From 083f60a6ee0d2d940e5c5c55663ce88a31ae40ef Mon Sep 17 00:00:00 2001 From: mintaka Date: Fri, 28 Aug 2026 00:48:02 -0400 Subject: [PATCH] refactor(rebrand): flip SEA-NNN issue refs to RIG-NNN across the tree (RIG-2804) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Number-preserving `SEA-` → `RIG-` sweep over the tracked compass tree, matching the settled orion #1829 (RIG-2569) pattern. The Linear team-key rename preserved issue numbers 1:1 (SEA-1512 == RIG-1512), so this is a pure token flip to match the live team name — no renumbering, no behavior change. Mechanical guarantee. Applied by a one-shot codemod matching `\bSEA-(\d+)\b`, then verified per file: for 344 of the 345 changed files, re-deriving the flip from the `main` version yields byte-identical output — i.e. the only change is `SEA-→RIG-`. 1515 refs across 345 files. The one exception is `docs/designs/DECISIONS.md`, which additionally flips 4 lowercase anchor-link slugs (`#...sea-1721...` → `#...rig-1721...`, likewise 1722/1723/1364). Those links target design-record headings whose text this flip renamed (`### A1 — SEA-1721:` → `### A1 — RIG-1721:`), so the heading's derived GitHub anchor moved to `rig-`; the link has to follow or it dangles. The design-ledger gate validates exactly these ledger→record anchors and is what surfaced it. Verified: DECISIONS.md deviates from the pure token flip on exactly those 4 lines and nothing else. Deliberately left untouched (the codemod does not match them): - lowercase `sea-` branch-slug artifacts (e.g. `compass-sea-1243-...`) — historical git branch names quoted in design records; the team rename does not rewrite the past. - `SEA-nnn` / `SEA-NNN` / `SEA-N` prose placeholders — the digit class rejects letters, so these stay as generic "some issue number" prose. No carve-outs needed. orion #1829's three (issue-owner dual-spell matcher, linear-auto-done TEAM_KEY, pr-title negative fixture) do not exist in compass (verified: zero TEAM_KEY consts, zero `(SEA|RIG)` dual-spell matchers, no SEA-detection negative fixture). The sole `forks/` file carrying a SEA ref is forks/README.md, first-party compass prose that flips like any authored file; vendored forks/** subtrees carry zero SEA issue refs. A follow-up commit adds tools/sea-ref-gate to keep the boundary from re-rotting. Spec-impact: none (issue-ref token flip; number-preserving; no externally-visible behavior change). Refs RIG-2804. Co-authored-by: Matt Wilkinson --- .github/secret_scanning.yml | 2 +- .github/workflows/ci.yml | 2 +- .github/workflows/eng-docs-deploy.yml | 2 +- .github/workflows/renovate.yml | 2 +- .markdownlint-cli2.jsonc | 4 +- .moon/workspace.yml | 12 +- apps/eng-docs/astro.config.mjs | 2 +- apps/eng-docs/moon.yml | 4 +- apps/eng-docs/package.json | 2 +- apps/eng-docs/scripts/deploy.ts | 2 +- apps/eng-docs/scripts/gather.ts | 4 +- apps/ui/.stylelintrc.cjs | 4 +- apps/ui/e2e/visual-smoke.spec.ts | 6 +- apps/ui/moon.yml | 2 +- apps/ui/playwright.config.ts | 2 +- apps/ui/src/app.css | 10 +- apps/ui/src/board-render.test.ts | 4 +- apps/ui/src/board-render.ts | 2 +- apps/ui/src/comms-stub.ts | 6 +- apps/ui/src/components/BadgeGlyph.test.tsx | 2 +- apps/ui/src/components/BadgeGlyph.tsx | 4 +- apps/ui/src/components/Bridge.test.tsx | 40 +++--- .../components/ChannelView.scroll.test.tsx | 2 +- apps/ui/src/components/ChannelView.test.tsx | 2 +- apps/ui/src/components/LeftSidebar.tsx | 2 +- apps/ui/src/components/MarkdownText.test.tsx | 4 +- apps/ui/src/components/MessageRow.test.tsx | 2 +- .../RightSidebar.fleetpane.test.tsx | 6 +- apps/ui/src/components/RightSidebar.test.ts | 4 +- apps/ui/src/components/RightSidebar.tsx | 8 +- apps/ui/src/components/SessionTrace.test.tsx | 2 +- apps/ui/src/constants.ts | 8 +- apps/ui/src/design/components.md | 4 +- apps/ui/src/design/components/badge-glyph.css | 2 +- apps/ui/src/design/surfaces.md | 8 +- apps/ui/src/design/tokens.css | 2 +- apps/ui/src/env-secrecy.test.ts | 4 +- apps/ui/src/live/adapt.test.ts | 14 +-- apps/ui/src/live/comms-state.test.ts | 2 +- apps/ui/src/live/comms-state.ts | 2 +- apps/ui/src/live/compass-fake.ts | 2 +- apps/ui/src/live/events.test.ts | 4 +- apps/ui/src/live/events.ts | 2 +- apps/ui/src/live/stream.test.ts | 4 +- apps/ui/src/live/stream.ts | 2 +- apps/ui/src/store.live.test.ts | 4 +- apps/ui/src/store.test.ts | 8 +- apps/ui/src/store.ts | 32 ++--- apps/ui/src/stub-data.ts | 62 +++++----- buf.gen.internal-go.yaml | 2 +- buf.gen.yaml | 2 +- buf.yaml | 4 +- config/prompts/manager/SYSTEM.md | 10 +- config/rules/own-your-issue.md | 2 +- config/skills/comms-playbook/SKILL.md | 4 +- config/skills/design/SKILL.md | 2 +- config/skills/jj/SKILL.md | 4 +- config/skills/management-trees/SKILL.md | 2 +- .../manager-coordination-channel/SKILL.md | 4 +- config/skills/review/SKILL.md | 4 +- config/skills/supervisor-channel/SKILL.md | 4 +- docs/designs/CONTRIBUTING.md | 6 +- docs/designs/DECISIONS.md | 60 ++++----- .../ci/compass-agent-image-publish/design.md | 8 +- .../design.md | 8 +- .../infra/ci/compass-dogfood-e2e/design.md | 62 +++++----- .../infra/ci/compass-dogfood-loop/design.md | 8 +- .../infra/ci/compass-local-dev/design.md | 22 ++-- .../infra/ci/compass-pr-validation/design.md | 2 +- .../compass-elastic-session-runtime/design.md | 10 +- .../design.md | 32 ++--- .../design.md | 8 +- .../compass-devenv-source-dry/design.md | 2 +- .../design.md | 6 +- .../compass-initial-prompt-removal.md | 14 +-- .../compass-runnerhub-send-queue/design.md | 8 +- .../compass-server-llm-gateway/design.md | 2 +- .../compass-server-runner-otel/design.md | 6 +- .../product/compass-ade-shell/design.md | 8 +- .../compass-agent-comms-tools/design.md | 8 +- .../compass-agent-config-delivery/design.md | 66 +++++----- .../design.md | 20 +-- .../compass-agent-container-runtime.md | 4 +- .../compass-agent-forge-tools/design.md | 2 +- .../compass-agent-org-mgmt-tools/design.md | 2 +- .../compass-agent-primary-lifecycle/design.md | 18 +-- .../compass-agent-runner-transport/design.md | 6 +- .../design.md | 76 ++++++------ .../compass-agent-spawn-despawn/design.md | 18 +-- .../design.md | 52 ++++---- .../product/compass-agent-trees/design.md | 16 +-- .../compass-ask-comms-roundtrip/design.md | 6 +- .../product/compass-ask-in-channel/design.md | 4 +- .../product/compass-ask-typed-derivation.md | 50 ++++---- .../product/compass-badge-clarity/design.md | 14 +-- .../compass-batteries-included/design.md | 116 +++++++++--------- .../product/compass-board-view/design.md | 2 +- .../product/compass-bridge-reclothe/design.md | 44 +++---- .../product/compass-dev-boot-gate/design.md | 2 +- .../compass-ds-token-cutover/design.md | 6 +- .../compass-first-turn-delivery/design.md | 40 +++--- .../design.md | 4 +- .../compass-forge-poll-driver/design.md | 16 +-- .../design.md | 2 +- .../product/compass-issue-model/design.md | 4 +- .../compass-linear-agent-responder/design.md | 8 +- .../product/compass-live-roster/design.md | 10 +- .../compass-manager-comms-substrate/design.md | 78 ++++++------ .../product/compass-manager-prompt/design.md | 100 +++++++-------- .../compass-mention-offline-redelivery.md | 8 +- .../design.md | 30 ++--- .../product/compass-native-app/design.md | 10 +- .../compass-native-client-mode/design.md | 2 +- .../compass-native-client-only/design.md | 2 +- .../compass-notification-delivery/design.md | 36 +++--- .../design.md | 2 +- .../compass-server-ownership-layer/design.md | 6 +- .../product/compass-session-trace-diff.md | 8 +- .../product/compass-shell-routing/design.md | 28 ++--- .../design.md | 8 +- .../product/compass-sidebar-pins/design.md | 10 +- .../product/compass-slack-thread-rendering.md | 8 +- .../product/compass-spawn-control/design.md | 12 +- .../design.md | 36 +++--- .../design.md | 8 +- docs/designs/product/compass-tauri-shell.md | 2 +- .../product/compass-ui-fixture-boot/design.md | 4 +- .../product/compass-ui-query-layer/design.md | 16 +-- .../product/compass-ux-foundation/design.md | 26 ++-- .../compass-zulip-threading-model/design.md | 32 ++--- docs/designs/repo/compass-drop-proto.md | 12 +- docs/designs/repo/compass-eng-docs/design.md | 12 +- .../repo/compass-renovate-migration.md | 12 +- docs/specs/product/compass.md | 8 +- forks/README.md | 2 +- go/.golangci.yml | 4 +- go/cmd/compass-server/main.go | 6 +- .../compass-stack/integration_podman_test.go | 2 +- go/cmd/compass/main.go | 2 +- go/e2e/agent_ops.go | 2 +- go/e2e/cannedmodel.go | 2 +- go/e2e/cannedmodel_test.go | 2 +- go/e2e/clients.go | 2 +- go/e2e/fixture.go | 16 +-- go/e2e/legthreefour_test.go | 4 +- go/e2e/legtwo_test.go | 2 +- go/e2e/teardown.go | 2 +- go/gen/compass/v1/comms.pb.go | 8 +- go/gen/compass/v1/compass.pb.go | 10 +- go/internal/auth/admin_gate_test.go | 2 +- go/internal/auth/interceptor_pgtest_test.go | 2 +- go/internal/auth/interceptor_test.go | 2 +- go/internal/auth/stream_test.go | 2 +- go/internal/auth/token_test.go | 2 +- go/internal/comms/agent_caller.go | 2 +- .../comms/agent_conversation_pgtest_test.go | 2 +- .../comms/channel_policy_pgtest_test.go | 2 +- go/internal/comms/comms.go | 8 +- go/internal/comms/comms_test.go | 4 +- go/internal/comms/coordination.go | 4 +- go/internal/comms/coordination_pgtest_test.go | 2 +- go/internal/comms/mapping.go | 2 +- go/internal/comms/pinned_board_pgtest_test.go | 2 +- go/internal/comms/roster_pgtest_test.go | 2 +- go/internal/comms/subscribe.go | 4 +- go/internal/comms/subscribe_test.go | 2 +- go/internal/delivery/consumer.go | 4 +- go/internal/delivery/consumer_test.go | 8 +- go/internal/delivery/mention_test.go | 2 +- go/internal/delivery/pin_sweep_test.go | 2 +- go/internal/delivery/reap_test.go | 2 +- go/internal/delivery/settle.go | 2 +- go/internal/delivery/sweep_test.go | 2 +- go/internal/forge/golden_capture_test.go | 2 +- go/internal/forge/linear_test.go | 10 +- go/internal/forge/notify_reader_test.go | 2 +- .../testdata/linear/comment_on_issue.json | 4 +- .../forge/testdata/linear/create_issue.json | 4 +- .../forge/testdata/linear/get_issue.json | 4 +- .../forge/testdata/linear/list_issues.json | 4 +- go/internal/gen/compass/v1/agent.pb.go | 22 ++-- .../gen/compass/v1/agent_gateway.pb.go | 4 +- .../agent_gateway.connect.go | 2 +- .../guest_control.connect.go | 2 +- .../runner.connect.go | 8 +- go/internal/gen/compass/v1/forge.pb.go | 2 +- .../gen/compass/v1/guest_control.pb.go | 2 +- go/internal/gen/compass/v1/runner.pb.go | 16 +-- go/internal/presence/activity_test.go | 2 +- go/internal/presence/presence.go | 2 +- go/internal/presence/presence_test.go | 2 +- go/internal/runner/agent_exec.go | 2 +- go/internal/runner/config_fetch.go | 2 +- go/internal/runner/config_materialize.go | 2 +- go/internal/runner/config_materialize_test.go | 4 +- go/internal/runner/config_refresh_test.go | 4 +- go/internal/runner/dispatch.go | 2 +- go/internal/runner/e2e_transport_test.go | 4 +- go/internal/runner/gateway/control_test.go | 6 +- go/internal/runner/gateway/gateway_test.go | 2 +- .../runner/gateway/post_conversation_frame.go | 6 +- go/internal/runner/gateway/socket.go | 2 +- .../runner/gateway/socket_podman_test.go | 2 +- go/internal/runner/gateway/socket_test.go | 2 +- .../runner/gateway/telemetry_ingest_test.go | 6 +- go/internal/runner/host.go | 14 +-- go/internal/runner/host_test.go | 4 +- go/internal/runner/run_test.go | 2 +- go/internal/runnerhub/commands.go | 2 +- go/internal/runnerhub/commands_test.go | 4 +- go/internal/runnerhub/commit_frame_test.go | 2 +- go/internal/runnerhub/deliveryarm_test.go | 6 +- go/internal/runnerhub/dispatch_control.go | 4 +- go/internal/runnerhub/enroll_reap_test.go | 2 +- go/internal/runnerhub/handler.go | 2 +- go/internal/runnerhub/hub.go | 48 ++++---- go/internal/runnerhub/hub_test.go | 2 +- go/internal/runnerhub/presence_test.go | 2 +- go/internal/runnerhub/provision_dedup_test.go | 4 +- go/internal/runnerhub/reconstruct.go | 2 +- go/internal/runnerhub/reconstruct_test.go | 2 +- go/internal/runnerhub/relay_comms.go | 14 +-- go/internal/runnerhub/relay_comms_test.go | 10 +- .../runnerhub/relay_roster_setstatus_test.go | 2 +- go/internal/runnerhub/resume_start.go | 2 +- go/internal/runnerhub/router.go | 6 +- go/internal/runnerhub/sessionstart_test.go | 2 +- go/internal/runtime/config_mount_test.go | 2 +- go/internal/runtime/portability_test.go | 4 +- go/internal/runtime/secrets_materialize.go | 4 +- .../secrets_materialize_podman_test.go | 2 +- go/internal/secrets/resolver.go | 2 +- go/internal/secrets/resolver_test.go | 4 +- go/internal/secrets/secrets.go | 2 +- go/internal/stack/config.go | 2 +- go/internal/stack/spec_test.go | 2 +- go/internal/store/accounts.go | 4 +- go/internal/store/agent_config.go | 12 +- go/internal/store/agent_config_pgtest_test.go | 4 +- go/internal/store/agent_config_test.go | 6 +- go/internal/store/agent_placements.go | 6 +- go/internal/store/agent_placements_test.go | 2 +- go/internal/store/agent_transcripts.go | 2 +- go/internal/store/agent_transcripts_test.go | 2 +- .../store/channel_policy_pgtest_test.go | 2 +- go/internal/store/channels.go | 4 +- go/internal/store/coordination.go | 2 +- go/internal/store/coordination_pgtest_test.go | 2 +- go/internal/store/delivery_cursors.go | 2 +- go/internal/store/delivery_cursors_test.go | 2 +- go/internal/store/delivery_reads.go | 2 +- go/internal/store/delivery_reads_test.go | 2 +- go/internal/store/errors.go | 2 +- go/internal/store/forge_cursors.go | 2 +- .../store/forge_cursors_pgtest_test.go | 2 +- go/internal/store/gen_credential_keys.go | 2 +- go/internal/store/inputs.go | 4 +- go/internal/store/issues_pgtest_test.go | 2 +- go/internal/store/messages.go | 8 +- .../store/messages_authored_update_test.go | 2 +- go/internal/store/messages_snapshot_test.go | 8 +- go/internal/store/messages_test.go | 16 +-- go/internal/store/migrations/0001_init.sql | 20 +-- go/internal/store/objectstore.go | 2 +- go/internal/store/presence_reads.go | 2 +- go/internal/store/presence_reads_test.go | 2 +- go/internal/store/secrets.go | 2 +- go/internal/store/secrets_test.go | 2 +- go/internal/store/store.go | 4 +- go/internal/store/types.go | 6 +- go/internal/tokenstore/keyring_test.go | 4 +- go/internal/tokenstore/tokenstore.go | 4 +- go/server/agent_config_service.go | 2 +- go/server/agent_config_service_pgtest_test.go | 2 +- go/server/comms_actor_pgtest_test.go | 2 +- go/server/cors_pgtest_test.go | 2 +- go/server/dev_door_pgtest_test.go | 2 +- go/server/forge_notify_matrix_test.go | 14 +-- go/server/lifecycle_e2e_pgtest_test.go | 4 +- go/server/network_door.go | 8 +- go/server/network_door_deadline_test.go | 2 +- .../network_door_proxy_bypass_pgtest_test.go | 2 +- go/server/network_door_test.go | 2 +- .../runner_enroll_compose_pgtest_test.go | 2 +- go/server/secrets_service.go | 2 +- go/server/serve.go | 28 ++--- go/server/serve_admin_handle_pgtest_test.go | 2 +- go/server/serve_forge_pgtest_test.go | 2 +- go/server/serve_forge_test.go | 2 +- go/server/serve_pgtest_test.go | 2 +- go/server/serve_seed.go | 4 +- go/server/service.go | 6 +- go/server/service_placement_pgtest_test.go | 4 +- go/server/service_resume_pgtest_test.go | 2 +- go/server/service_sessionend_pgtest_test.go | 2 +- go/server/sinks.go | 18 +-- .../scripts/verify-abort-mutants.test.ts | 2 +- packages/compass-agent/src/agent.test.ts | 16 +-- packages/compass-agent/src/agent.ts | 20 +-- .../src/cli.config-passthrough.test.ts | 6 +- packages/compass-agent/src/cli.test.ts | 30 ++--- packages/compass-agent/src/cli.ts | 28 ++--- packages/compass-agent/src/comms.test.ts | 4 +- packages/compass-agent/src/comms.ts | 2 +- packages/compass-agent/src/compassv1.ts | 8 +- .../src/config-passthrough-probe.ts | 2 +- packages/compass-agent/src/config-reader.ts | 2 +- packages/compass-agent/src/frame.ts | 10 +- .../src/gen/compass/v1/agent_gateway_pb.ts | 4 +- .../src/gen/compass/v1/agent_pb.ts | 22 ++-- .../src/gen/compass/v1/comms_pb.ts | 8 +- .../src/gen/compass/v1/compass_pb.ts | 12 +- .../src/gen/compass/v1/forge_pb.ts | 2 +- packages/compass-agent/src/lifecycle.ts | 2 +- packages/compass-agent/src/mapping.test.ts | 2 +- packages/compass-agent/src/mapping.ts | 4 +- .../compass-agent/src/session-tee.test.ts | 4 +- packages/compass-agent/src/session-tee.ts | 8 +- .../src/transport/control-source.test.ts | 12 +- .../src/transport/control-source.ts | 32 ++--- .../src/transport/control/ack-cursor.test.ts | 2 +- .../src/transport/control/ack-cursor.ts | 4 +- .../src/transport/control/buffer.test.ts | 2 +- .../src/transport/frame-sink.test.ts | 6 +- .../compass-agent/src/transport/frame-sink.ts | 8 +- .../compass-agent/src/transport/index.test.ts | 2 +- packages/compass-agent/src/transport/index.ts | 4 +- .../src/gen/compass/v1/comms_pb.ts | 8 +- .../src/gen/compass/v1/compass_pb.ts | 12 +- proto/compass/v1/agent.proto | 22 ++-- proto/compass/v1/agent_gateway.proto | 4 +- proto/compass/v1/comms.proto | 8 +- proto/compass/v1/compass.proto | 12 +- proto/compass/v1/forge.proto | 2 +- proto/compass/v1/guest_control.proto | 2 +- proto/compass/v1/runner.proto | 22 ++-- proto/moon.yml | 14 +-- tools/design-ledger-gate/index.ts | 2 +- tools/design-ledger-gate/moon.yml | 4 +- tools/design-ledger-gate/package.json | 2 +- tools/forge-linear-token/index.ts | 4 +- tools/renovate/config.json5 | 4 +- tools/stamp-gate/moon.yml | 2 +- tools/stamp-gate/package.json | 2 +- tools/stamp-gate/stamp-gate.ts | 2 +- 345 files changed, 1435 insertions(+), 1435 deletions(-) diff --git a/.github/secret_scanning.yml b/.github/secret_scanning.yml index 6cf6411b3..3715858db 100644 --- a/.github/secret_scanning.yml +++ b/.github/secret_scanning.yml @@ -4,7 +4,7 @@ # protection for them (excluded paths are exempt from both — GitHub Docs, # "Excluding folders and files from secret scanning"). # -# forks/*/** — vendored fork subtrees (SEA-1512, SEA-1514). These trees are +# forks/*/** — vendored fork subtrees (RIG-1512, RIG-1514). These trees are # byte-for-byte copies of their upstreams, imported and kept object-identical so # they round-trip cleanly to their public spokes via Copybara. They legitimately # carry upstream's own committed constants that secret scanning flags — e.g. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 58a3e5929..2ced8a199 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1798,7 +1798,7 @@ jobs: # otherwise → pull the published image. On a PR that leaves the image # untouched (and on every push to main, where the detection step does # not run and image_affected is unset), test the last-published - # `:latest`. The image is public (SEA-1690; Matt-ruled public), so this + # `:latest`. The image is public (RIG-1690; Matt-ruled public), so this # pulls with no login, no credential, and no `packages: read`. The # mutable `:latest` tag is intentional (Matt-ruled always-fresh) — do # NOT "fix" it to a digest pin; the gate is meant to test whatever main diff --git a/.github/workflows/eng-docs-deploy.yml b/.github/workflows/eng-docs-deploy.yml index 6f5876067..691ef0a59 100644 --- a/.github/workflows/eng-docs-deploy.yml +++ b/.github/workflows/eng-docs-deploy.yml @@ -2,7 +2,7 @@ # # A push to main deploys production; a pull_request deploys a per-PR Cloudflare # Pages preview and upserts the preview-URL comment (apps/eng-docs/scripts/ -# deploy.ts, SEA-1765). This is a STANDALONE CD workflow — it is deliberately +# deploy.ts, RIG-1765). This is a STANDALONE CD workflow — it is deliberately # NOT part of `moon ci :ci` (the CI gate in ci.yml), so a deploy failure never # gates a merge and a green CI never waits on Cloudflare. name: eng-docs diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index dde8d2c00..522cbde70 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -106,7 +106,7 @@ jobs: - name: Assert devenv is on PATH # Fail loud at setup if the shim is missing, rather than exit-127ing # silently on the first channel-bump branch and shipping a half-refreshed - # devenv.lock (the SEA-1304/RIG-2245 regression class). + # devenv.lock (the RIG-1304/RIG-2245 regression class). run: command -v devenv - name: Mint the Renovate App installation token diff --git a/.markdownlint-cli2.jsonc b/.markdownlint-cli2.jsonc index 4737a1d39..bdcfc8ae3 100644 --- a/.markdownlint-cli2.jsonc +++ b/.markdownlint-cli2.jsonc @@ -2,10 +2,10 @@ // Rules live in .markdownlint.json. This file scopes markdownlint-cli2 to the // whole repo, honoring .gitignore (skips node_modules + build outputs). // Exclusions: - // - forks/ — vendored upstream fork subtrees (SEA-1512). The glob is + // - forks/ — vendored upstream fork subtrees (RIG-1512). The glob is // `forks/*/**`, not `forks/**`: the first-party forks/README.md stays // linted; only the fork trees under it are exempt. - // - config/prompts/** + config/agents/** — agent-context PAYLOADS (SEA-1732), + // - config/prompts/** + config/agents/** — agent-context PAYLOADS (RIG-1732), // not docsite prose: these files are loaded verbatim into a model's context // (the config-delivery bundle, packages/compass-agent/src/config-reader.ts), // and their shape is fixed by the frozen manager-prompt design record diff --git a/.moon/workspace.yml b/.moon/workspace.yml index 8060e696a..be70056d1 100644 --- a/.moon/workspace.yml +++ b/.moon/workspace.yml @@ -23,7 +23,7 @@ projects: # The SolidJS web UI. compass-ui: 'apps/ui' # The public engineering docsite: Astro Starlight rendering the reviewed - # docs/ tree to a public Cloudflare Pages site (SEA-1763). + # docs/ tree to a public Cloudflare Pages site (RIG-1763). compass-eng-docs: 'apps/eng-docs' # The backend Go module: server + comms + the generated compass.v1 Go stubs. compass-go: 'go' @@ -65,13 +65,13 @@ projects: toolchain-parity: 'tools/toolchain' # The generator-stamp gate: asserts the checked-in gen trees' `@generated by` # headers agree with each other and with the nixpkgs protoc-gen-es on PATH - # (SEA-1405). Separate from compass-proto because its subject is the plugin + # (RIG-1405). Separate from compass-proto because its subject is the plugin # rather than the schema. stamp-gate: 'tools/stamp-gate' # The design-ledger gate: validates the Compass design-decision ledger # (docs/designs/DECISIONS.md), the per-record `Status:` headers, and - # dangling supersession/Record pointers (SEA-1187). Migrated from the sealed - # repo with the corpus it governs (SEA-1794). + # dangling supersession/Record pointers (RIG-1187). Migrated from the sealed + # repo with the corpus it governs (RIG-1794). design-ledger-gate: 'tools/design-ledger-gate' # The orion-ref-gate boundary gate (RIG-2489): fail-closed scan that the PUBLIC # compass repo carries no reference to the PRIVATE internal monorepo. Mirrors @@ -81,7 +81,7 @@ projects: orion-ref-gate: 'tools/orion-ref-gate' # The cx-token consumption gate: scans apps/ui/src CSS for raw hex, --rigel-* # primitives, and literal duration/easing values banned outside tokens.css - # (D2/D9 consumption rule; SEA-1812). Mirrors design-ledger-gate; the mark + # (D2/D9 consumption rule; RIG-1812). Mirrors design-ledger-gate; the mark # file's --rigel-purple is the one narrow allowlist. WARN until the adoption # step-5 flip, then ERROR. cx-token-gate: 'tools/cx-token-gate' @@ -121,7 +121,7 @@ projects: # query projects`, or the generator's zero-untagged assertion never covers the # very tool that enforces it. ci-matrix: 'tools/ci-matrix' - # Vendored upstream fork subtrees (forks/, SEA-1512). Each carries its + # Vendored upstream fork subtrees (forks/, RIG-1512). Each carries its # own nix-driven build as functional CI — so a fork-only change is gated by # the fork's own suite — while its tree stays exempt from the style gates # (biome + markdownlint exclusions). moon discovers projects from this diff --git a/apps/eng-docs/astro.config.mjs b/apps/eng-docs/astro.config.mjs index d52a26b10..609c82b70 100644 --- a/apps/eng-docs/astro.config.mjs +++ b/apps/eng-docs/astro.config.mjs @@ -4,7 +4,7 @@ import starlight from "@astrojs/starlight"; import { defineConfig } from "astro/config"; import { sidebar } from "./src/sidebar.generated.ts"; -// Public engineering docsite (SEA-1763). Renders the compass monorepo's +// Public engineering docsite (RIG-1763). Renders the compass monorepo's // reviewed markdown — the docs/ tree gathered into src/content/docs/ by // scripts/gather.ts — to a public Cloudflare Pages site. This is PUBLIC: no // auth gate and no analytics. Shares the Rigel brand (Night Owl diff --git a/apps/eng-docs/moon.yml b/apps/eng-docs/moon.yml index 6a4bd035d..4dd985d99 100644 --- a/apps/eng-docs/moon.yml +++ b/apps/eng-docs/moon.yml @@ -1,6 +1,6 @@ # yaml-language-server: $schema=https://moonrepo.dev/schemas/project.json # -# Public engineering docsite (SEA-1763). Astro Starlight rendering the reviewed +# Public engineering docsite (RIG-1763). Astro Starlight rendering the reviewed # docs/ tree to a public Cloudflare Pages site. System tasks: bun/astro from the # devenv toolchain on PATH. install/lint/format are inherited (bun tag → # root:install; biome + markdownlint are the root whole-repo sweep, which lints @@ -75,7 +75,7 @@ tasks: # Deploy dist/ to Cloudflare Pages. CD (runInCI:false): `deploy` on push:main # (production), `deploy-preview` on pull_request (a per-branch preview URL). - # Both run deploy.ts, which is ported in T3 (SEA-1765); until then this task + # Both run deploy.ts, which is ported in T3 (RIG-1765); until then this task # is declared for the graph shape but never runs (runInCI:false, and no local # invocation in T1). deploy: &deploy-task diff --git a/apps/eng-docs/package.json b/apps/eng-docs/package.json index bf902692a..ad617a666 100644 --- a/apps/eng-docs/package.json +++ b/apps/eng-docs/package.json @@ -2,7 +2,7 @@ "name": "@compass/eng-docs", "private": true, "type": "module", - "description": "Public engineering docsite (Astro Starlight, SEA-1763). Renders the compass monorepo's reviewed markdown to a public Cloudflare Pages site. Content under src/content/docs/ is generated by scripts/gather.ts from the repo's docs/ tree and is gitignored; edit the canonical sources, not the generated copy.", + "description": "Public engineering docsite (Astro Starlight, RIG-1763). Renders the compass monorepo's reviewed markdown to a public Cloudflare Pages site. Content under src/content/docs/ is generated by scripts/gather.ts from the repo's docs/ tree and is gitignored; edit the canonical sources, not the generated copy.", "scripts": { "gather": "bun scripts/gather.ts", "dev": "bun run gather && astro dev", diff --git a/apps/eng-docs/scripts/deploy.ts b/apps/eng-docs/scripts/deploy.ts index 535f5f417..799e1ed6a 100644 --- a/apps/eng-docs/scripts/deploy.ts +++ b/apps/eng-docs/scripts/deploy.ts @@ -2,7 +2,7 @@ // preview-URL comment. Invoked by the compass-eng-docs:deploy / // compass-eng-docs:deploy-preview moon tasks (CD, runInCI:false) — gated to // push:main / pull_request by the standalone .github/workflows/eng-docs-deploy.yml -// GitHub Actions workflow (SEA-1765). The engineering docsite lives on +// GitHub Actions workflow (RIG-1765). The engineering docsite lives on // Cloudflare Pages under the compass-eng-docs project. // // Adapted from sealed apps/docs/scripts/deploy.ts — they share the same diff --git a/apps/eng-docs/scripts/gather.ts b/apps/eng-docs/scripts/gather.ts index 4f5c50f48..afd76eba9 100644 --- a/apps/eng-docs/scripts/gather.ts +++ b/apps/eng-docs/scripts/gather.ts @@ -1,5 +1,5 @@ // Gather the reviewed monorepo markdown into the Starlight content collection -// (SEA-1764). The canonical sources carry no frontmatter and open with a `# H1`; +// (RIG-1764). The canonical sources carry no frontmatter and open with a `# H1`; // Starlight's docsSchema requires a `title`. This mirrors each source into // apps/eng-docs/src/content/docs/ with a derived `title:` block, the now- // duplicated body H1 removed, and in-repo links rewritten to site routes / @@ -370,7 +370,7 @@ export function buildSidebar(sections: readonly string[]): string { return ( "// Generated by scripts/gather.ts — do not edit.\n" + "// The monorepo docsite sidebar, one group per populated nav section\n" + - "// (SEA-1764). Regenerated on every gather; gitignored like the content mirror.\n" + + "// (RIG-1764). Regenerated on every gather; gitignored like the content mirror.\n" + `export const sidebar = ${JSON.stringify(groups, null, "\t")};\n` ); } diff --git a/apps/ui/.stylelintrc.cjs b/apps/ui/.stylelintrc.cjs index 8474d0ce0..abdc22008 100644 --- a/apps/ui/.stylelintrc.cjs +++ b/apps/ui/.stylelintrc.cjs @@ -1,4 +1,4 @@ -// D7 stylelint guard (SEA-2034 T6) — the DS-token-cutover ratchet. +// D7 stylelint guard (RIG-2034 T6) — the DS-token-cutover ratchet. // // Bans, at ERROR severity (stylelint's default; a violation exits non-zero and // fails `moon run compass-ui:stylelint` -> CI), the vocabulary the cutover @@ -17,7 +17,7 @@ // lane removes on migration (Matt ruling 2026-08-15) — the ratchet stays whole, // so any NEW raw motion reds CI. // -// Refs SEA-2034; design: docs/designs/product/compass-ds-token-cutover/design.md (e) +// Refs RIG-2034; design: docs/designs/product/compass-ds-token-cutover/design.md (e) module.exports = { rules: { // D7 ban 1a — raw hex color literals. Catches hex in properties stylelint diff --git a/apps/ui/e2e/visual-smoke.spec.ts b/apps/ui/e2e/visual-smoke.spec.ts index 2a253097f..db01f016d 100644 --- a/apps/ui/e2e/visual-smoke.spec.ts +++ b/apps/ui/e2e/visual-smoke.spec.ts @@ -1,6 +1,6 @@ import { test } from "@playwright/test"; -// Visual-smoke harness (SEA-2034 T1). Navigates the HashRouter surfaces of the +// Visual-smoke harness (RIG-2034 T1). Navigates the HashRouter surfaces of the // app and writes one full-page PNG per surface into e2e/__screens__/ for Matt's // before/after review. The webServer boots the app under `--mode fixture`, so // the app boots fully on the in-memory fixture store (stub-data.ts) with no @@ -49,12 +49,12 @@ test.describe("visual smoke — legacy-palette baseline", () => { await page.locator(".bridge").waitFor({ state: "visible" }); // Drive the real interaction path so the PR pane actually renders: the // pane is shown only when an issue is selected AND the PR tab is active. - // Select the compass-ui issue (SEA-1022 / PR #453) — its review set carries a + // Select the compass-ui issue (RIG-1022 / PR #453) — its review set carries a // `commented` verdict, so the shot captures the recolored review-pending // (faint-grey) chip alongside the approved chips. That review-pending // value is the only one with a visual delta in this PR: approved/changes // map to alias tokens (--cx-ok/--cx-error) that are unchanged. - const card = page.locator(".cx-card", { hasText: "SEA-1022" }).first(); + const card = page.locator(".cx-card", { hasText: "RIG-1022" }).first(); await card.waitFor({ state: "visible" }); await card.click(); await page.getByRole("button", { name: "Pull request" }).click(); diff --git a/apps/ui/moon.yml b/apps/ui/moon.yml index 0ab63e086..40c005977 100644 --- a/apps/ui/moon.yml +++ b/apps/ui/moon.yml @@ -49,7 +49,7 @@ tasks: # cached-green, precisely on the config change the gate exists to catch. inputs: ['src/**/*', 'index.html', 'tsconfig.json', 'package.json', 'vite.config.ts', '/bun.lock', '/packages/compass-client/src/**/*', '/packages/compass-client/package.json'] stylelint: - # D7 guard (SEA-2034 T6): bans raw hex, --rigel-* refs, literal + # D7 guard (RIG-2034 T6): bans raw hex, --rigel-* refs, literal # durations/easings, and the retired legacy var vocabulary outside # design/tokens.css. Error severity is stylelint's default — any violation # exits non-zero and fails this task (and, via ci deps, the CI gate). diff --git a/apps/ui/playwright.config.ts b/apps/ui/playwright.config.ts index 31feff454..7a7152cc1 100644 --- a/apps/ui/playwright.config.ts +++ b/apps/ui/playwright.config.ts @@ -1,7 +1,7 @@ import { createServer } from "node:net"; import { defineConfig, devices } from "@playwright/test"; -// The repo's first browser harness (SEA-2034 T1). Drives `vite dev` against the +// The repo's first browser harness (RIG-2034 T1). Drives `vite dev` against the // in-memory stub store (the app boots fully on stub-data.ts — no daemon, no // Tauri IPC) and captures full-page screenshots of the core surfaces for Matt's // human review. This is a smoke harness: no pixel-diff gating, no computed-style diff --git a/apps/ui/src/app.css b/apps/ui/src/app.css index 4fe684778..908bfe805 100644 --- a/apps/ui/src/app.css +++ b/apps/ui/src/app.css @@ -273,7 +273,7 @@ width: 10px; display: inline-flex; justify-content: center; - /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s grandfathered by the SEA-2034 cutover lane, which never scoped the motion axis */ + /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s grandfathered by the RIG-2034 cutover lane, which never scoped the motion axis */ transition: transform 0.12s; } @@ -924,7 +924,7 @@ .ws-caret { display: inline-block; - /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s/ease grandfathered by the SEA-2034 cutover lane, which never scoped the motion axis */ + /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s/ease grandfathered by the RIG-2034 cutover lane, which never scoped the motion axis */ transition: transform 0.12s ease; } @@ -1675,7 +1675,7 @@ .backlog-chevron { color: var(--cx-text-faint); font-size: 10px; - /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s/ease grandfathered by the SEA-2034 cutover lane, which never scoped the motion axis */ + /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s/ease grandfathered by the RIG-2034 cutover lane, which never scoped the motion axis */ transition: transform 0.12s ease; } @@ -2288,7 +2288,7 @@ color: var(--cx-text); } -/* An unreachable pin's tab is dimmed (SEA-1645 P2) so the activity bar itself +/* An unreachable pin's tab is dimmed (RIG-1645 P2) so the activity bar itself * distinguishes a dead pin from a live one — the affirmative visual mark that * pairs with the title's "(unreachable)" suffix and the absent StateDot. */ .r-tab.unreachable { @@ -2913,7 +2913,7 @@ .browse-caret { display: inline-block; - /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s/ease grandfathered by the SEA-2034 cutover lane, which never scoped the motion axis */ + /* stylelint-disable-next-line declaration-property-value-disallowed-list -- TODO(motion migration, D9/foundation-T8): raw 0.12s/ease grandfathered by the RIG-2034 cutover lane, which never scoped the motion axis */ transition: transform 0.12s ease; margin-right: 4px; color: var(--cx-text-faint); diff --git a/apps/ui/src/board-render.test.ts b/apps/ui/src/board-render.test.ts index 05bf48c6f..2bfeeb33f 100644 --- a/apps/ui/src/board-render.test.ts +++ b/apps/ui/src/board-render.test.ts @@ -146,12 +146,12 @@ describe("issueKey + isMultiForge", () => { const linked = issue({ tracker: { kind: "linear", - id: "SEA-1042", + id: "RIG-1042", status: "In Progress", url: "", }, }); - expect(issueKey(linked, true)).toBe("SEA-1042"); + expect(issueKey(linked, true)).toBe("RIG-1042"); }); test("coordinate repo#number when no tracker and single-forge", () => { diff --git a/apps/ui/src/board-render.ts b/apps/ui/src/board-render.ts index b1a14fcab..4ae0d2ee7 100644 --- a/apps/ui/src/board-render.ts +++ b/apps/ui/src/board-render.ts @@ -62,7 +62,7 @@ export function prBadge( } /** The user-facing card key for a board item (DL-071). The tracker id in its - * native form when linked (e.g. `SEA-1042`), else the forge coordinate + * native form when linked (e.g. `RIG-1042`), else the forge coordinate * `${repo}#${number}` — host-qualified `${host}/${repo}#${number}` only when * the board holds artifacts from more than one distinct ForgeRef, so two * artifacts never collide on `repo` alone. Both forms always renderable, no diff --git a/apps/ui/src/comms-stub.ts b/apps/ui/src/comms-stub.ts index 2895545b0..2dac41892 100644 --- a/apps/ui/src/comms-stub.ts +++ b/apps/ui/src/comms-stub.ts @@ -255,7 +255,7 @@ const MATT_ACCOUNT: Account = { kind: "user", }; -/** The reserved platform system sender `@compass` (SEA-1820). A third account +/** The reserved platform system sender `@compass` (RIG-1820). A third account * kind alongside the caller and agents — never a roster/directory entry (it is * not a STUB_AGENTS row, so it never enters the agent tree), but it IS a comms * account so its posts render with the system-author style and an `@compass` @@ -536,7 +536,7 @@ export const STUB_MESSAGES: Message[] = [ { questionId: "q1", question: - "Q2 (live-daemon integration CI) — new sub-issue, or fold into SEA-1023?", + "Q2 (live-daemon integration CI) — new sub-issue, or fold into RIG-1023?", allowMultiple: false, chosenOptionIds: [], options: [ @@ -548,7 +548,7 @@ export const STUB_MESSAGES: Message[] = [ }, { id: "opt-fold", - label: "Fold into SEA-1023", + label: "Fold into RIG-1023", description: "Keep it under the one ACP session lane.", }, ], diff --git a/apps/ui/src/components/BadgeGlyph.test.tsx b/apps/ui/src/components/BadgeGlyph.test.tsx index 26f30f42e..fcca1a6ce 100644 --- a/apps/ui/src/components/BadgeGlyph.test.tsx +++ b/apps/ui/src/components/BadgeGlyph.test.tsx @@ -2,7 +2,7 @@ import { describe, expect, test } from "bun:test"; import { render } from "@solidjs/testing-library"; import { BadgeGlyph } from "./BadgeGlyph"; -// BadgeGlyph's observable contract (SEA-2121 / SEA-2117 Option B): each badge is +// BadgeGlyph's observable contract (RIG-2121 / RIG-2117 Option B): each badge is // a wrapper carrying the axis+status as data-attributes (the single source of // truth for color routing), a 2-char axis code, and a 9×9 crispEdges SVG glyph // whose lit `` count is the frozen glyph geometry. The tests pin the diff --git a/apps/ui/src/components/BadgeGlyph.tsx b/apps/ui/src/components/BadgeGlyph.tsx index ff5ee1790..2d5e06fa3 100644 --- a/apps/ui/src/components/BadgeGlyph.tsx +++ b/apps/ui/src/components/BadgeGlyph.tsx @@ -1,6 +1,6 @@ import { type Component, For } from "solid-js"; -/** The axis+status badge (SEA-2117 / SEA-2121, design compass-badge-clarity +/** The axis+status badge (RIG-2117 / RIG-2121, design compass-badge-clarity * Option B): a fixed 2-char axis code (`CI` / `RV`) in the DS mono UI face, * followed by a 9×9 1-bit pixel-art glyph carrying the status. Code and glyph * share the status color — the wrapper's `data-axis`+`data-status` route @@ -14,7 +14,7 @@ import { type Component, For } from "solid-js"; * `data-compact`). * * Consumers (IssueCard / Bridge / DoneView) are flipped in a separate slice - * (SEA-2122); this component is the primitive they will adopt. */ + * (RIG-2122); this component is the primitive they will adopt. */ type CiStatus = "success" | "pending" | "failure"; type ReviewStatus = "approved" | "changes" | "commented"; diff --git a/apps/ui/src/components/Bridge.test.tsx b/apps/ui/src/components/Bridge.test.tsx index 9d7df40b0..585211c6c 100644 --- a/apps/ui/src/components/Bridge.test.tsx +++ b/apps/ui/src/components/Bridge.test.tsx @@ -301,7 +301,7 @@ describe("Bridge card badges (Record B §3)", () => { // so these drive real window `keydown`s (the same seam the dispatcher listens // on) and assert against the live DOM + store. The fixture has no swimlane // multi-card cell, so the multi-card traversal is exercised in status mode (the -// in_review column stacks SEA-1022/1085/847) and the empty-cell skip in swimlane +// in_review column stacks RIG-1022/1085/847) and the empty-cell skip in swimlane // mode (compass-ui's queued/blocked cells are empty between its cards). const boardGrouping = (container: HTMLElement): HTMLElement | null => container.querySelector('[aria-label="Board grouping"]'); @@ -365,7 +365,7 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { test("the cursor seeds to the selected card (store seeds STUB_ISSUES[0])", () => { const { store, container } = mountBridge(); expect(store.selectedIssueId()).toBe(STUB_ISSUES[0].id); // ws-1022 - expect(cursorLabel(container)).toBe("Issue SEA-1022"); + expect(cursorLabel(container)).toBe("Issue RIG-1022"); }); // Keyboard-driving tests re-host onto the full shell (`mountApp`) so the @@ -376,28 +376,28 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { test("Up/Down traverse a multi-card column (status mode in_review stack)", () => { const { container } = mountApp("/"); clickGrouping(container, "Status"); - // The in_review column stacks three cards; the cursor rests on SEA-1022. - expect(cursorLabel(container)).toBe("Issue SEA-1022"); + // The in_review column stacks three cards; the cursor rests on RIG-1022. + expect(cursorLabel(container)).toBe("Issue RIG-1022"); enterBoard(container); press({ key: "ArrowDown" }); - expect(cursorLabel(container)).toBe("Issue SEA-1085"); + expect(cursorLabel(container)).toBe("Issue RIG-1085"); press({ key: "ArrowDown" }); - expect(cursorLabel(container)).toBe("Issue SEA-847"); + expect(cursorLabel(container)).toBe("Issue RIG-847"); // No wrap: Down at the column end clamps. press({ key: "ArrowDown" }); - expect(cursorLabel(container)).toBe("Issue SEA-847"); + expect(cursorLabel(container)).toBe("Issue RIG-847"); press({ key: "ArrowUp" }); - expect(cursorLabel(container)).toBe("Issue SEA-1085"); + expect(cursorLabel(container)).toBe("Issue RIG-1085"); }); test("Left skips empty cells and lands on the row gutter (swimlane)", () => { const { container } = mountApp("/"); - // compass-ui's row: SEA-1022 (in_review) and SEA-965 (in_progress) are the + // compass-ui's row: RIG-1022 (in_review) and RIG-965 (in_progress) are the // only cards; queued/blocked cells are empty, and the gutter is column -1. - expect(cursorLabel(container)).toBe("Issue SEA-1022"); + expect(cursorLabel(container)).toBe("Issue RIG-1022"); enterBoard(container); press({ key: "ArrowLeft" }); - expect(cursorLabel(container)).toBe("Issue SEA-965"); // in_progress + expect(cursorLabel(container)).toBe("Issue RIG-965"); // in_progress press({ key: "ArrowLeft" }); // The empty queued/blocked cells are skipped — straight to the gutter head. expect(cursorLabel(container)).toBe("compass-ui lane"); @@ -410,7 +410,7 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { const { store, container } = mountApp("/"); clickGrouping(container, "Status"); enterBoard(container); - press({ key: "ArrowDown" }); // cursor → SEA-1085 (ws-1085) + press({ key: "ArrowDown" }); // cursor → RIG-1085 (ws-1085) const event = press({ key: "Enter" }); expect(store.selectedIssueId()).toBe("ws-1085"); expect(event.defaultPrevented).toBe(true); @@ -440,7 +440,7 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { scope: "main", run: () => commsSendRan++, }); - // Cursor on SEA-1022 (assignee acc-compass-ui). Shift+Enter opens the agent. + // Cursor on RIG-1022 (assignee acc-compass-ui). Shift+Enter opens the agent. enterBoard(container); const event = press({ key: "Enter", shiftKey: true }); expect(event.defaultPrevented).toBe(true); @@ -454,7 +454,7 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { test("Space fires the cursor card's cross-link (Issues → PRs)", () => { const { store, container } = mountApp("/"); - // Cursor SEA-1022 has a PR chip; Space is its cross-link (select + flip). + // Cursor RIG-1022 has a PR chip; Space is its cross-link (select + flip). enterBoard(container); const event = press({ key: " " }); expect(event.defaultPrevented).toBe(true); @@ -464,12 +464,12 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { test("Space on a chip-less card is still claimed (no select, no scroll, no fall-through)", () => { const { store, container } = mountApp("/"); - // Move to SEA-965 (compass-ui, in_progress) — an issue with no PR, so no + // Move to RIG-965 (compass-ui, in_progress) — an issue with no PR, so no // cross-link. Space must STILL be claimed: the handler reports handled, the // dispatcher preventDefaults, and nothing selects / scrolls / falls through. enterBoard(container); press({ key: "ArrowLeft" }); - expect(cursorLabel(container)).toBe("Issue SEA-965"); + expect(cursorLabel(container)).toBe("Issue RIG-965"); const selectedBefore = store.selectedIssueId(); const event = press({ key: " " }); expect(event.defaultPrevented).toBe(true); // claimed → native scroll suppressed @@ -494,7 +494,7 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { const { container } = mountBridge(); const cursor = container.querySelector('[tabindex="0"]'); if (!cursor) throw new Error("no cursor stop"); - expect(cursor.getAttribute("aria-label")).toBe("Issue SEA-1022"); + expect(cursor.getAttribute("aria-label")).toBe("Issue RIG-1022"); expect(cursor.getAttribute("aria-description")).toContain("column"); // The cursor card names the Space cross-link (design §491). expect(cursor.getAttribute("aria-keyshortcuts")).toBe("Space"); @@ -520,7 +520,7 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { // + `.bridge-lane` gutters); the Unassigned lane is a non-interactive
, // so `button.…` selects only real stops in DOM order. const { container } = mountBridge(); - expect(cursorLabel(container)).toBe("Issue SEA-1022"); + expect(cursorLabel(container)).toBe("Issue RIG-1022"); clickTab(container, "PRs"); const stops = container.querySelectorAll( "button.cx-card, button.bridge-lane", @@ -540,9 +540,9 @@ describe("Bridge board roving group (T4, DL-220/221)", () => { // A plain click still selects, exactly as before the roving group. const cards = [...container.querySelectorAll(".cx-card")]; const target = cards.find((c) => - c.getAttribute("aria-label")?.includes("SEA-965"), + c.getAttribute("aria-label")?.includes("RIG-965"), ); - if (!target) throw new Error("no SEA-965 card"); + if (!target) throw new Error("no RIG-965 card"); fireEvent.click(target); flushSync(); expect(store.selectedIssueId()).toBe("ws-965"); diff --git a/apps/ui/src/components/ChannelView.scroll.test.tsx b/apps/ui/src/components/ChannelView.scroll.test.tsx index 3e6600997..7101207ab 100644 --- a/apps/ui/src/components/ChannelView.scroll.test.tsx +++ b/apps/ui/src/components/ChannelView.scroll.test.tsx @@ -387,7 +387,7 @@ describe("MessageStream scroll contract", () => { // Case (10): the .conv-sizer carries the flex-shrink guard so the virtual // scroll range survives .conv-stream being a flex column. REGRESSION for the - // P1 (SEA-1332 / PR #886): the scroller is `display: flex; flex-direction: + // P1 (RIG-1332 / PR #886): the scroller is `display: flex; flex-direction: // column`, so an unpinned sizer flex-shrinks below its set getTotalSize() // height once the content exceeds the viewport — collapsing scrollHeight to // one screen and stranding every message past the first viewport. diff --git a/apps/ui/src/components/ChannelView.test.tsx b/apps/ui/src/components/ChannelView.test.tsx index 31c1bd307..e64ef4c21 100644 --- a/apps/ui/src/components/ChannelView.test.tsx +++ b/apps/ui/src/components/ChannelView.test.tsx @@ -387,7 +387,7 @@ describe("ChannelView is a composerless topic index (T5 model boundary)", () => }); // The @compass system-sender mention resolves as KNOWN through the REAL store, -// end to end (SEA-1820 T5). The unit test in MarkdownText.test.tsx builds a +// end to end (RIG-1820 T5). The unit test in MarkdownText.test.tsx builds a // local byHandle with a hardcoded compass entry, and identity.test.ts pins that // STUB_ACCOUNTS carries the system sender — this closes the loop between them: // it renders TopicView over the actual offline store (whose byHandle is built diff --git a/apps/ui/src/components/LeftSidebar.tsx b/apps/ui/src/components/LeftSidebar.tsx index 3a7abcf98..dc647c58d 100644 --- a/apps/ui/src/components/LeftSidebar.tsx +++ b/apps/ui/src/components/LeftSidebar.tsx @@ -22,7 +22,7 @@ import { StateDot } from "./StateDot"; /** An agent leaf row in the tree — the per-agent select button, plus a hover * pin/unpin affordance on the right (Record A §T4). Renders the same StateDot / - * handle / non-worker role-pip (SEA-1623: pip left alone) for both a childless + * handle / non-worker role-pip (RIG-1623: pip left alone) for both a childless * leaf and a parent agent's own row. An optional descendant badge trails the * row when the agent has children. The pin toggle sits as a sibling BUTTON * outside the select button (a button can't nest a button), calling diff --git a/apps/ui/src/components/MarkdownText.test.tsx b/apps/ui/src/components/MarkdownText.test.tsx index 74880e191..815ed1aee 100644 --- a/apps/ui/src/components/MarkdownText.test.tsx +++ b/apps/ui/src/components/MarkdownText.test.tsx @@ -37,7 +37,7 @@ afterEach(() => { // A byHandle map keyed lowercase, exactly as ChannelView builds it // (ChannelView.tsx:364-365). "cook" is a known account; "compass" is the known -// system sender (SEA-1820 — resolves like any known account, NOT reserved); +// system sender (RIG-1820 — resolves like any known account, NOT reserved); // "everyone" is reserved (comms-stub.ts:175); "ghost" is unknown (absent). function byHandle(): Map { const cook: Account = { @@ -137,7 +137,7 @@ describe("MarkdownText — mention composition", () => { }); test("the @compass system sender chips as known — not reserved, not unknown", () => { - // SEA-1820: @compass resolves like any known account (accent chip), NOT a + // RIG-1820: @compass resolves like any known account (accent chip), NOT a // reserved broadcast target. The `reserved` modifier is purple (mark-only // per DL-155), so a system-sender mention must never carry it; and being a // resolved account it is not `unknown` either. diff --git a/apps/ui/src/components/MessageRow.test.tsx b/apps/ui/src/components/MessageRow.test.tsx index 6f1d76975..0e7f5fd00 100644 --- a/apps/ui/src/components/MessageRow.test.tsx +++ b/apps/ui/src/components/MessageRow.test.tsx @@ -6,7 +6,7 @@ import { MessageRow } from "./ChannelView"; // The message row's author-style contract: a row's `.msg` element carries the // author's `kind` (`user`/`agent`/`system`) as a modifier class, so each sender // reads distinctly. The system arm is the reserved `@compass` platform sender -// (SEA-1820 T5) — without its own class it would render styled as a plain user. +// (RIG-1820 T5) — without its own class it would render styled as a plain user. // MessageRow is rendered directly (no virtualizer/store) so the assertion pins // the class mapping alone. diff --git a/apps/ui/src/components/RightSidebar.fleetpane.test.tsx b/apps/ui/src/components/RightSidebar.fleetpane.test.tsx index 46891d4c3..44b3be4e8 100644 --- a/apps/ui/src/components/RightSidebar.fleetpane.test.tsx +++ b/apps/ui/src/components/RightSidebar.fleetpane.test.tsx @@ -56,7 +56,7 @@ function mountRightSidebar(): { store: AppStore; container: HTMLElement } { // The two visible fixture agents whose home-DM the fleet pane renders. The fleet // tabs are CONFIGURABLE PINS keyed `agent:${accountId}` (Record A §T2), not a // hardcoded Supervisor · Cook pair. The pane arm reads the active tab's item -// out of `rightTabGroups()` (SEA-1645 P2), which emits only PINNED agents, so a +// out of `rightTabGroups()` (RIG-1645 P2), which emits only PINNED agents, so a // test must pin the agent before activating its tab. Both ids resolve in the // fixture, so once pinned the pane renders their home-DM inline. const FLEET_TABS = ["acc-supervisor", "acc-compass-ui"] as const; @@ -191,7 +191,7 @@ describe("RightSidebar fleet pane", () => { }); // A resolved fleet tab renders the live pane, not the unreachable block: the - // pane arm resolves reachability first (SEA-1645). Both real fleet tabs + // pane arm resolves reachability first (RIG-1645). Both real fleet tabs // resolve, so this asserts the resolved tab renders a fleet-pane with no // in-pane unpin control — the observable inverse that reddens if the arm ever // stops resolving a live agent. @@ -208,7 +208,7 @@ describe("RightSidebar fleet pane", () => { // An active GHOST pin (an id resolving to no fixture agent) renders the "agent // unreachable" pane — the message and a working in-pane unpin control — not - // FleetPane and not StatusPane (SEA-1645 P2/P6). The pin must exist for the + // FleetPane and not StatusPane (RIG-1645 P2/P6). The pin must exist for the // pane arm to read its item out of rightTabGroups(), so pin then activate. test("an active ghost pin renders the unreachable pane with a working unpin", () => { const { store, container } = mountRightSidebar(); diff --git a/apps/ui/src/components/RightSidebar.test.ts b/apps/ui/src/components/RightSidebar.test.ts index d325d06df..e484b17ec 100644 --- a/apps/ui/src/components/RightSidebar.test.ts +++ b/apps/ui/src/components/RightSidebar.test.ts @@ -179,7 +179,7 @@ describe("rightTabGroups() derivation (Record A §T2)", () => { }); // An unresolvable pin (no visible agent for the id) now surfaces a MARKED - // activity-bar item (SEA-1645) — the derivation no longer filters. The + // activity-bar item (RIG-1645) — the derivation no longer filters. The // resolvable pin beside it is unmarked, so the marking is selective. test("an unresolvable pin surfaces a marked fleet item", () => { withGroups( @@ -215,7 +215,7 @@ describe("rightTabGroups() derivation (Record A §T2)", () => { } // The UNMARKED fleet items with an agentId are exactly the resolvable // pins, each resolving a real stub agent. A marked (unreachable) item - // may carry an agentId that resolves no stub (SEA-1645), so exclude it. + // may carry an agentId that resolves no stub (RIG-1645), so exclude it. const withAgent = (fleet?.items ?? []).filter( (item) => item.agentId !== undefined && item.unreachable !== true, ); diff --git a/apps/ui/src/components/RightSidebar.tsx b/apps/ui/src/components/RightSidebar.tsx index aa35e1241..70275eb41 100644 --- a/apps/ui/src/components/RightSidebar.tsx +++ b/apps/ui/src/components/RightSidebar.tsx @@ -423,7 +423,7 @@ const RepoBranchDropdown: Component = () => { * conversation inline (asks answerable in place — first-responder-wins, per * the ask-in-channel record), above a compact header control that opens the * agent's full workspace via store.openAgent. Only rendered for a RESOLVABLE - * pin (SEA-1645 P2): the pane arm resolves reachability before choosing this + * pin (RIG-1645 P2): the pane arm resolves reachability before choosing this * vs the unreachable block, so there is no unresolved-agentId fallback here. */ const FleetPane: Component<{ item: ActivityBarItem }> = (props) => { const store = useStore(); @@ -454,7 +454,7 @@ const FleetPane: Component<{ item: ActivityBarItem }> = (props) => { ); }; -/** An unreachable pin's pane (SEA-1645 P2): the pinned agent no longer resolves +/** An unreachable pin's pane (RIG-1645 P2): the pinned agent no longer resolves * (dead / despawned / filtered out). Shows an empty-state message styled like * the other `term-empty` panes and a WORKING unpin control — the only unpin * affordance for an unreachable pin, whose left-tree row is gone (the tree @@ -566,7 +566,7 @@ export const RightSidebar: Component = () => { const active = store.activeRightTab(); return active === "status" || active.startsWith("agent:"); }; - // The active tab's fleet pane item, for any `agent:`-prefixed pin (SEA-1645 + // The active tab's fleet pane item, for any `agent:`-prefixed pin (RIG-1645 // P2). The P1 `rightTabGroups()` memo already emits an item for EVERY pin // (marked unreachable or not) with the cached-handle title; read it out rather // than resolving/rebuilding a second time — this is the SINGLE @@ -603,7 +603,7 @@ export const RightSidebar: Component = () => { )} - {/* Defensive close (SEA-1645 P2): an `agent:` tab that matches no + {/* Defensive close (RIG-1645 P2): an `agent:` tab that matches no pin in rightTabGroups() lands on status rather than a blank pane. Unreachable via the current UI — setActiveRightTab is only ever called with a pinned bar-item id, "status", or an diff --git a/apps/ui/src/components/SessionTrace.test.tsx b/apps/ui/src/components/SessionTrace.test.tsx index a6bbe4912..e8dcb0ab8 100644 --- a/apps/ui/src/components/SessionTrace.test.tsx +++ b/apps/ui/src/components/SessionTrace.test.tsx @@ -253,7 +253,7 @@ describe("SessionTrace (T-U2)", () => { // A notice whose link carries a dangerous scheme (javascript:/data:) must // render NO navigable anchor. Once the live session-event stream feeds these - // links (SEA-1342), the link is untrusted agent input; an unhardened + // links (RIG-1342), the link is untrusted agent input; an unhardened // `href={link}` would make it clickable (stored-XSS-adjacent). The scheme // allow-list (safe-url.ts) gates the anchor. Pre-fix (`href={href()}` with no // gate) the anchor renders → red. diff --git a/apps/ui/src/constants.ts b/apps/ui/src/constants.ts index fe3fd9d64..e849da0d0 100644 --- a/apps/ui/src/constants.ts +++ b/apps/ui/src/constants.ts @@ -87,9 +87,9 @@ export interface ActivityBarItem { group: RightTabGroup; /** Fleet agent tabs: the agent whose `StateDot` badges the tab icon. On an * unreachable pin this is the pinned id that resolves to no visible agent, so - * it carries no live `StateDot` (SEA-1645). */ + * it carries no live `StateDot` (RIG-1645). */ agentId?: string; - /** Fleet agent tabs (SEA-1645): true when the pinned agent no longer resolves + /** Fleet agent tabs (RIG-1645): true when the pinned agent no longer resolves * to a visible agent (dead / despawned / filtered out). Absent/false = live. * The activity bar and the pane render the unreachable state for a marked * item. */ @@ -124,7 +124,7 @@ export const RIGHT_SIDEBAR_ISSUE_ITEMS: readonly ActivityBarItem[] = Object.values(RIGHT_SIDEBAR_TAB_BY_ID).filter((t) => t.group === "issue"); /** Build the fleet activity-bar item for a RESOLVABLE pinned agent (Record A - * §T2; SEA-1645 P1). The tab id is the `agent:`-prefixed account id (the open + * §T2; RIG-1645 P1). The tab id is the `agent:`-prefixed account id (the open * arm of `RightSidebarTab`); the icon is the agent handle's initial (matching * the UI's glyph-icon convention — a per-agent glyph, no hardcoded Supervisor * ◆), and the title is the LIVE agent handle. The item is left @@ -141,7 +141,7 @@ export function fleetItemForAgent(agent: Agent): ActivityBarItem { }; } -/** Build the fleet activity-bar item for an UNRESOLVABLE pin (SEA-1645 P1): its +/** Build the fleet activity-bar item for an UNRESOLVABLE pin (RIG-1645 P1): its * agent no longer resolves to a visible agent (dead / despawned / filtered * out). The label is the handle cached at pin time (P0), so the item shows the * human name the user pinned rather than an opaque id (a legacy `{ id, handle: diff --git a/apps/ui/src/design/components.md b/apps/ui/src/design/components.md index c88a2e3c6..94bf08ce7 100644 --- a/apps/ui/src/design/components.md +++ b/apps/ui/src/design/components.md @@ -84,7 +84,7 @@ plus the accent left rule, never a raised background. `--cx-text-xs`, `--cx-space-1/-2/-4/-5`, `--cx-radius-sm`, `--cx-motion-fast`, `--cx-ease-out`, `--cx-focus-ring`. -### Axis badge — `.cx-axis-badge` (SEA-2117 / SEA-2121, shipped variant) +### Axis badge — `.cx-axis-badge` (RIG-2117 / RIG-2121, shipped variant) - **Classes:** `.cx-axis-badge` · `data-axis` (`ci | review`) · `data-status` · `data-compact`; contains `.cx-axis-code` (the `CI` / `RV` mono label) and a @@ -203,7 +203,7 @@ plus the accent left rule, never a raised background. The public `rigel.build` DS docs still show the earlier flat-dot badge form. Porting this axis-badge variant (the code + 9×9 glyph grids above) to that surface is tracked as a follow-up, out of scope for the Compass adoption -(SEA-2117 Q5). Until then, the grids here are canonical. +(RIG-2117 Q5). Until then, the grids here are canonical. ## State dot diff --git a/apps/ui/src/design/components/badge-glyph.css b/apps/ui/src/design/components/badge-glyph.css index 80337e29e..179d71466 100644 --- a/apps/ui/src/design/components/badge-glyph.css +++ b/apps/ui/src/design/components/badge-glyph.css @@ -1,4 +1,4 @@ -/* Axis badge — .cx-axis-badge (SEA-2117 / SEA-2121, design +/* Axis badge — .cx-axis-badge (RIG-2117 / RIG-2121, design compass-badge-clarity Option B). A fixed 2-char axis code (`CI` / `RV`) in the mono UI face + a 9×9 1-bit pixel-art status glyph, both riding the status color. The wrapper's data-axis+data-status is the single source of truth: it diff --git a/apps/ui/src/design/surfaces.md b/apps/ui/src/design/surfaces.md index eb0aa786e..4fe7cced8 100644 --- a/apps/ui/src/design/surfaces.md +++ b/apps/ui/src/design/surfaces.md @@ -181,7 +181,7 @@ pane states the unreachable condition explicitly. dot, both component glyphs, not the brand mark. **Flip checklist.** This flip sequences after the unreachable-pin lane -(DL-113 / SEA-1645) merges; until then the right sidebar stays on the current +(DL-113 / RIG-1645) merges; until then the right sidebar stays on the current vocabulary. 1. Replace the activity bar with `.cx-tabs[data-orientation="v"]`; render pinned, @@ -247,7 +247,7 @@ open-PR count). **Mark placement.** None. The board is glyph-dense with state dots and status badges; the brand mark does not appear on it. -**Flip checklist.** This flip sequences after the board-remodel lane (SEA-1633) +**Flip checklist.** This flip sequences after the board-remodel lane (RIG-1633) merges. If the token and component contracts land first, that lane should build directly against `.cx-*` and skip the build-on-legacy-then-re-skin double-work. @@ -450,7 +450,7 @@ The render contract: view code serves both. **Deferred.** In-window tabs (Linear-style) and in-window split views are deferred -to the Beta milestone (SEA-1808) and are not built here. The decomposition is +to the Beta milestone (RIG-1808) and are not built here. The decomposition is designed to admit both later without rework — a tab strip or a splitter hosts the same window-scoped views — but neither ships in the dogfood scope. @@ -458,7 +458,7 @@ same window-scoped views — but neither ships in the dogfood scope. shell. The frozen compass-native record (`compass-native-app/design.md`, DL-110) is single-window today: one window loading the built UI. This decomposition expands that scope, so compass-native's shell record needs a multi-window -amendment (SEA-1684's lane) before the views can be hosted in separate OS +amendment (RIG-1684's lane) before the views can be hosted in separate OS windows. This is a dependency to track, not a blocker on the view decomposition itself — the views are independently mountable regardless of how many windows host them. diff --git a/apps/ui/src/design/tokens.css b/apps/ui/src/design/tokens.css index 8af3d5f18..d1a82e15a 100644 --- a/apps/ui/src/design/tokens.css +++ b/apps/ui/src/design/tokens.css @@ -153,7 +153,7 @@ /* --- Message author (voice) — the system/@compass author color. User and agent authors reuse existing semantic tokens (--cx-accent / --cx-ok); only the system voice needs its own. Magenta, the closest non-purple decorative - primitive to the retired legacy --pink; purple stays mark-only (SEA-2008). */ + primitive to the retired legacy --pink; purple stays mark-only (RIG-2008). */ --cx-author-system: var(--rigel-magenta); /* --- Editor theme (--cx-ed-*) — embedded editor/Shiki share the chrome palette (D8) --- */ diff --git a/apps/ui/src/env-secrecy.test.ts b/apps/ui/src/env-secrecy.test.ts index c1bbbfa78..62b669833 100644 --- a/apps/ui/src/env-secrecy.test.ts +++ b/apps/ui/src/env-secrecy.test.ts @@ -4,7 +4,7 @@ // app. No moon task consumes these paths (they are inputs to nothing that // lints, tests, or scans), so review is the ONLY thing between a committed token // and an exfiltrated one — and review is exactly what missed it the first time -// (SEA-1539). This gate gives the `.gitignore` rules teeth so they cannot +// (RIG-1539). This gate gives the `.gitignore` rules teeth so they cannot // silently re-widen, and — the property that actually matters — pins the real // tracked set so it can never grow past the one dev-defaults file. // @@ -87,7 +87,7 @@ describe("env-secrecy gate (no new committable .env; tracked env set pinned to d expect( envFiles, unexpected.length > 0 - ? `Unexpected tracked env file(s) under apps/ui: [${unexpected.join(", ")}]. A VITE_* value in any tracked env file is baked into dist/ and shipped to every browser (SEA-1539). Untrack it (git rm --cached ); only ${DEV_DEFAULTS} (loopback dev defaults, no secret) may be tracked.` + ? `Unexpected tracked env file(s) under apps/ui: [${unexpected.join(", ")}]. A VITE_* value in any tracked env file is baked into dist/ and shipped to every browser (RIG-1539). Untrack it (git rm --cached ); only ${DEV_DEFAULTS} (loopback dev defaults, no secret) may be tracked.` : "", ).toEqual([DEV_DEFAULTS]); }); diff --git a/apps/ui/src/live/adapt.test.ts b/apps/ui/src/live/adapt.test.ts index 4f90ae55d..41b137a67 100644 --- a/apps/ui/src/live/adapt.test.ts +++ b/apps/ui/src/live/adapt.test.ts @@ -757,7 +757,7 @@ describe("adaptTopic", () => { }); }); -// ── Board (SEA-1729 read slice): adaptIssue / adaptPullRequest ─────────────── +// ── Board (RIG-1729 read slice): adaptIssue / adaptPullRequest ─────────────── // These defend the wire→domain bridges the board read path depends on: the // total IssueState/ForgeProvider enum maps, the empty-string→null assignee seam, // the forge-truth string narrowing, and the nested PR/review/thread mapping. @@ -879,7 +879,7 @@ describe("adaptIssue", () => { title: "read slice", body: "stripped", forgeState: "open", - url: "https://linear.app/SEA-1729", + url: "https://linear.app/RIG-1729", agent: { agentHandle: "cook" }, forgeAccount: "matt", labels: ["p1", "ui"], @@ -897,9 +897,9 @@ describe("adaptIssue", () => { ], tracker: { kind: "linear", - id: "SEA-1729", + id: "RIG-1729", status: "In Progress", - url: "https://linear.app/SEA-1729", + url: "https://linear.app/RIG-1729", }, }), ); @@ -910,7 +910,7 @@ describe("adaptIssue", () => { expect(r.title).toBe("read slice"); expect(r.body).toBe("stripped"); expect(r.forgeState).toBe("open"); - expect(r.url).toBe("https://linear.app/SEA-1729"); + expect(r.url).toBe("https://linear.app/RIG-1729"); expect(r.agent).toEqual({ agentHandle: "cook", ownerHandle: "", @@ -927,9 +927,9 @@ describe("adaptIssue", () => { expect(r.prs[0].repo).toBe("SEA"); expect(r.tracker).toEqual({ kind: "linear", - id: "SEA-1729", + id: "RIG-1729", status: "In Progress", - url: "https://linear.app/SEA-1729", + url: "https://linear.app/RIG-1729", }); }); diff --git a/apps/ui/src/live/comms-state.test.ts b/apps/ui/src/live/comms-state.test.ts index 321db4626..c00f728da 100644 --- a/apps/ui/src/live/comms-state.test.ts +++ b/apps/ui/src/live/comms-state.test.ts @@ -23,7 +23,7 @@ import { // comms-state.ts is the pure live-comms reducer: reduceSnapshot turns a raw // snapshot into a fresh CommsState (wire→domain adaptation + (atUnixMs,id) // message sort), and applyEvent folds one already-decoded stream event into the -// next state. The reducer is now CURSOR-FREE (SEA-1333 correction): the stream +// next state. The reducer is now CURSOR-FREE (RIG-1333 correction): the stream // `seq` and instance epoch are driver-local transport bookkeeping in stream.ts, // deliberately kept OUT of the reduced domain state, so there is no cursor to // carry or assert here. These tests defend the contracts a plausible refactor diff --git a/apps/ui/src/live/comms-state.ts b/apps/ui/src/live/comms-state.ts index 0a7467f7d..8343e4cb2 100644 --- a/apps/ui/src/live/comms-state.ts +++ b/apps/ui/src/live/comms-state.ts @@ -53,7 +53,7 @@ export type MapMessage = (wire: unknown) => Message; * snapshot token and the stream tail cursor two SEPARATE counters — the client * never conflates the point-in-time read boundary with the live tail position, * so it stays gap-free whether the snapshot boundary resolves as bus-space or - * store-space (SEA-1333 amendment to the T2 contract). */ + * store-space (RIG-1333 amendment to the T2 contract). */ export interface CommsState { readonly accounts: readonly Account[]; readonly channelGroups: readonly ChannelGroup[]; diff --git a/apps/ui/src/live/compass-fake.ts b/apps/ui/src/live/compass-fake.ts index 62fb3d31c..d052d77f2 100644 --- a/apps/ui/src/live/compass-fake.ts +++ b/apps/ui/src/live/compass-fake.ts @@ -87,7 +87,7 @@ export function createFakeCompass(): FakeCompass { } return { accountId: whoAmIAccountId.accountId }; }, - // The board read stream (SEA-1729). This double drives only the + // The board read stream (RIG-1729). This double drives only the // agent-lifecycle + probe paths, so the event stream yields NOTHING and // holds open until the caller aborts — mirroring the real transport (a // gRPC-Web call ends its response stream on abort) and comms-fake's diff --git a/apps/ui/src/live/events.test.ts b/apps/ui/src/live/events.test.ts index 585cc018d..54791d073 100644 --- a/apps/ui/src/live/events.test.ts +++ b/apps/ui/src/live/events.test.ts @@ -13,7 +13,7 @@ import { import type { Issue as DomainIssue } from "../stub-data"; import { runEventStream } from "./events"; -// The SubscribeEvents read-driver seam (SEA-1729 read slice). A fake server is a +// The SubscribeEvents read-driver seam (RIG-1729 read slice). A fake server is a // `createRouterTransport` handler serving CompassService.SubscribeEvents — the // vendor's documented no-HTTP test path — so the round-trip exercises the real // driver + adapt boundary, never a mock. The handler is an async generator that @@ -111,7 +111,7 @@ async function drainUntil(predicate: () => boolean): Promise { } } -describe("runEventStream (SEA-1729 read driver)", () => { +describe("runEventStream (RIG-1729 read driver)", () => { test("pushes adapted domain issues; a repeat id REPLACES (upsert)", async () => { const transport = scriptedTransport([ issueResp(1n, "a", { title: "first", state: IssueState.TODO }), diff --git a/apps/ui/src/live/events.ts b/apps/ui/src/live/events.ts index b83d7724f..ef343f69d 100644 --- a/apps/ui/src/live/events.ts +++ b/apps/ui/src/live/events.ts @@ -2,7 +2,7 @@ // server event stream (compass.v1 CompassService.SubscribeEvents) into a // sequence of domain Issue[] snapshots for the board. // -// This is the READ half of SEA-1729. It mirrors the comms driver's +// This is the READ half of RIG-1729. It mirrors the comms driver's // (./stream.ts runCommsStream) snapshot+tail shape: a cold-start subscription // pairs the durable board re-snapshot read (ListBoardIssues) with the live // SubscribeEvents tail, unioned into one board map and deduped by issue id diff --git a/apps/ui/src/live/stream.test.ts b/apps/ui/src/live/stream.test.ts index 95bc84335..b572b25c8 100644 --- a/apps/ui/src/live/stream.test.ts +++ b/apps/ui/src/live/stream.test.ts @@ -21,7 +21,7 @@ import { fetchSnapshot, runCommsStream } from "./stream"; // stream.ts is the SubscribeComms driver: it applies the established // snapshot+tail+resync protocol over a CommsClient, pushing each reduced state // to onState. It owns the TWO transport cursors kept out of the reducer -// (SEA-1333): the read-RPC boundary `snapshotSeq` (an opaque token forwarded +// (RIG-1333): the read-RPC boundary `snapshotSeq` (an opaque token forwarded // verbatim to every list call, NEVER a tail cursor) and the stream tail cursor, // which advances from `SubscribeCommsResponse.seq` (the stream's own counter). // These tests drive it against a hand-written fake client (no network, no @@ -474,7 +474,7 @@ describe("runCommsStream — resync + reconnect", () => { expect(calls.listAccountsSeqs).toEqual([100n, 200n]); }); - test("a clean stream drop resubscribes gap-free from the STREAM seq — never snapshotSeq, never 0 (SEA-1333 two-counter regression)", async () => { + test("a clean stream drop resubscribes gap-free from the STREAM seq — never snapshotSeq, never 0 (RIG-1333 two-counter regression)", async () => { const controller = new AbortController(); // The regression fixture: the boundary snapshotSeq (500) and the tail seqs // (1,2,3) are DIFFERENT number spaces on purpose. A driver that conflated diff --git a/apps/ui/src/live/stream.ts b/apps/ui/src/live/stream.ts index 6e00b8fe4..7689b5ce9 100644 --- a/apps/ui/src/live/stream.ts +++ b/apps/ui/src/live/stream.ts @@ -22,7 +22,7 @@ // The two cursors are kept apart on PURPOSE. `snapshot_seq` (the read-RPC // boundary) and the stream `seq` (the tail cursor) are two counters doing two // jobs, and the frozen design line "tail from snapshot_seq + 1" conflated them. -// Under the SEA-1333 amendment the snapshot boundary may resolve as store-space +// Under the RIG-1333 amendment the snapshot boundary may resolve as store-space // (durable BIGSERIAL) while the stream seq is bus-space (resets per boot) — the // two are incomparable, so any arithmetic across them silently drops rows after // a restart. This driver treats snapshot_seq as an opaque token and tails from diff --git a/apps/ui/src/store.live.test.ts b/apps/ui/src/store.live.test.ts index 260229800..2148caee3 100644 --- a/apps/ui/src/store.live.test.ts +++ b/apps/ui/src/store.live.test.ts @@ -1118,7 +1118,7 @@ describe("store agents() live join (§T3)", () => { }); }); - // The SEA-1645 reactivity the store.ts:790-795 comment owed: `agentById` + // The RIG-1645 reactivity the store.ts:790-795 comment owed: `agentById` // resolves through the reactive `agents()` memo, so a presence tick flips its // answer. A tail AgentPresenceChanged upserts acc-idle's lifecycle and the // seam re-resolves stopped→working with no accessor swap. @@ -1152,7 +1152,7 @@ describe("store agents() live join (§T3)", () => { }); }); - // L3 (SEA-2100): a chat-message tail must NOT recompute the agents() join. + // L3 (RIG-2100): a chat-message tail must NOT recompute the agents() join. // The memo depends only on accounts()/presence(); a MessagePosted touches // messages() with structural sharing, so accounts/presence keep identity and // agents() returns the SAME array reference. Reference equality is the point: diff --git a/apps/ui/src/store.test.ts b/apps/ui/src/store.test.ts index 2a4534da9..d0671795a 100644 --- a/apps/ui/src/store.test.ts +++ b/apps/ui/src/store.test.ts @@ -367,7 +367,7 @@ describe("openAgent", () => { // `selectedChannelId` on either path — so a standalone channel opened in // between can never bleed into the workspace, and re-opening the already-open // agent (early-return path) restores the agent view without disturbing the - // standalone selection (PR #783 / SEA-1195). + // standalone selection (PR #783 / RIG-1195). test("re-opening the agent-view agent shows its home DM while leaving the standalone selection intact", () => { withStore((s) => { s.openAgent("acc-compass-ui"); // agentViewAgentId = compass-ui @@ -644,7 +644,7 @@ describe("agent pins (Record A §T2/T3/T5)", () => { }); // Write-through: pinning persists to the workspace-namespaced key as - // `{ id, handle }` pairs (SEA-1645 P0), so a fresh store on the same workspace + // `{ id, handle }` pairs (RIG-1645 P0), so a fresh store on the same workspace // re-hydrates the pin with its cached handle. test("writes pins through to localStorage on pin", () => { clearStorage(); @@ -693,7 +693,7 @@ describe("agent pins (Record A §T2/T3/T5)", () => { clearStorage(); }); - // SEA-1645: an ACTIVE agent tab whose id resolves to no visible agent (a ghost + // RIG-1645: an ACTIVE agent tab whose id resolves to no visible agent (a ghost // pin, or a visibility fluctuation) is NOT coerced — the resolvability guard is // retired. The tab stays put and the pane renders the unreachable state; only a // deliberate unpin removes it. @@ -746,7 +746,7 @@ describe("agent pins (Record A §T2/T3/T5)", () => { clearStorage(); }); - // ── SEA-1645 unreachable pins (ghost pin: an id resolving to no fixture + // ── RIG-1645 unreachable pins (ghost pin: an id resolving to no fixture // agent) ── // A ghost pin KEEPS its bar item, marked unreachable, in pin order, and its // title is the handle cached at pin time — not filtered out. diff --git a/apps/ui/src/store.ts b/apps/ui/src/store.ts index 765920a7e..6529edd8e 100644 --- a/apps/ui/src/store.ts +++ b/apps/ui/src/store.ts @@ -102,7 +102,7 @@ export type IssueTab = "files" | "vcs" | "pr"; export type RightSidebarTab = PinnedAgentTab | "status" | IssueTab; /** A persisted pin: the agent's account id plus the handle cached at pin time - * (SEA-1645). The cached handle is the degraded label an unreachable pin renders + * (RIG-1645). The cached handle is the degraded label an unreachable pin renders * when its agent no longer resolves — so a dropped/despawned pin still shows the * human name the user pinned, not an opaque id. A resolvable pin always renders * its LIVE handle (via `fleetItemForAgent`), so the cache only ever surfaces @@ -336,7 +336,7 @@ export interface AppStore { toggleAgent: (agentId: string) => void; // ── Right sidebar: activity-bar tabs + pins + repos (T6; dock-in-sidebar D1; - // Record A §T2/T3; unreachable-pin amendment SEA-1645) ── + // Record A §T2/T3; unreachable-pin amendment RIG-1645) ── /** The active right-sidebar tab: a pinned agent conversation * (`agent:${accountId}`), the `status` fleet pane, or an issue tab (Files / * VCS / PR). */ @@ -349,7 +349,7 @@ export interface AppStore { * id-valued view of `pinnedAgents()` for its existing consumers. */ pinnedAgentIds: Accessor; /** The pinned agents as `{ id, handle }` pairs, in pin order — the handle is - * cached at pin time (SEA-1645) so an unreachable pin renders the name the + * cached at pin time (RIG-1645) so an unreachable pin renders the name the * user pinned. Persisted per workspace in `localStorage`. */ pinnedAgents: Accessor; /** Pin an agent's conversation to the fleet activity bar (append if new). */ @@ -359,13 +359,13 @@ export interface AppStore { /** Whether an agent id is in the pin set. */ isPinned: (accountId: string) => boolean; /** Resolve an account id to its visible agent, or undefined — the single - * agent-resolution seam (SEA-1645 P5). A REACTIVE read: consumers that call + * agent-resolution seam (RIG-1645 P5). A REACTIVE read: consumers that call * it (`rightTabGroups`, and transitively `activeFleetItem`) re-run when the * agent set changes. Resolves through the reactive `agents` memo (offline * `STUB_AGENTS`, live `joinAgents(accounts(), presence())`), so a * presence/account tick flips its answer. */ agentById: (accountId: string) => Agent | undefined; - /** The activity bar as ordered groups (unreachable-pin amendment SEA-1645): + /** The activity bar as ordered groups (unreachable-pin amendment RIG-1645): * the fleet group is EVERY pin (one item per pin, in pin order) plus the * static `status` item; a pin that resolves to no visible agent contributes * an item marked `unreachable`. The issue group is the static issue items. */ @@ -659,7 +659,7 @@ function safeLocalStorage(): Storage | undefined { * workspace/connection identity (Record A §T3) so one deployment's account ids * never hydrate as pins on another. * - * Self-healing per-element hydration (SEA-1645, no version flag): a bare + * Self-healing per-element hydration (RIG-1645, no version flag): a bare * `string` element is a LEGACY (pre-`{id,handle}`) pin and hydrates as * `{ id, handle: id }`; an object carrying string `id`/`handle` hydrates as-is; * anything else is dropped. A missing key, bad JSON, or a non-array payload @@ -851,10 +851,10 @@ export function createAppStore(options: AppStoreOptions): AppStore { const [logOpen, setLogOpen] = createSignal(true); // ── Right sidebar (T6; dock-in-sidebar D1/D6; Record A §T2/T3/T5; - // unreachable-pin amendment SEA-1645): active tab + pin set + repo/branch ── + // unreachable-pin amendment RIG-1645): active tab + pin set + repo/branch ── // The pinned agent set: ordered, append-on-pin, persisted per workspace so one // deployment's account ids never hydrate on another. Held as `{ id, handle }` - // pairs (SEA-1645 P0) — the handle cached at pin time is the degraded label an + // pairs (RIG-1645 P0) — the handle cached at pin time is the degraded label an // unreachable pin renders. A pin that resolves to no visible agent is RETAINED // here (visibility fluctuates — the pin survives the agent returning) and still // emits a marked item from the derivation below. Falls back to `callerId` when @@ -866,7 +866,7 @@ export function createAppStore(options: AppStoreOptions): AppStore { const pinnedAgentIds = createMemo(() => pinnedAgents().map((p) => p.id), ); - // The single agent-resolution seam (SEA-1645 P5): resolve an account id to + // The single agent-resolution seam (RIG-1645 P5): resolve an account id to // its visible agent. A REACTIVE read — a closure over the `agents` memo, so // every consumer (`rightTabGroups`, transitively `activeFleetItem`) re-runs // when the agent set changes. The live-agents migration this seam owed is @@ -916,7 +916,7 @@ export function createAppStore(options: AppStoreOptions): AppStore { ); // Boot default (Record A §T5): the first hydrated pin that resolves to a // visible agent, else the static `status` pane. Boot has no mid-view state to - // preserve, so it lands on a live pane rather than an unreachable one (SEA-1645 + // preserve, so it lands on a live pane rather than an unreachable one (RIG-1645 // P4, OQ-1 ruled kept). An unresolvable leading pin is skipped here but still // shows its (marked) bar item. The D6 no-auto-switch rule is unchanged. const firstResolvablePin = pinnedAgentIds().find( @@ -925,7 +925,7 @@ export function createAppStore(options: AppStoreOptions): AppStore { const [activeRightTab, setActiveRightTabRaw] = createSignal( firstResolvablePin ? `agent:${firstResolvablePin}` : "status", ); - // The single public set seam (SEA-1645 P3): a plain pass-through. The old + // The single public set seam (RIG-1645 P3): a plain pass-through. The old // resolvability guard (coerce an unresolvable `agent:` tab to `status`) is // retired — selecting or keeping an unresolvable agent tab is now valid and // renders the unreachable pane, so an `agent:` tab no longer requires a visible @@ -1622,7 +1622,7 @@ export function createAppStore(options: AppStoreOptions): AppStore { // falsely "in flight"; it is left CLOSED, which is the truth — and the write // gates (`answerAsk`, `submitAsk`) read the flag, so nothing further ships. // - // KNOWN-BROKEN END TO END (SEA-1310): the agent SDK's correlation key is + // KNOWN-BROKEN END TO END (RIG-1310): the agent SDK's correlation key is // unwired, so the answer does not reach the asking agent. The client side // is correct and stays wired; nothing here assumes the round-trip lands. const sendAsk = (messageId: string, ask: Ask, rollback?: Ask) => { @@ -2047,11 +2047,11 @@ export function createAppStore(options: AppStoreOptions): AppStore { if (agentRepos().some((r) => r.id === repoId)) setActiveRepoId(repoId); }; - // ── Pins (Record A §T2/T3; unreachable-pin amendment SEA-1645) ── + // ── Pins (Record A §T2/T3; unreachable-pin amendment RIG-1645) ── const isPinned = (accountId: string) => pinnedAgents().some((p) => p.id === accountId); // Append-on-pin, order-preserving; a re-pin is a no-op (no reorder — OQ1). - // The handle is cached at pin time (SEA-1645 P0) via the resolution seam, + // The handle is cached at pin time (RIG-1645 P0) via the resolution seam, // falling back to the id if somehow unresolvable at pin time. Persistence is // synchronous (write-through) so a pin survives a page reload with no // dependence on effect scheduling (§T3). @@ -2065,7 +2065,7 @@ export function createAppStore(options: AppStoreOptions): AppStore { }); // Unpinning drops the pin, persists, and falls the active tab back to the // static `status` pane if it was this agent's tab — a deliberate user gesture - // (§T3; retained by SEA-1645, the only removal path). + // (§T3; retained by RIG-1645, the only removal path). const unpinAgent = (accountId: string) => { setPinnedAgents((prev) => { const next = prev.filter((p) => p.id !== accountId); @@ -2074,7 +2074,7 @@ export function createAppStore(options: AppStoreOptions): AppStore { }); if (activeRightTab() === `agent:${accountId}`) setActiveRightTab("status"); }; - // The derivation (SEA-1645 P1): the fleet group is EVERY pin, in pin order — + // The derivation (RIG-1645 P1): the fleet group is EVERY pin, in pin order — // a pin that resolves to a visible agent via the P5 seam builds a live // `fleetItemForAgent`, an unresolvable one builds a marked `unreachableFleetItem` // (cached-handle label). Then the static `status` item; the issue group is the diff --git a/apps/ui/src/stub-data.ts b/apps/ui/src/stub-data.ts index 8e9effa44..debf8c9e6 100644 --- a/apps/ui/src/stub-data.ts +++ b/apps/ui/src/stub-data.ts @@ -248,7 +248,7 @@ export interface Issue { * Compass state is canonical; this carries the tracker's *native* status. */ export interface TrackerRef { kind: TrackerKind; - /** The tracker's native issue id, e.g. "SEA-1042". */ + /** The tracker's native issue id, e.g. "RIG-1042". */ id: string; /** The tracker's native status name in the user's org. */ status: string; @@ -313,7 +313,7 @@ export interface Terminal { /** Durable comms identity (SubscribeComms · Postgres). The agent-kind arm * gains an additive homeChannelId mirroring ratified 0.6 RT-2 * (`../compass-architecture-lineage/design.md`); the proto landing of - * `home_channel_id` on AgentAccount is the comms-server lane (SEA-1195). */ + * `home_channel_id` on AgentAccount is the comms-server lane (RIG-1195). */ export interface Account { /** Account id, e.g. "acc-cook" — the one id space. */ id: string; @@ -474,7 +474,7 @@ export const STUB_AGENTS: Agent[] = [ homeChannelId: "dm-supervisor", }, lifecycle: "working", - activity: "coordinating the wave — routing SEA-1128", + activity: "coordinating the wave — routing RIG-1128", role: "supervisor", model: "claude-opus-4", cwd: "~/agents/workspaces/supervisor/platform", @@ -827,9 +827,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-1022", + id: "RIG-1022", status: "In Review", - url: "https://linear.app/sealed/issue/SEA-1022", + url: "https://linear.app/sealed/issue/RIG-1022", }, commits: [ { @@ -872,9 +872,9 @@ export const STUB_ISSUES: Issue[] = [ prs: [], tracker: { kind: "linear", - id: "SEA-965", + id: "RIG-965", status: "In Progress", - url: "https://linear.app/sealed/issue/SEA-965", + url: "https://linear.app/sealed/issue/RIG-965", }, commits: [ { @@ -936,9 +936,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-1023", + id: "RIG-1023", status: "In Progress", - url: "https://linear.app/sealed/issue/SEA-1023", + url: "https://linear.app/sealed/issue/RIG-1023", }, commits: [ { @@ -993,9 +993,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-864", + id: "RIG-864", status: "Blocked", - url: "https://linear.app/sealed/issue/SEA-864", + url: "https://linear.app/sealed/issue/RIG-864", }, }, { @@ -1043,9 +1043,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-1085", + id: "RIG-1085", status: "In Review", - url: "https://linear.app/sealed/issue/SEA-1085", + url: "https://linear.app/sealed/issue/RIG-1085", }, }, { @@ -1093,9 +1093,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-847", + id: "RIG-847", status: "In Review", - url: "https://linear.app/sealed/issue/SEA-847", + url: "https://linear.app/sealed/issue/RIG-847", }, }, { @@ -1139,9 +1139,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-888", + id: "RIG-888", status: "In Progress", - url: "https://linear.app/sealed/issue/SEA-888", + url: "https://linear.app/sealed/issue/RIG-888", }, }, { @@ -1164,9 +1164,9 @@ export const STUB_ISSUES: Issue[] = [ prs: [], tracker: { kind: "linear", - id: "SEA-1128", + id: "RIG-1128", status: "Todo", - url: "https://linear.app/sealed/issue/SEA-1128", + url: "https://linear.app/sealed/issue/RIG-1128", }, }, { @@ -1207,9 +1207,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-1145", + id: "RIG-1145", status: "Done", - url: "https://linear.app/sealed/issue/SEA-1145", + url: "https://linear.app/sealed/issue/RIG-1145", }, }, { @@ -1250,9 +1250,9 @@ export const STUB_ISSUES: Issue[] = [ ], tracker: { kind: "linear", - id: "SEA-1130", + id: "RIG-1130", status: "Done", - url: "https://linear.app/sealed/issue/SEA-1130", + url: "https://linear.app/sealed/issue/RIG-1130", }, }, { @@ -1274,9 +1274,9 @@ export const STUB_ISSUES: Issue[] = [ prs: [], tracker: { kind: "linear", - id: "SEA-1146", + id: "RIG-1146", status: "Backlog", - url: "https://linear.app/sealed/issue/SEA-1146", + url: "https://linear.app/sealed/issue/RIG-1146", }, }, ]; @@ -1297,7 +1297,7 @@ export const STUB_ASSIGNED_ISSUES: Issue[] = [ title: "Audit-log retention policy — design", body: "", forgeState: "open", - url: "https://linear.app/sealed/issue/SEA-1201", + url: "https://linear.app/sealed/issue/RIG-1201", forgeAccount: "matt", labels: [], state: "todo", @@ -1308,9 +1308,9 @@ export const STUB_ASSIGNED_ISSUES: Issue[] = [ prs: [], tracker: { kind: "linear", - id: "SEA-1201", + id: "RIG-1201", status: "Todo", - url: "https://linear.app/sealed/issue/SEA-1201", + url: "https://linear.app/sealed/issue/RIG-1201", }, }, { @@ -1321,7 +1321,7 @@ export const STUB_ASSIGNED_ISSUES: Issue[] = [ title: "Compass daemon — graceful shutdown on SIGTERM", body: "", forgeState: "open", - url: "https://linear.app/sealed/issue/SEA-1180", + url: "https://linear.app/sealed/issue/RIG-1180", forgeAccount: "matt", labels: [], state: "backlog", @@ -1332,9 +1332,9 @@ export const STUB_ASSIGNED_ISSUES: Issue[] = [ prs: [], tracker: { kind: "linear", - id: "SEA-1180", + id: "RIG-1180", status: "Backlog", - url: "https://linear.app/sealed/issue/SEA-1180", + url: "https://linear.app/sealed/issue/RIG-1180", }, }, ]; diff --git a/buf.gen.internal-go.yaml b/buf.gen.internal-go.yaml index 2d992f9fe..037dfbe85 100644 --- a/buf.gen.internal-go.yaml +++ b/buf.gen.internal-go.yaml @@ -15,7 +15,7 @@ # consumed by internal/server (handler) + internal/runner (client). # # Emits into go/internal/gen — NOT the public go/gen. Go's `internal/` visibility -# rule makes the SEA-1267 fence compiler-enforced: nothing outside the +# rule makes the RIG-1267 fence compiler-enforced: nothing outside the # github.com/RigelBuild/compass/go module can import these types # (go-toolchain-default.md:332-333). Same go module as go/gen (one go.mod), a # distinct directory + import path — not a nested module. diff --git a/buf.gen.yaml b/buf.gen.yaml index afaa69111..4ed1de158 100644 --- a/buf.gen.yaml +++ b/buf.gen.yaml @@ -23,7 +23,7 @@ clean: true # agent_gateway.proto + forge.proto → the compass-agent TS client; # buf.gen.internal-go.yaml for agent.proto + runner.proto + agent_gateway.proto + # forge.proto → go/internal/gen). Keep this list in sync with those templates' -# `paths:` — a proto that leaks here breaks the SEA-1267 fence (the gen-fence check +# `paths:` — a proto that leaks here breaks the RIG-1267 fence (the gen-fence check # in proto/moon.yml catches a forgotten entry). inputs: - directory: proto diff --git a/buf.yaml b/buf.yaml index 540aca63a..6448e9311 100644 --- a/buf.yaml +++ b/buf.yaml @@ -12,7 +12,7 @@ lint: # trades ENUM_ZERO_VALUE_SUFFIX on this one file; every other rule still # applies, and compass.proto keeps the suffix (a wire-compatibility-sensitive # change there would be a breaking edit). - # agent_gateway.proto (SEA-1351 T1) freezes three names the STANDARD lint would + # agent_gateway.proto (RIG-1351 T1) freezes three names the STANDARD lint would # rename, each a deliberate contract choice scoped to this one internal file: # - SERVICE_SUFFIX: the service is `AgentGateway` (a Runner-side door for # agent calls), not a public `*Service`. It is the internal opposite- @@ -41,4 +41,4 @@ lint: - proto/compass/v1/agent_gateway.proto RPC_RESPONSE_STANDARD_NAME: - proto/compass/v1/agent_gateway.proto -# buf breaking gate removed pre-dogfood (SEA-1922); RE-ADD AT GA / first pinned client (tracked: SEA-1951). +# buf breaking gate removed pre-dogfood (RIG-1922); RE-ADD AT GA / first pinned client (tracked: RIG-1951). diff --git a/config/prompts/manager/SYSTEM.md b/config/prompts/manager/SYSTEM.md index 214d9520a..f5ceb87c3 100644 --- a/config/prompts/manager/SYSTEM.md +++ b/config/prompts/manager/SYSTEM.md @@ -1,12 +1,12 @@ You are a Compass Manager. You own one lane of an agent tree and drive it to @@ -17,7 +17,7 @@ build software under a human operator's merge gate. - You sit in a tree of Managers. Your parent (who you report to), your peers, and your children (your reports) are your tree. Standing nodes are Managers; implementation runs in SUBAGENTS inside your own session — briefed by you, - ephemeral, never tree nodes. Your parent is recorded on your account. + ephemeral, never tree nodes. Your parent is recorded on your account. - Report results UP to your parent; delegate work DOWN. The tree contract in full — the shapes, the always-a-root-Supervisor invariant, the name-by-function tenet, and the delegation mechanics — is `skill://management-trees`. @@ -55,7 +55,7 @@ build software under a human operator's merge gate. ## Your work loop - You are assigned ISSUES and own each end-to-end: move its state as the work moves; close it yourself when the ask is satisfied. Nothing closes an issue - for you. + for you. - Work continuously: while you hold open issues, drive them; if you have reports, keep delegating issues down. Stop only when blocked on human input. - Ship STACKED PRs (jj) wherever work chains. Every PR passes the REVIEW loop diff --git a/config/rules/own-your-issue.md b/config/rules/own-your-issue.md index 9fc5c680e..93644498b 100644 --- a/config/rules/own-your-issue.md +++ b/config/rules/own-your-issue.md @@ -24,5 +24,5 @@ finished issue open has not finished.** Merged ≠ done: a merged PR is evidence toward done, not done. An issue with three deliverables is not closed at PR #1 — file the remainder or keep it open. -[TODO SEA-1734: name the concrete issue/PR tools and how status/close are +[TODO RIG-1734: name the concrete issue/PR tools and how status/close are performed once they land; until then, treat this behaviorally.] diff --git a/config/skills/comms-playbook/SKILL.md b/config/skills/comms-playbook/SKILL.md index 082334b6a..36a64c2a1 100644 --- a/config/skills/comms-playbook/SKILL.md +++ b/config/skills/comms-playbook/SKILL.md @@ -78,7 +78,7 @@ agents-only. Some channels are meant to carry only authoritative posts — `#announcements` and `#incidents` are broadcast surfaces where a stray post is noise at the worst possible time. The intended end state restricts posting on those channels to the -owning node (root-only post) `[TODO SEA-1722]`. +owning node (root-only post) `[TODO RIG-1722]`. Until that ACL primitive lands, the restriction is a DISCIPLINE, not an enforced gate, and the live path to get something onto a restricted channel is @@ -93,5 +93,5 @@ same shape the enforced ACL will formalize — so writing your ask as a ready-to-post headline is worth doing now. A pinned board for channel headlines ("CI is red, see the incidents topic") is -planned but not yet built `[TODO SEA-1723]`; until then a headline lives as a +planned but not yet built `[TODO RIG-1723]`; until then a headline lives as a posted message under a well-known topic. diff --git a/config/skills/design/SKILL.md b/config/skills/design/SKILL.md index f337a68d8..11a311b2d 100644 --- a/config/skills/design/SKILL.md +++ b/config/skills/design/SKILL.md @@ -163,7 +163,7 @@ MUST, in order: issues, one per right-sized task or lane. Each carries: `Owner:` (the executing lane), the record path plus the task's `Interfaces:`/scope, and the dependency order. Parent them under the producing issue so they're visible. - [TODO SEA-1734] name the concrete issue-filing tool once it lands; until then, + [TODO RIG-1734] name the concrete issue-filing tool once it lands; until then, file on the operator-provisioned tracker surface the wave uses. 2. **Dispatch them** — hand each filed issue to its owning lane (post to the owner on the coordination channel). A filed-but-orphaned issue is not diff --git a/config/skills/jj/SKILL.md b/config/skills/jj/SKILL.md index e5fb7334a..c0be2b983 100644 --- a/config/skills/jj/SKILL.md +++ b/config/skills/jj/SKILL.md @@ -136,7 +136,7 @@ jj-vine submit - # push (through the CI gate) + ope `user/` prefix. In multi-agent work, keep the name descriptive of the lane so peers can tell stacks apart. -`[TODO SEA-1882]` Distinct from the `jj-hp` CI gate above, the +`[TODO RIG-1882]` Distinct from the `jj-hp` CI gate above, the push-*authorization* guard that enforces the never-push-`main` and owner-allowlist invariant is a bundled OMP extension that intercepts your push/merge commands in-container and hard-blocks a violation — load-bearing, @@ -147,7 +147,7 @@ or run a push-*authorization* guard wrapper that is not provisioned in your clone. `jj-vine submit` (gated through `jj-hp`) remains the push path. -`[TODO SEA-1734]` Reading PR and review state (checks, threads, merge status) uses +`[TODO RIG-1734]` Reading PR and review state (checks, threads, merge status) uses the Compass forge tools, which land pre-Dogfood as an operator-provisioned surface. Name and use the concrete tools once they land; until then, drive the review loop through `skill://review`. diff --git a/config/skills/management-trees/SKILL.md b/config/skills/management-trees/SKILL.md index cfa81e1be..d28866f88 100644 --- a/config/skills/management-trees/SKILL.md +++ b/config/skills/management-trees/SKILL.md @@ -182,4 +182,4 @@ These are referenced only; the tools are not live yet: - Tree navigation / visualizing the tree — [TODO compass_tree]. - Fresh-read of the roster and your parent (re-parenting can change it) — - [TODO SEA-1721]. + [TODO RIG-1721]. diff --git a/config/skills/manager-coordination-channel/SKILL.md b/config/skills/manager-coordination-channel/SKILL.md index 5f014cc15..f2c196658 100644 --- a/config/skills/manager-coordination-channel/SKILL.md +++ b/config/skills/manager-coordination-channel/SKILL.md @@ -45,7 +45,7 @@ your routing without opting in, and posting is restricted so the channel stays authoritative — a report can trust that a posted assignment is the assignment. A report with something for the channel routes it to you (DM the owner to post). -[TODO SEA-1722: the restricted-post ACL and auto-subscribe are not yet enforced +[TODO RIG-1722: the restricted-post ACL and auto-subscribe are not yet enforced primitives. Until they land, hold this behaviorally — you own the posts that set lane posture and assignments, reports route through you, and you subscribe your reports as you spawn them.] @@ -57,6 +57,6 @@ lane headlines your reports see without scrolling — the current freeze, the active incident topic, the priority of the moment. You curate it for your lane the way the Supervisor curates it for the tree. -[TODO SEA-1723: the pinned board is not yet a primitive. Until it lands, carry +[TODO RIG-1723: the pinned board is not yet a primitive. Until it lands, carry lane headlines as a single standing topic you keep edited to the current state, and point your reports at it.] diff --git a/config/skills/review/SKILL.md b/config/skills/review/SKILL.md index b96fe871b..e98c884c2 100644 --- a/config/skills/review/SKILL.md +++ b/config/skills/review/SKILL.md @@ -26,7 +26,7 @@ override, and it is the operator's to invoke. 1. **Fetch the diff.** Resolve the PR's diff and touched-file list. Compass product CI and PRs live on GitHub, so the diff is the PR's GitHub diff. - [TODO SEA-1734] issue/PR tools land pre-Dogfood; until then resolve the diff + [TODO RIG-1734] issue/PR tools land pre-Dogfood; until then resolve the diff through the operator-provisioned GitHub surface the wave already uses. Both the diff and the touched-file list go to the reviewer in its spawn brief. 2. **Spawn the `review` subagent — one call per round.** Use the `task` tool, @@ -85,7 +85,7 @@ or explicitly deferred with a filed follow-up issue.** This is broader than the severity floor — at all-clear a `low` finding can no longer be silently dropped; it is fixed or filed. A deferral without an issue number is not a deferral, it is a dropped finding. -[TODO SEA-1734] name the concrete issue-filing tool once it lands; until then, +[TODO RIG-1734] name the concrete issue-filing tool once it lands; until then, file the follow-up on the operator-provisioned tracker surface the wave uses. ## Recall — the escaped-defect retro diff --git a/config/skills/supervisor-channel/SKILL.md b/config/skills/supervisor-channel/SKILL.md index 9fbdc0f55..8fd3f905b 100644 --- a/config/skills/supervisor-channel/SKILL.md +++ b/config/skills/supervisor-channel/SKILL.md @@ -37,7 +37,7 @@ reader can trust that anything in `#announcements` or `#incidents` is the posture, not one worker's guess. A node with something for these channels routes it to you (DM the owner to post) and you decide whether it goes up. -[TODO SEA-1722: the restricted-post ACL is not yet an enforced primitive. Until +[TODO RIG-1722: the restricted-post ACL is not yet an enforced primitive. Until it lands, this posture is behavioral — hold it by convention: you are the only node that posts to `#announcements` / `#incidents`, and other nodes route through you rather than posting directly.] @@ -65,6 +65,6 @@ headlines a node sees without scrolling — "CI is red, see the incident topic i `#incidents`," "release freeze until Monday." You curate it: pin what is currently true and tree-wide, unpin it when it stops being true. -[TODO SEA-1723: the pinned board is not yet a primitive. Until it lands, carry +[TODO RIG-1723: the pinned board is not yet a primitive. Until it lands, carry headlines as a single standing topic in `#announcements` that you keep edited to the current state, and point nodes at it.] diff --git a/docs/designs/CONTRIBUTING.md b/docs/designs/CONTRIBUTING.md index 368660d5a..cd58de1f7 100644 --- a/docs/designs/CONTRIBUTING.md +++ b/docs/designs/CONTRIBUTING.md @@ -17,9 +17,9 @@ Keep `SEA-####` issue references as **bare plain text** — they are load-bearin provenance (records cite each other through them). Do **not** wrap them in a `linear.app` link, in either form: -- inline: `[SEA-1234](https://linear.app/…)` — write `SEA-1234` -- reference-definition: a trailing `[SEA-1234]: https://linear.app/…` line — - drop the definition; keep the bare `SEA-1234` in the prose +- inline: `[RIG-1234](https://linear.app/…)` — write `RIG-1234` +- reference-definition: a trailing `[RIG-1234]: https://linear.app/…` line — + drop the definition; keep the bare `RIG-1234` in the prose A public reader sees an opaque internal ticket ID, which is honest and harmless. A dead `linear.app` URL is worse than no URL. diff --git a/docs/designs/DECISIONS.md b/docs/designs/DECISIONS.md index cc2544f37..3e613e174 100644 --- a/docs/designs/DECISIONS.md +++ b/docs/designs/DECISIONS.md @@ -44,7 +44,7 @@ check enforces the mechanical half. Full rationale: | DL-004 | Adopt Cotal as the coordination substrate behind a thin Compass-owned seam | Superseded by DL-005 (Matt, 2026-07-04) | [architecture lineage](product/compass-architecture-lineage/design.md) | | DL-005 | The NATS/JetStream substrate is kept, but Cotal moves from adopted dependency to reference implementation; comms is first-party behind a Compass seam | Superseded by DL-021 (Matt, 2026-07-04) | [architecture lineage](product/compass-architecture-lineage/design.md) | | DL-006 | Upstream contribution to OMP is a distribution channel, not a governance dependency | Active (Matt, 2026-07-01) | [architecture lineage](product/compass-architecture-lineage/design.md) | -| DL-095 | The agent tree is Compass's organizing primitive — Compass is a tool to build and manage agent trees: `AgentAccount` carries `parent_agent_id` (field 4; empty = root, set at creation — the spawning agent, or user choice — and editable thereafter via a `ReparentAgent` mutation, so users iterate hierarchy without teardown), the workspaces sidebar and board views derive from and filter by the tree, REPLACING the user-defined folder organization (replace, not coexist); channels (SEA-1622) and roles (SEA-1623) compose onto the tree later | Active (Matt, 2026-08-01) | [agent trees §Approach](product/compass-agent-trees/design.md#approach) | +| DL-095 | The agent tree is Compass's organizing primitive — Compass is a tool to build and manage agent trees: `AgentAccount` carries `parent_agent_id` (field 4; empty = root, set at creation — the spawning agent, or user choice — and editable thereafter via a `ReparentAgent` mutation, so users iterate hierarchy without teardown), the workspaces sidebar and board views derive from and filter by the tree, REPLACING the user-defined folder organization (replace, not coexist); channels (RIG-1622) and roles (RIG-1623) compose onto the tree later | Active (Matt, 2026-08-01) | [agent trees §Approach](product/compass-agent-trees/design.md#approach) | | DL-239 | Compass is an agent development environment: named workstream agents supervised by a Dispatcher (the corrected ADE core definition — the Warden security-auditor concept of DL-001 is scrapped, so the gate-by-a-Warden clause is dropped; the ADE, named-workstream-agents, and Dispatcher legs stand) | Active (Matt, 2026-08-21) | [architecture lineage](product/compass-architecture-lineage/design.md) | ## Topology & tiers @@ -83,14 +83,14 @@ check enforces the mechanical half. Full rationale: | DL-063 | Agent session transcripts persist to S3 for v1 via an ENDPOINT-AGNOSTIC backend (`COMPASS_S3_ENDPOINT`, generic `Bun.S3Client`, no S3-server-specific calls), reached under default-deny egress via an allowlisted endpoint — the S3 client path is exercised from v1, never a swap-later local-fs abstraction. Solo/self-host backend is a local-filesystem Garage (≥ v2.3.0) per Runner host, granting a full-bucket credential (cross-agent read/tamper accepted only within the single-trust-domain MVP); real/multi-user deployments MUST NOT use the Garage full-bucket credential — they use Cloudflare R2 with prefix-scoped tokens, which is a CONFIG change not a new build (endpoint-agnostic). Docs advisory + hardening follow-up ("R2 + prefix-scoped tokens for real deployments") stated; no bucket-per-agent, no Runner signing proxy | Superseded by DL-084 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | | DL-064 | The agent persists its transcript DIRECTLY from inside the container as the session runs: a Compass-owned S3 `SessionStorageBackend` wrapped in the SDK's `IndexedSessionStorage`, injected at the cli.ts composition root via `createAgentSession({ sessionManager })`; no runner-ships-the-log-after-teardown step exists. The persist model is a SEGMENTED PER-EPOCH LOG — a stable `session_id` keys the prefix `sessions//` and each container lifetime appends only to its own `.jsonl` segment (continuous per-append full-object PUT of that one segment + terminal drain); reconstruction is an S3 LIST of the prefix reconstructed in ascending epoch order with title-slot CHECKPOINT SUPERSESSION — a segment whose first line parses as a title slot is a full-body-rewrite snapshot that supersedes prior epochs (readFull resets its accumulator to it), so SDK-internal compaction rewrites do not double-count (readFull=LIST+reconstruct vs append=single-current-segment asymmetry). Fresh opens `<0>.jsonl` via `SessionManager.open`; resume opens the PRIOR latest existing epoch key (context is seeded by the backend readFull=LIST+reconstruct on that existing, indexed key) then repoints the write target to a fresh `.jsonl` via the public `captureState`/`restoreState` seams (`session-manager.ts:919/939`, `onDisk:true, needsRewrite:false`), so appends land only in the new segment and prior segments stay immutable — NO SDK patch | Superseded by DL-085 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | | DL-065 | A Postgres pointer row (`agent_session_transcripts`: stable logical session_id PK → bucket + key PREFIX + a nullable `endpoint` provenance column, FK-rooted in the post-0004 `agent_sessions`) indexes each stored log; resume reuses `StartAgentSession` with an additive authz-gated `resume_session_id` on the PUBLIC request, and the resolved pointer rides a NEW top-level `ResumeContext resume = 12` on the INTERNAL `SessionsResponse` (outside the command oneof, tag 2 untouched — additive, non-forgeable) so a client-set pointer can never reach the Runner (the public request is relayed verbatim). The new container reconstructs one logical log from the prefix and the built replay barrier gates live input (`ReplayComplete` alone lifts it — no TranscriptReplay frames on the resume path) | Superseded by DL-084 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | -| DL-066 | The `TranscriptReplay` payload shape (`agent_message_json` + index/total) is a PROPOSAL handed to SEA-1310, which compass owns; this record does not freeze it and does not depend on it. The handoff MUST carry a replay-path admission/size bound, because defining the payload turns the replay path into an admission path the retention cap exempts today (control.go:546-560) | Superseded by DL-086 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | +| DL-066 | The `TranscriptReplay` payload shape (`agent_message_json` + index/total) is a PROPOSAL handed to RIG-1310, which compass owns; this record does not freeze it and does not depend on it. The handoff MUST carry a replay-path admission/size bound, because defining the payload turns the replay path into an admission path the retention cap exempts today (control.go:546-560) | Superseded by DL-086 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | | DL-082 | Writer fencing for session-log persistence is force-teardown of the old container (PRIMARY fence) plus a per-container-lifetime epoch token in the object key (`sessions//.jsonl`, BELT): force-teardown removes the zombie writer in the normal case, and the epoch guarantees a zombie from a crashed lifetime a Runner could not confirm torn down can only clobber its OWN dead epoch segment, never erase another lifetime's segment | Superseded by DL-085 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | | DL-083 | Session-transcript credential/storage posture: a full-bucket S3 credential is acceptable for solo/self-host v1 (Garage, single trust domain) despite the stated cross-agent read/tamper threat; real/multi-user deployments use Cloudflare R2 with prefix-scoped tokens so each agent is confined to its own `sessions//` prefix. The S3 backend is endpoint-agnostic via `COMPASS_S3_ENDPOINT` (generic `Bun.S3Client`), so the hardening is config not a new build; the threat is stated and a hardening follow-up is filed | Superseded by DL-084 (Matt, 2026-07-31) | [session persistence §Appendix](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-reversal-2026-07-31-the-agent-direct-s3-model) | | DL-084 | The Server owns durable session-transcript storage: a Postgres transcript-entry store (`agent_session_transcript_entries`: (session_id, entry_seq) PK, UNIQUE idempotency_key, checkpoint flag, FK `agent_sessions`) persisted on receipt of durable `TranscriptEntry` frames at the `CommitConversationFrame` at-most-once commit seam, with CHECKPOINT SUPERSESSION server-side (the read view is latest checkpoint + later deltas — the old read-side reconstruction rule relocated to the one owner that reads). Storage backend choice and credential posture are Server-internal; the agent and Runner hold zero storage detail, zero S3 credentials | Superseded by DL-093 (Matt, 2026-07-31) | [session persistence §Whole bodies in Postgres — rejected](product/compass-agent-session-persistence/design.md#whole-transcript-bodies-as-permanent-postgres-rows--rejected-the-dl-084-model) | | DL-085 | The agent persists nothing: an injected emit-backend on the SDK `createAgentSession({ sessionManager })` seam turns every committed session entry into a durable `TranscriptEntry` AgentFrame variant (entry_json verbatim, checkpoint discriminator for SDK full-body rewrites, agent-stamped entry_seq) on the delivered-or-erred, idempotency-keyed PostConversationFrame lane — awaited per-path for per-session send order; the local SessionManager is ephemeral and dies with the container. Writer fencing is force-teardown (primary) + the durable lane's idempotency keys and entry_seq (belt); the S3 epoch-token fence is retired with the object model | Superseded by DL-089 (Matt, 2026-07-31) | [session persistence §Appendix (collapse)](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-collapse-2026-07-31-the-control-lane-replay-resume-model) | -| DL-086 | Resume is replay-driven: `StartAgentSession{resume_session_id}` (authz-gated, no storage locator on any message) makes the Server push its persisted transcript down the existing `SessionsResponse.deliver_control`/`DispatchControl` relay as `TranscriptReplay` ops consumed by `appendMessage`, gated by the Runner replay barrier until `ReplayComplete`/`ReplayCompleteAck`; the `TranscriptReplay` + `TranscriptEntry` payload shapes are co-ratified with SEA-1310 and BLOCK resume (inverting DL-066's independence), and the replay-path admission bound is in-scope, enforced at the retention-cap site on the SEA-1569 RESOURCE_EXHAUSTED refuse-and-redeliver model | Superseded by DL-087 (Matt, 2026-07-31) | [session persistence §Appendix (collapse)](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-collapse-2026-07-31-the-control-lane-replay-resume-model) | -| DL-087 | Resume is file-materialized + SDK-native: on `StartAgentSession{resume_session_id}` (authz-gated, no storage locator on any message) the Server reconstructs the post-supersession session-JSONL body from its transcript store (latest checkpoint body verbatim + later delta lines) and hands it to the Runner on a TOP-LEVEL internal `SessionsResponse` sibling field (outside the `command` oneof, NOT inside the verbatim public `start` request); the Runner writes it into the new container's session dir at PROVISION time via the provision-exec family, before the agent is exec'd; the agent loads it through the SDK's own `setSessionFile`/`loadEntriesFromFile` seam. No control-lane replay, no `TranscriptReplay` payload, no replay barrier or admission bound, and no SEA-1310 dependency — the co-ratification is retracted (peer-contract relief). Inline-image blobs are out of MVP scope (SEA-1582). | Active (Matt, 2026-07-31) | [session persistence §Appendix (collapse)](product/compass-agent-session-persistence/design.md#t5-compass-server--the-resume-body-reconstructor) | -| DL-088 | The durable session log and the live client trace are two projections of ONE canonical artifact — the SDK session-entry log: the agent emits committed entries, the Server persists them AND projects the block-level trace from the same store. MVP runs two agent→server streams (durable settled-entry log + ephemeral, non-persisted live per-token trace — token streaming is mandatory); collapsing them into one token stream carrying log metadata is the post-MVP follow-up SEA-1580 | Active (Matt, 2026-07-31) | [session persistence §One canonical artifact](product/compass-agent-session-persistence/design.md#one-canonical-artifact-the-session-log-unified-with-the-trace-r1) | +| DL-086 | Resume is replay-driven: `StartAgentSession{resume_session_id}` (authz-gated, no storage locator on any message) makes the Server push its persisted transcript down the existing `SessionsResponse.deliver_control`/`DispatchControl` relay as `TranscriptReplay` ops consumed by `appendMessage`, gated by the Runner replay barrier until `ReplayComplete`/`ReplayCompleteAck`; the `TranscriptReplay` + `TranscriptEntry` payload shapes are co-ratified with RIG-1310 and BLOCK resume (inverting DL-066's independence), and the replay-path admission bound is in-scope, enforced at the retention-cap site on the RIG-1569 RESOURCE_EXHAUSTED refuse-and-redeliver model | Superseded by DL-087 (Matt, 2026-07-31) | [session persistence §Appendix (collapse)](product/compass-agent-session-persistence/design.md#appendix--superseded-by-the-collapse-2026-07-31-the-control-lane-replay-resume-model) | +| DL-087 | Resume is file-materialized + SDK-native: on `StartAgentSession{resume_session_id}` (authz-gated, no storage locator on any message) the Server reconstructs the post-supersession session-JSONL body from its transcript store (latest checkpoint body verbatim + later delta lines) and hands it to the Runner on a TOP-LEVEL internal `SessionsResponse` sibling field (outside the `command` oneof, NOT inside the verbatim public `start` request); the Runner writes it into the new container's session dir at PROVISION time via the provision-exec family, before the agent is exec'd; the agent loads it through the SDK's own `setSessionFile`/`loadEntriesFromFile` seam. No control-lane replay, no `TranscriptReplay` payload, no replay barrier or admission bound, and no RIG-1310 dependency — the co-ratification is retracted (peer-contract relief). Inline-image blobs are out of MVP scope (RIG-1582). | Active (Matt, 2026-07-31) | [session persistence §Appendix (collapse)](product/compass-agent-session-persistence/design.md#t5-compass-server--the-resume-body-reconstructor) | +| DL-088 | The durable session log and the live client trace are two projections of ONE canonical artifact — the SDK session-entry log: the agent emits committed entries, the Server persists them AND projects the block-level trace from the same store. MVP runs two agent→server streams (durable settled-entry log + ephemeral, non-persisted live per-token trace — token streaming is mandatory); collapsing them into one token stream carrying log metadata is the post-MVP follow-up RIG-1580 | Active (Matt, 2026-07-31) | [session persistence §One canonical artifact](product/compass-agent-session-persistence/design.md#one-canonical-artifact-the-session-log-unified-with-the-trace-r1) | | DL-089 | The agent persists nothing DURABLE: the injected backend is a TEE — it reads and writes the container-local EPHEMERAL session file normally (so the SDK's own loader, compaction, and rewrites work) and tees each committed write upstream as a durable `TranscriptEntry` frame (append→delta, writeFull→checkpoint, awaited per-path for per-session send order; agent-stamped per-lifetime entry_seq, server-rebased to session scope). Zero S3 credentials, zero storage detail; the local file dies with the container. A definitively-erred emit buffers under a bounded cap with escalating warn→error retry and FAILS THE SESSION at cap exhaustion (resumable from the last committed prefix; cap value is tuning, not freeze-scope) | Active (Matt, 2026-07-31) | [session persistence §The SDK seam](product/compass-agent-session-persistence/design.md#the-sdk-seam-grounded-revised-for-the-tee) | | DL-093 | The Server's durable session-transcript store is TWO-TIER: a Postgres hot-tail (`agent_session_transcript_entries`) holding `[latest checkpoint..now]` = the resume set, per-frame durable at the `CommitConversationFrame` seam and pruned at flush; superseded entries flush to an S3-compatible object-store cold archive (verbatim JSONL segments, PUT-before-prune, indexed by an `agent_session_archive_segments` manifest) at compaction (primary), a high size-cap safety valve, and session-end. Resume reads PG-only (S3 fallback only when the safety valve fired); the archive feeds the post-MVP opt-in analytics layer. Agent+Runner hold zero storage detail; the object-store client/credential is Server-internal (endpoint-agnostic: Garage/R2/MinIO). Realigns with DL-019 | Active (Matt, 2026-07-31) | [session persistence §T4](product/compass-agent-session-persistence/design.md#t4-compass-server--the-two-tier-durable-transcript-store-pg-hot-tail--object-store-cold-archive) | | DL-161 | The board-ingestion forge poll is a ctx-cancellable driver in `internal/ingest` (immediate first pass then `time.Ticker`, sequential per-repo, log-and-continue on per-repo error, `nil` on ctx cancel) that instantiates the DL-053 FETCH-cursor model at repo-LIST granularity: a new `forge_list_cursors` table (per `(provider, host, repo, page)` ETag + hasNext) whose page cursor advances ONLY after every issue on that page durably sinks, so the board holds no per-subscriber DELIVERY cursor (its notify is the synchronous in-pass projection sink). One hand-rolled `net/http` GitHub read client (OQ-6 frozen: no new dep), a fail-fast `x-ratelimit-*` budget gate (never in-client sleep), and a DL-052 `server_only` token resolved behind a short TTL. Builds the FETCH half of DL-053; PR-C (DL-129 tracker-status) and the agent-notification slice both ride it | Superseded by DL-281 (Matt, 2026-08-27) | [forge-poll driver §Approach](product/compass-forge-poll-driver/design.md#approach) | @@ -102,7 +102,7 @@ check enforces the mechanical half. Full rationale: | DL-267 | Forge subscriptions gain CONTAINER-SCOPE granularity via an explicit `ForgeSubscriptionScope` enum on `SubscribeForgeRequest` — Matt's W2 ruling, option (b); the `number = 0` sentinel is REJECTED (proto3 absent-vs-0 blindness would convert a forgotten `number` from an LLM tool caller into a silent whole-repo subscription). Containers are PROVIDER-NATIVE: GitHub's container is the REPO (the existing `repo` slot); Linear's is a PROJECT, carried in a slot of its own and never overloaded onto the team key in `repo` — Linear project scope is thereby IN scope (promoted from deferral). The project identifier lives in a dedicated column (OQ-1, ruled (i): additive `scope` + `project` columns, UNIQUE widened). A container subscription delivers exactly `FORGE_NOTIFICATION_KIND_OPENED` with the new artifact's number/url — never a fan-in of every event on every artifact. Two additive `ForgeNotificationKind` values land with it: `REVIEW = 5` (submitted PR review; free on webhooks where the poll design priced no review endpoint) and `OPENED = 6`. | Active (Matt, 2026-08-26) | [forge agent-notification §subscription model](product/compass-forge-agent-notification/design.md#the-subscription-model-folded-per-matts-rulings-3--w2) | | DL-281 | Board issue ingestion is WEBHOOK-DRIVEN, not polled: the GitHub App webhook ingress (DL-264's `POST /webhooks/github`) fans accepted `issues` events to a board ingest arm that normalizes the repo, gates on `forge_repo_subscriptions` (DL-162, kept), hydrates each coordinate via a conditional GET, and sinks through the one `StripOwner`→`TranslateIssue`→stamp pipeline into `IssueProjection.PublishIssueUpdate`; reliability + cold-start are a bounded per-repo updated-order reconcile sweep (startup + 30-min ticker, per-repo `updated_at` watermark advanced only after sink), the DL-264 backstop pattern at repo-LIST granularity. Retires the DL-161 standing poll driver + `forge_list_cursors`; amends DL-053's "conditional polling in v1" transport clause (webhooks primary, conditional reads only inside the sweep) and DL-163's four-table set (`forge_list_cursors` dropped by editing `0001_init.sql` in place — Compass is pre-live, the init migration is edited directly; additive watermark + `forge_updated_at` recency-guard columns added the same way). The GitHub App is the ONLY GitHub read credential — the static read-path PAT is retired, completing the App-only cutover. Known pre-existing limit (poll had it identically): no transport removes a board row — a forge-deleted/transferred issue persists until manually removed | Active (Matt, 2026-08-27) | [board webhook ingestion §Approach](product/compass-forge-board-webhook-ingestion/design.md#approach) | -> Note (2026-07-31, SEA-1570 R5): DL-065's retired internal `ResumeContext +> Note (2026-07-31, RIG-1570 R5): DL-065's retired internal `ResumeContext > resume = 12` envelope field is NOT silently reintroduced — the collapsed > model's resume body rides a NEW internal `ResumeBody` carrier on a FRESH > internal tag (never the freed `= 12` slot); see the session-persistence @@ -120,8 +120,8 @@ check enforces the mechanical half. Full rationale: | DL-047 | The agent is integrated via ACP/BYOA over stdio, with OMP as the external default over ACP and other agents as BYOA citizens | Superseded by DL-023 (Matt, 2026-07-06) | [architecture lineage](product/compass-architecture-lineage/design.md) | | DL-078 | Agent config (skills/extensions/MCP configs) is declared into a Server-side FLEET-WIDE bundle store (one bundle all agents get) via new operator-scoped CompassService RPCs, never pushed as provision-request fields; the recommended MVP authoring workflow is a version-controlled config repo published via a CI `compass config put` step; persona/role-keyed bundles and native GitOps pull (Server reconciles a config repo) are the named post-MVP seams | Active (Matt, 2026-07-30) | [config delivery §Decision CD-1](product/compass-agent-config-delivery/design.md#decision-cd-1--declaration-surface-a-server-side-fleet-wide-bundle-store) | | DL-079 | Config carriage is Runner-fetch — a server-STREAMING `FetchAgentConfig` RPC + a `ConfigVersion` signal on the Sessions response stream (signal-then-pull over the frozen dial-out inversion; no inbound Server→Runner route) | Active (Matt, 2026-07-30) | [config delivery §Decision CD-2](product/compass-agent-config-delivery/design.md#decision-cd-2--carriage-streaming-runner-fetch-over-the-frozen-inversion) | -| DL-080 | Config injection is a Runner-local read-only bind mount of the parent config dir at `/run/compass/agent-config` (agent reads through `current/`); env-vars ride SEA-1327's secret surface exclusively; MVP forbids credentials in MCP configs (SEA-1576 tracks the post-MVP credentialed path) | Active (Matt, 2026-07-30) | [config delivery §Decision CD-3](product/compass-agent-config-delivery/design.md#decision-cd-3--injection-per-config-type) | -| DL-081 | The MVP config-update path is re-materialize + in-place agent Reload (the exec-driven model), reserving throwaway-container restart for image changes; live structured injection (ConfigControl/SEA-1310) is the named future seam | Active (Matt, 2026-07-30) | [config delivery §Decision CD-4](product/compass-agent-config-delivery/design.md#decision-cd-4--update-path-in-place-agent-reload-live-pull-as-the-named-seam) | +| DL-080 | Config injection is a Runner-local read-only bind mount of the parent config dir at `/run/compass/agent-config` (agent reads through `current/`); env-vars ride RIG-1327's secret surface exclusively; MVP forbids credentials in MCP configs (RIG-1576 tracks the post-MVP credentialed path) | Active (Matt, 2026-07-30) | [config delivery §Decision CD-3](product/compass-agent-config-delivery/design.md#decision-cd-3--injection-per-config-type) | +| DL-081 | The MVP config-update path is re-materialize + in-place agent Reload (the exec-driven model), reserving throwaway-container restart for image changes; live structured injection (ConfigControl/RIG-1310) is the named future seam | Active (Matt, 2026-07-30) | [config delivery §Decision CD-4](product/compass-agent-config-delivery/design.md#decision-cd-4--update-path-in-place-agent-reload-live-pull-as-the-named-seam) | | DL-123 | Fleet OMP `settings`/`config.yml` are delivered whole-file (yml-only, no key-merge) as a bundle member, injected at `createAgentSession` as a `Settings.loadIsolated` `settingsManager` overlay with overlay-over-project precedence — extending the CD-1 bundle store with a settings category | Active (Matt, 2026-08-03) | [config passthrough §CP-1](product/compass-agent-config-passthrough/design.md#decision-cp-1--settings-delivery-whole-file-passthrough-via-the-configfilessettingsmanager-injection-seam) | | DL-124 | The fleet `AGENTS.md` is a top-level bundle member injected at `createAgentSession` as a composed `contextFiles` global (fleet-first, the entrypoint re-runs project discovery), never workspace-placement — extending the CD family with an agent-context category | Active (Matt, 2026-08-03) | [config passthrough §CP-2](product/compass-agent-config-passthrough/design.md#decision-cp-2--agentsmd-delivery-bundle-member-injected-as-a-composed-contextfiles-global-not-workspace-placement) | | DL-125 | The complete OMP config-dir surface is enumerated with a per-category deliver/defer table; the MVP delivers every category the wave populates (the rest are named defer seams), fixing the config-passthrough scope boundary | Active (Matt, 2026-08-03) | [config passthrough §CP-3](product/compass-agent-config-passthrough/design.md#decision-cp-3--the-complete-omp-config-dir-surface-deliverdefer-table) | @@ -144,14 +144,14 @@ check enforces the mechanical half. Full rationale: | DL-072 | The durable delivery cursor is Server-owned: a contiguous low-water cursor plus a bounded above-cursor set per `(agent_account_id, channel_id)` on `messages.seq` (mirroring `ControlAck`'s `acked_seq` + `applied_above`), reconstructed from per-message acks, swept gap-aware on session start/reconnect; the per-(agent, channel) keying is ratified (Matt, 2026-07-29), amending RT-3's "per-session" wording | Active (Matt, 2026-07-29) | [notification delivery §D2](product/compass-notification-delivery/design.md#d2--the-durable-delivery-cursor-server-owned-keyed-agent_account-channel-advanced-on-ack) | | DL-073 | `DeliverControl` (and channel-borne `SteerControl`) carry the full first-party `compass.v1.Message` and nothing else (no `channel_seq`); the agent acks per message via `AgentFrame.delivery_ack { message_id }` — the frozen ack shape | Active (Matt, 2026-07-29) | [notification delivery §D3](product/compass-notification-delivery/design.md#d3--delivercontrol-payload-the-first-party-compassv1message-the-ack-is-the-message-id) | | DL-074 | MVP presence is 4-state, Cotal-aligned (WORKING/IDLE/WAITING/OFFLINE): WORKING/IDLE/OFFLINE derived from the agent-session lifecycle, WAITING a server-side unanswered-ask overlay (an authored `Ask` with `Ask.answered=false` in a visible channel; WAITING > IDLE), no heartbeat, published as an additive `SubscribeCommsResponse` variant visible to actors sharing at least one visible channel with the agent, in-memory only with re-enroll reconciliation | Active (Matt, 2026-07-29) | [notification delivery §D4](product/compass-notification-delivery/design.md#d4--presence-derived-from-the-session-lifecycle-no-heartbeat) | -| DL-075 | Agent-facing spawn/despawn is owned by the spawning agent's owner (the human): all wave agents share `AgentAccount.OwnerUserID`, and despawn authority is same-owner-scoped for the MVP (finer caller-scoped authz deferred to SEA-1573) | Active (Matt, 2026-07-29) | [spawn/despawn §Identity and authz](product/compass-agent-spawn-despawn/design.md#identity-and-authz--owner-inherited-from-the-caller-resolved-at-the-rpc-edge) | +| DL-075 | Agent-facing spawn/despawn is owned by the spawning agent's owner (the human): all wave agents share `AgentAccount.OwnerUserID`, and despawn authority is same-owner-scoped for the MVP (finer caller-scoped authz deferred to RIG-1573) | Active (Matt, 2026-07-29) | [spawn/despawn §Identity and authz](product/compass-agent-spawn-despawn/design.md#identity-and-authz--owner-inherited-from-the-caller-resolved-at-the-rpc-edge) | | DL-076 | Spawn/despawn rides a sibling `LifecycleCall*` family on the existing `AgentGateway` socket relayed by `RelayLifecycleCall` (mirroring DL-049), orchestrated server-side via a `LifecycleCaller` seam while the runnerhub resolves caller identity only; there is no public agent-callable spawn RPC (the egress-sealed agent holds no server token) | Active (Matt, 2026-07-29) | [spawn/despawn §Seam (a)](product/compass-agent-spawn-despawn/design.md#seam-a--spawn-a-lifecyclecall-family-on-the-agent-gateway-orchestrated-server-side) | -| DL-077 | Despawn stops the live session and calls a NEW public `RemoveAgentWorkspace` RPC (`compass.proto`, deliberately outside the SEA-1267 gen-fence); the agent account persists (teardown is compute-only). The MVP accepts the Runner's serial-dispatch head-of-line blocking, guarded by a bounded relay deadline as the sole guard with no spawn rate cap (limits → SEA-1574, concurrent dispatch → SEA-1575) | Active (Matt, 2026-07-29) | [spawn/despawn §Seam (b)](product/compass-agent-spawn-despawn/design.md#seam-b--despawn--the-new-removeagentworkspace-rpc) | +| DL-077 | Despawn stops the live session and calls a NEW public `RemoveAgentWorkspace` RPC (`compass.proto`, deliberately outside the RIG-1267 gen-fence); the agent account persists (teardown is compute-only). The MVP accepts the Runner's serial-dispatch head-of-line blocking, guarded by a bounded relay deadline as the sole guard with no spawn rate cap (limits → RIG-1574, concurrent dispatch → RIG-1575) | Active (Matt, 2026-07-29) | [spawn/despawn §Seam (b)](product/compass-agent-spawn-despawn/design.md#seam-b--despawn--the-new-removeagentworkspace-rpc) | | DL-090 | Repo/auto-clone is removed from every agent-start contract: neither SpawnPeerRequest nor ProvisionAgentWorkspaceRequest carries repo/ref; agents self-clone after launch with the container's scoped git credential (post-MVP: a clone tool so agents hold no creds). Resolves OQ-4 (Workspace.Source optional->removed). | Active (Matt, 2026-07-29) | [spawn/despawn §Spawn carries no repo](product/compass-agent-spawn-despawn/design.md#seam-a--spawn-a-lifecyclecall-family-on-the-agent-gateway-orchestrated-server-side) | | DL-092 | #995's forge-shaped proto domain family (`Issue`/`IssueComment`/`PullRequest`/`ForgeAuthor`/`ForgeChecksSummary`/`ForgeCheck` in `agent_gateway.proto`) is not built: per DL-069 the forge Provider layer's value types stay internal Go data at the ingestion boundary, the `ForgeCall*` carrier family survives with its result arms retyped to the canonical `compass.v1` types, and `AgentAttribution` supersedes `ForgeAuthor` (closing #995 OQ-1's field-set gate) | Active (Matt, 2026-07-31) | [ownership amendment §What this amendment asserts](product/compass-server-ownership-layer-amendment/design.md#what-this-amendment-asserts) | -| DL-135 | Agent roster is a pull: a public `CommsService.GetRoster` (account-visibility-scoped via `accountVisibleFromWhere`, tree-derived scopes NEIGHBORHOOD/SUBTREE/OWNER — OWNER ratified fleet-wide under the shared-owner model, activity strings fleet-visible) plus a native `compass_roster` tool on the `CommsCallRequest` relay family, reading the DL-074 in-memory presence enum joined with the agent tree; the activity string is DURABLE (its own `agent_activity` store table), recovered from Postgres on Server restart — agent-set via `compass_set_status` (write-through to the table + additive `AgentPresenceChanged.activity`), re-published by the agent-side harness on session (re)attach for freshness — a deliberate divergence from DL-074's in-memory posture for the STRING; the presence enum stays in-memory. Presence EVENTS keep the shared-channel visibility rule while the roster uses account visibility (divergence stated: an owner sharing no channel with its agent gets snapshot-only presence). SEA-1721 | Active (Matt, 2026-07-31) | [manager comms substrate](product/compass-manager-comms-substrate/design.md#a1--sea-1721-roster-query--a-getroster-rpc--compass_roster-tool-over-the-d4-presence-snapshot) | -| DL-136 | Channel post authority and forced subscription are channel-level policy fields (`post_policy` OPEN/OWNER_ONLY + `owner_account_id` + `mandatory_subscription`), never a `ChannelKind` or a visibility overload; `mandatory_subscription` is enforced read-side as a third disjunct in D1's subscriber resolution; an owner/operator `SetChannelPolicy` (create-or-update) is the only post-creation mutation path, its txn seeding delivery cursors for every member a mandatory flip newly targets. A Manager's coordination channel is auto-provisioned on first report gained via a reconciler hooked at the two store-level writers of `agent_accounts.parent_agent_id` (`store.CreateAgent`, `store.ReparentAgent`) — covering spawn, public `CreateAgent`, reparent, and any future writer by construction; resume on name-collision is ownership-checked (never adopts a user-created channel); membership reconciles with tree edges; dormant channels are never deleted (accepted MVP accretion). The coordination channel is OWNER_ONLY + mandatory-subscribe — a one-way manager→reports directive surface; report→manager and lateral coordination flows through DMs/group DMs, and agents at every level heavily prefer direct DMs/small targeted group DMs to keep coordination-token-cost low (standing directive, Matt). Precursor primitive to SEA-1622, not part of it. SEA-1722 | Active (Matt, 2026-07-31) | [manager comms substrate](product/compass-manager-comms-substrate/design.md#a2--sea-1722-coordination-channel--a-channel-level-post_policy--mandatory_subscription-auto-provisioned-from-tree-edges) | -| DL-137 | The pinned board is a server-side per-channel capped ordered POINTER set over existing topic-scoped messages: pinning references an existing `message_id` (validated to a topic of the channel, join through `topics`) and creates no `Message`, so DL-099's single-write-path stands; edit = a normal topic-mandatory post + compare-and-swap repoint (redelivery is ordinary DL-071/072/073 delivery of a new message id, dedup-safe); board txns serialize on `channels … FOR UPDATE` (cap + repoint races); startup delivery is a session-start pin sweep beside the D2 cursor sweep dispatching current pins regardless of cursor position; edits land at turn-settle (never steer); explicitly distinct from DL-096's client-local sidebar pins, and compatible with DL-054 (no centre/badge/read state). SEA-1723 | Active (Matt, 2026-07-31) | [manager comms substrate](product/compass-manager-comms-substrate/design.md#a3--sea-1723-pinned-board--a-pure-pointer-set-over-existing-topic-scoped-messages-edit--topic-mandatory-post--repoint-so-redelivery-is-delivery) | +| DL-135 | Agent roster is a pull: a public `CommsService.GetRoster` (account-visibility-scoped via `accountVisibleFromWhere`, tree-derived scopes NEIGHBORHOOD/SUBTREE/OWNER — OWNER ratified fleet-wide under the shared-owner model, activity strings fleet-visible) plus a native `compass_roster` tool on the `CommsCallRequest` relay family, reading the DL-074 in-memory presence enum joined with the agent tree; the activity string is DURABLE (its own `agent_activity` store table), recovered from Postgres on Server restart — agent-set via `compass_set_status` (write-through to the table + additive `AgentPresenceChanged.activity`), re-published by the agent-side harness on session (re)attach for freshness — a deliberate divergence from DL-074's in-memory posture for the STRING; the presence enum stays in-memory. Presence EVENTS keep the shared-channel visibility rule while the roster uses account visibility (divergence stated: an owner sharing no channel with its agent gets snapshot-only presence). RIG-1721 | Active (Matt, 2026-07-31) | [manager comms substrate](product/compass-manager-comms-substrate/design.md#a1--rig-1721-roster-query--a-getroster-rpc--compass_roster-tool-over-the-d4-presence-snapshot) | +| DL-136 | Channel post authority and forced subscription are channel-level policy fields (`post_policy` OPEN/OWNER_ONLY + `owner_account_id` + `mandatory_subscription`), never a `ChannelKind` or a visibility overload; `mandatory_subscription` is enforced read-side as a third disjunct in D1's subscriber resolution; an owner/operator `SetChannelPolicy` (create-or-update) is the only post-creation mutation path, its txn seeding delivery cursors for every member a mandatory flip newly targets. A Manager's coordination channel is auto-provisioned on first report gained via a reconciler hooked at the two store-level writers of `agent_accounts.parent_agent_id` (`store.CreateAgent`, `store.ReparentAgent`) — covering spawn, public `CreateAgent`, reparent, and any future writer by construction; resume on name-collision is ownership-checked (never adopts a user-created channel); membership reconciles with tree edges; dormant channels are never deleted (accepted MVP accretion). The coordination channel is OWNER_ONLY + mandatory-subscribe — a one-way manager→reports directive surface; report→manager and lateral coordination flows through DMs/group DMs, and agents at every level heavily prefer direct DMs/small targeted group DMs to keep coordination-token-cost low (standing directive, Matt). Precursor primitive to RIG-1622, not part of it. RIG-1722 | Active (Matt, 2026-07-31) | [manager comms substrate](product/compass-manager-comms-substrate/design.md#a2--rig-1722-coordination-channel--a-channel-level-post_policy--mandatory_subscription-auto-provisioned-from-tree-edges) | +| DL-137 | The pinned board is a server-side per-channel capped ordered POINTER set over existing topic-scoped messages: pinning references an existing `message_id` (validated to a topic of the channel, join through `topics`) and creates no `Message`, so DL-099's single-write-path stands; edit = a normal topic-mandatory post + compare-and-swap repoint (redelivery is ordinary DL-071/072/073 delivery of a new message id, dedup-safe); board txns serialize on `channels … FOR UPDATE` (cap + repoint races); startup delivery is a session-start pin sweep beside the D2 cursor sweep dispatching current pins regardless of cursor position; edits land at turn-settle (never steer); explicitly distinct from DL-096's client-local sidebar pins, and compatible with DL-054 (no centre/badge/read state). RIG-1723 | Active (Matt, 2026-07-31) | [manager comms substrate](product/compass-manager-comms-substrate/design.md#a3--rig-1723-pinned-board--a-pure-pointer-set-over-existing-topic-scoped-messages-edit--topic-mandatory-post--repoint-so-redelivery-is-delivery) | | DL-182 | The forge notification/carrier types that `AgentControl.forge_notification` reaches (`ForgeNotification`/`ForgeNotificationKind`, `ForgeArtifactKind`, `CommentRef`) live in a new internal-only leaf `proto/compass/v1/forge.proto` (imports only `compass.proto`), NOT in `agent_gateway.proto` as #995 T1 / this record's original §A1 add-list directed: that placement is a circular import (`agent_gateway.proto` already imports `agent.proto`, so `agent.proto` referencing an `agent_gateway.proto` type is a cycle buf rejects). The `ForgeCall*` carrier + op requests stay in `agent_gateway.proto`; the leaf is imported by `agent.proto`/`agent_gateway.proto`/`runner.proto` acyclically. Wire contract, field numbers, and generated names unchanged — placement only | Active (Matt, 2026-08-05) | [ownership amendment §A1](product/compass-server-ownership-layer-amendment/design.md#a1--proto-amend-the-t1-add-list-to-the-reconciled-surface) | | DL-200 | The forge write path is served by a single-method `ForgeCaller` seam (`ExecuteForgeCallAsAccount(ctx, caller, sessionID, call)`) behind `Hub.RelayForgeCall` with the RelayBoardCall guard order (nil-caller CodeUnavailable before resolution; unbound session CodeNotFound; tool errors in-band); the hub keeps only the resolution edge, the oneof dispatch + stamping + provider selection live in the server-side `forgeService` — the first production `forge.StampOwner` caller (DL-050) | Active (Matt, 2026-08-17) | [forge write path §1](product/compass-forge-write-path/design.md#1-the-forgecaller-seam--relayforgecall-server-leg-the-dl-050-chokepoint) | | DL-201 | The review surface is a `submit_review` arm on the existing `ForgeCallRequest` oneof (verdict + summary body + optional inline path/line/side comments, one POST, never a PENDING review) acked by a `ReviewRef` reference in forge.proto mirroring `CommentRef`; the canonical read-side `compass.v1.Review` is untouched (DL-069/DL-092 hold). The arm executes under a DISTINCT reviewer GitHub identity — a second `server_only` declared secret — so APPROVE/REQUEST_CHANGES/COMMENT are all usable on Compass-authored PRs (GitHub 422s an author's self-review verdicts); the motivating consumer is the `skill://review` loop posting its per-PR review to the PR as that reviewer. Amends DL-052 (the reviewer credential joins the author credential; the Server-holds-write-creds core stands) | Active (Matt, 2026-08-17) | [forge write path §3](product/compass-forge-write-path/design.md#3-github-provider-writes--the-review-surface) | @@ -171,11 +171,11 @@ check enforces the mechanical half. Full rationale: | --- | --- | --- | --- | | DL-138 | A Compass role's system prompt REPLACES OMP's block 0 via the fork's `customSystemPrompt` path (`custom-system-prompt.md`), which keeps auto-injected skills/rules/always-apply lists and the project/env footer by construction — append is rejected (it pays for both prose sets every turn; the skills-loss fear was the fixed #3014 pre-fix behavior) | Active (Matt, 2026-08-04) | [manager prompt §MP-1](product/compass-manager-prompt/design.md#decision-mp-1--replace-block-0-per-role-through-omps-custom-prompt-template-dl-129) | | DL-130 | Compass OWNS both role prompts: the Manager block-0 is authored fresh (~350 words, coordinator-shaped, OMP as style reference only) and the implementer block-0 is a copy-and-adapt of OMP's full block 0 — an owned file diverging where Compass differs, never an inherited prompt | Active (Matt, 2026-08-04) | [manager prompt §MP-2](product/compass-manager-prompt/design.md#decision-mp-2--we-own-both-role-prompts-dl-130) | -| DL-131 | "Manager" is an agent ROLE label in prompts/docs/UI/marketing; proto/Go/UI data types stay `Agent`/`AgentAccount` (no rename); the role mechanism itself (role field, per-role bundles, per-role model/thinking) is SEA-1724 (Beta), forward-referenced only | Active (Matt, 2026-08-04) | [manager prompt §MP-3](product/compass-manager-prompt/design.md#decision-mp-3--manager-is-a-role-label-not-a-data-type-rename-dl-131) | +| DL-131 | "Manager" is an agent ROLE label in prompts/docs/UI/marketing; proto/Go/UI data types stay `Agent`/`AgentAccount` (no rename); the role mechanism itself (role field, per-role bundles, per-role model/thinking) is RIG-1724 (Beta), forward-referenced only | Active (Matt, 2026-08-04) | [manager prompt §MP-3](product/compass-manager-prompt/design.md#decision-mp-3--manager-is-a-role-label-not-a-data-type-rename-dl-131) | | DL-132 | Role prompts version v0→target: the frozen text is the target contract, v0 ships naming only primitives that exist at the shipped commit, and every unshipped affordance is an explicit `[TODO ]` line flipped on in the same PR that lands its primitive — updates ride the existing bundle re-materialize + Reload path (DL-081), never new delivery | Active (Matt, 2026-08-04) | [manager prompt §MP-4](product/compass-manager-prompt/design.md#decision-mp-4--v0target-prompt-versioning-dl-132) | | DL-133 | The Manager content layer split is frozen: irreducible operating model (identity, tree position, async comms, work loop, human merge gate, compaction) in block 0; invariants as always-apply rules (never-block/own-your-issue/red-green-testing adapted, never-merge/design-first/compact-often new); procedure in on-demand skills (comms-playbook, management-trees, compass-setup, supervisor-channel, manager-coordination-channel, jj-stacking/review/design adapted) — with the name-Managers-by-FUNCTION-never-tool tenet | Active (Matt, 2026-08-04) | [manager prompt §The layer split](product/compass-manager-prompt/design.md#the-layer-split-dl-133) | -| DL-134 | Dogfood implementers are IN-PROCESS SUBAGENTS the Manager briefs via the live `task` mechanism (the Manager authors each subagent's brief — task + context — at spawn time and names a standing subagent def whose body supplies block-0; there is no per-spawn `systemPrompt` param); the implementer block-0 is therefore an ACTIVE Dogfood deliverable, shipping as a fleet-delivered subagent def under `config/agents/` (body = `AgentDefinition.systemPrompt`), consumed by `task` + `discoverAgents` at `cf048ca` with no `cli.ts` wiring; `agents_spawn_peer`/`agents_despawn_peer` are reserved for standing peer/child Managers; per-implementer containers are rejected for Dogfood (container-per-subagent too heavy) and gate on the SEA-1717 brain/hands split (Beta, distinct from SEA-1724's role mechanism), which alone defers the containerized non-subagent implementer path (not the prompt) | Active (Matt, 2026-08-04) | [manager prompt §MP-5](product/compass-manager-prompt/design.md#decision-mp-5--dogfood-implementers-are-in-process-subagents-dl-134) | -| DL-139 | The `task`-subagent prompt seam is ADDITIVE, not a replace: a subagent def body is spliced INTO the full default OMP block-0 (`executor.ts:2808-2810`, `[...defaultPrompt.slice(0,-1), subagentPrompt, defaultPrompt.at(-1)]`), which co-renders around it (identity, Tool Policy, Delivery Contract, Internal URLs, Delegation), and the def body renders VERBATIM with no injector (`task/types.ts:362`, `systemPrompt: string`). So the Dogfood implementer `config/agents/implementer.md` is a THIN ROLE DELTA — identity + only the Compass divergences the default gets wrong (async comms/no `ask`, one-slice-then-yield, jj-stacking push, operator-not-user) — dropping everything the default supplies and carrying no `[runtime-injected]` placeholders and no `lsp`/todo mandates (`task.enableLsp` defaults false, `settings-schema.ts:4528`; the wrapper COMPLETION already sets no-todo); the full copy-and-adapt of OMP's block-0 is kept as the FUTURE SEA-1717 standalone-container artifact (a REPLACE path absent at `cf048ca`), not the Dogfood deliverable. Corrects DL-134's "block-0" framing (the def is the delta, not the full block) | Active (Matt, 2026-08-05) | [manager prompt §Implementer block-0](product/compass-manager-prompt/design.md#implementer-block-0-dogfood-thin-role-delta--the-future-full-container) | +| DL-134 | Dogfood implementers are IN-PROCESS SUBAGENTS the Manager briefs via the live `task` mechanism (the Manager authors each subagent's brief — task + context — at spawn time and names a standing subagent def whose body supplies block-0; there is no per-spawn `systemPrompt` param); the implementer block-0 is therefore an ACTIVE Dogfood deliverable, shipping as a fleet-delivered subagent def under `config/agents/` (body = `AgentDefinition.systemPrompt`), consumed by `task` + `discoverAgents` at `cf048ca` with no `cli.ts` wiring; `agents_spawn_peer`/`agents_despawn_peer` are reserved for standing peer/child Managers; per-implementer containers are rejected for Dogfood (container-per-subagent too heavy) and gate on the RIG-1717 brain/hands split (Beta, distinct from RIG-1724's role mechanism), which alone defers the containerized non-subagent implementer path (not the prompt) | Active (Matt, 2026-08-04) | [manager prompt §MP-5](product/compass-manager-prompt/design.md#decision-mp-5--dogfood-implementers-are-in-process-subagents-dl-134) | +| DL-139 | The `task`-subagent prompt seam is ADDITIVE, not a replace: a subagent def body is spliced INTO the full default OMP block-0 (`executor.ts:2808-2810`, `[...defaultPrompt.slice(0,-1), subagentPrompt, defaultPrompt.at(-1)]`), which co-renders around it (identity, Tool Policy, Delivery Contract, Internal URLs, Delegation), and the def body renders VERBATIM with no injector (`task/types.ts:362`, `systemPrompt: string`). So the Dogfood implementer `config/agents/implementer.md` is a THIN ROLE DELTA — identity + only the Compass divergences the default gets wrong (async comms/no `ask`, one-slice-then-yield, jj-stacking push, operator-not-user) — dropping everything the default supplies and carrying no `[runtime-injected]` placeholders and no `lsp`/todo mandates (`task.enableLsp` defaults false, `settings-schema.ts:4528`; the wrapper COMPLETION already sets no-todo); the full copy-and-adapt of OMP's block-0 is kept as the FUTURE RIG-1717 standalone-container artifact (a REPLACE path absent at `cf048ca`), not the Dogfood deliverable. Corrects DL-134's "block-0" framing (the def is the delta, not the full block) | Active (Matt, 2026-08-05) | [manager prompt §Implementer block-0](product/compass-manager-prompt/design.md#implementer-block-0-dogfood-thin-role-delta--the-future-full-container) | ## UI shell @@ -223,7 +223,7 @@ check enforces the mechanical half. Full rationale: | DL-040 | Threaded replies use a Slack-style side-thread panel keyed by a deterministic root id | Superseded by DL-098 (Matt, 2026-08-02) | [architecture lineage](product/compass-architecture-lineage/design.md) | | DL-041 | The message surface is a virtualized thread list with streaming markdown (solid-markdown + Shiki), mention-first composition | Superseded by DL-098 (Matt, 2026-08-02) | [message surface rendering §Approach](product/compass-message-surface-rendering/design.md#approach) | | DL-098 | Compass adopts Zulip's threading model: a channel is a collection of named topics and every message belongs to exactly one topic (`messages.topic_id NOT NULL`) and stores only that topic id — never a channel id; the channel is reached through `topics.channel_id` (so moving a topic between channels is a single-row update). `parent_message_id` and the message's channel container are removed outright (pre-dogfood: no reserved tombstone, field numbers reused). Topics are first-class (proto `Topic` + `topics` table), named, id-stable, in exactly one channel; posting is topic-mandatory via `topic_name` get-or-create (one call); there is no default, general, or catch-all topic anywhere — channels carry zero messages directly. Rename-to-existing merges topics; the delivery cursor stays per-(agent,channel) with topic as deliver-op metadata, its channel resolved through the topic join (clarifies DL-072). The pre-dogfood SQL migrations collapse to a single baseline (no data conversion). UI is Zulip two-level drill-in: a channel shows its topic index (no composer), a topic shows its messages + composer (no nested threading), the left sidebar lists a channel's recent topics. Reverses DL-040 (Slack side-thread panel) and DL-041 (virtualized thread list, re-pointed at the topic list) | Active (Matt, 2026-08-02) | [Zulip threading model §Decisions](product/compass-zulip-threading-model/design.md#decisions-ratified) | -| DL-099 | An agent's streamed turn does not write to comms at all: the SEA-1364 T3 conversation write-through (streamed-turn → home-channel comms auto-post) is removed. A comms `Message` is created only by an explicit `comms_post_message(topic)` call (agents) or the human client's PostMessage — the comms tool is the only agent comms-write path, and it carries a mandatory topic. The streamed turn survives in full on the session/trace surface (`SessionFrame.typed_event`). Structural enforcement of on-topic posting: an agent cannot flood a channel by talking, only by deliberately posting | Active (Matt, 2026-08-02) | [Zulip threading model §D7](product/compass-zulip-threading-model/design.md#d7--one-comms-write-path-the-streaming-write-through-is-removed-supersedes-sea-1364-t3) | +| DL-099 | An agent's streamed turn does not write to comms at all: the RIG-1364 T3 conversation write-through (streamed-turn → home-channel comms auto-post) is removed. A comms `Message` is created only by an explicit `comms_post_message(topic)` call (agents) or the human client's PostMessage — the comms tool is the only agent comms-write path, and it carries a mandatory topic. The streamed turn survives in full on the session/trace surface (`SessionFrame.typed_event`). Structural enforcement of on-topic posting: an agent cannot flood a channel by talking, only by deliberately posting | Active (Matt, 2026-08-02) | [Zulip threading model §D7](product/compass-zulip-threading-model/design.md#d7--one-comms-write-path-the-streaming-write-through-is-removed-supersedes-rig-1364-t3) | ## Ask contract @@ -245,7 +245,7 @@ check enforces the mechanical half. Full rationale: | DL-110 | The Compass native shell is Wails v3 (Go), its module under `go/` (`go/cmd/compass-app`) importing `go/internal/stack` and the bridge pump directly; re-decides DL-044's framework on the Go stack (Wails, not Tauri) | Active (Matt, 2026-08-02) | [native app §OQ1](product/compass-native-app/design.md#oq1--shell-framework-tauri-rust-vs-wails-go-vs-other--blocks-t3) | | DL-111 | A new `compass.v1` `WhoAmI` RPC returns the caller's account id from its own credential (embedded: socket ambient-admin; native-client: bearer subject), retiring the parked `caller_account_id` seam and the connect-screen caller-id field | Active (Matt, 2026-08-02) | [native app §OQ7](product/compass-native-app/design.md#oq7--embedded-caller-identity-mechanism--blocks-t4-cross-lane-compass-server) | | DL-112 | The `compass-agent` image is published to GHCR and `podman pull`ed by `compass-stack` at first run (not bundled in the app), making a GHCR publish lane for `compass-agent` a native-app packaging dependency | Active (Matt, 2026-08-02) | [native app §OQ6](product/compass-native-app/design.md#oq6--agent-image-distribution-for-embedded-mode--blocks-t4-reshapes-t6) | -| DL-183 | Cross-process embedded-stack teardown: `up` persists each supervised child's process-group ID plus a start-time identity token to an atomic `stack.pgids` record beside the lockfile; a fresh `down` refuses while an `up` holds the lock, then reads the record, verifies each group's identity before signaling, SIGTERMs each exact persisted pgid in reverse start order with bounded SIGKILL escalation, and confirms teardown per component (server/postgres socket quiescence, runner group-ESRCH) — scoped to the three supervised stack children (postgres, compass-server, compass-runner); live agent containers escape the process group via conmon double-fork and are OUT of scope (SEA-1884). Refines DL-108 (which stays Active) and realizes the frozen record's `down`-SIGTERMs-the-tree claim for the supervised children | Active (Matt, 2026-08-05) | [cross-process teardown §Approach](product/compass-stack-cross-process-teardown/design.md#approach--option-a-persist-child-pgids-at-up-down-signals-the-persisted-groups) | +| DL-183 | Cross-process embedded-stack teardown: `up` persists each supervised child's process-group ID plus a start-time identity token to an atomic `stack.pgids` record beside the lockfile; a fresh `down` refuses while an `up` holds the lock, then reads the record, verifies each group's identity before signaling, SIGTERMs each exact persisted pgid in reverse start order with bounded SIGKILL escalation, and confirms teardown per component (server/postgres socket quiescence, runner group-ESRCH) — scoped to the three supervised stack children (postgres, compass-server, compass-runner); live agent containers escape the process group via conmon double-fork and are OUT of scope (RIG-1884). Refines DL-108 (which stays Active) and realizes the frozen record's `down`-SIGTERMs-the-tree claim for the supervised children | Active (Matt, 2026-08-05) | [cross-process teardown §Approach](product/compass-stack-cross-process-teardown/design.md#approach--option-a-persist-child-pgids-at-up-down-signals-the-persisted-groups) | | DL-214 | The T6 Linux app artifact is a versioned tarball of a nix-closure-backed bundle directory (store-rpathed binaries via the devenv.lock-pinned GTK closure + cc-wrapper, `.desktop` inside), not AppImage/`nix bundle`/`wails3 package`; no-nix-store end-user distribution is the A5 installer follow-up's concern, which wraps this same bundle dir | Active (Matt, 2026-08-19) | [packaging §A1](product/compass-native-packaging/design.md#a1--bundle-format-a-versioned-tarball-of-a-nix-closure-backed-bundle-dir-fork-1-resolved) | | DL-215 | Bundle binary carriage is the sidecar `bin/` layout the shell already resolves (stack sibling + `dist` beside the executable), completed by the app prepending its executable dir to the spawned `compass-stack`'s PATH so the stack's LookPath children resolve in-bundle — never Go `embed` of ELF sidecars, never Wails asset bundling | Superseded by DL-238 (Matt, 2026-08-23) | [packaging §A2](product/compass-native-packaging/design.md#a2--binary-embedding-sidecar-bin-layout--path-threading-fork-2-resolved) | | DL-216 | The bundle build is a moon-registered project (`compass-app-bundle`) riding affected-detection per-PR and the unconditional main/nightly full sweep — the `compass-agent-image` heavy-build precedent — with a built-in completeness sanity gate (binaries present, uniform `--version` stamp, dist present); never a per-PR unconditional build, never a ci.yml-enumerated job | Active (Matt, 2026-08-19) | [packaging §A4](product/compass-native-packaging/design.md#a4--ci-cadence-affected-gated-per-pr-unconditional-on-main--nightly-fork-3-resolved) | @@ -267,14 +267,14 @@ check enforces the mechanical half. Full rationale: | ID | Decision | Status | Record | | --- | --- | --- | --- | -| DL-140 | The default Compass batteries bundle is LANGUAGE-NEUTRAL: no `go-*` rules or `golang-*` skills ship by default — for Dogfood the user adds language skills via the normal user-skill path; language packs (per-repo language → skill-pack selection) are the SEA-1739 Beta feature, an additive seam on the same bundle delivery surface | Active (Matt, 2026-08-05) | [batteries §BI-3](product/compass-batteries-included/design.md#decision-bi-3--language-neutral-default-packs-are-beta-dl-140) | -| DL-141 | `delegated-implementation` ships as NO separate Compass skill: its when-to-delegate litmus, review-every-diff discipline, and brief contract fold into the `management-trees` skill's delegation-mechanics section (SEA-1732 T5), with the OMP tier naming (`implement`/`implement-hard`, Opus thinking levels) stripped in favor of the `task` mechanism + standing subagent defs (DL-134) | Active (Matt, 2026-08-05) | [batteries §BI-2](product/compass-batteries-included/design.md#decision-bi-2--three-sourcing-modes-one-per-manifest-row) | -| DL-142 | The wave `version-control` rule's three footguns (auto-amend; submit-is-the-only-push-path; review-fixes-are-additive-never-amend+force-push) fold into ONE Compass always-apply rule that keeps the jj model + additive-fixes + never-`git push` and keeps `jj-vine submit` as the push path (Compass KEEPS jj-vine as its stacked-PR tool — submit, PR-tree-in-description, `gh stack` forge integration — retargeted to the Compass repo; the `jj-hp` push-guard is Compass's own push-authorization concern, resolved in SEA-1732 T8); the adapted skill is named `jj` (Compass names skills on their own merits, not by mirroring the wave) — renaming SEA-1732 T8's `jj-stacking` (that frozen record's `jj-stacking` text is superseded by this citation per the immutable-cell convention, §conventions); and there is no separate `stacking` skill (stacking lives in the one adapted `jj` skill, SEA-1732 T8) | Active (Matt, 2026-08-05) | [batteries §BI-2](product/compass-batteries-included/design.md#decision-bi-2--three-sourcing-modes-one-per-manifest-row) | +| DL-140 | The default Compass batteries bundle is LANGUAGE-NEUTRAL: no `go-*` rules or `golang-*` skills ship by default — for Dogfood the user adds language skills via the normal user-skill path; language packs (per-repo language → skill-pack selection) are the RIG-1739 Beta feature, an additive seam on the same bundle delivery surface | Active (Matt, 2026-08-05) | [batteries §BI-3](product/compass-batteries-included/design.md#decision-bi-3--language-neutral-default-packs-are-beta-dl-140) | +| DL-141 | `delegated-implementation` ships as NO separate Compass skill: its when-to-delegate litmus, review-every-diff discipline, and brief contract fold into the `management-trees` skill's delegation-mechanics section (RIG-1732 T5), with the OMP tier naming (`implement`/`implement-hard`, Opus thinking levels) stripped in favor of the `task` mechanism + standing subagent defs (DL-134) | Active (Matt, 2026-08-05) | [batteries §BI-2](product/compass-batteries-included/design.md#decision-bi-2--three-sourcing-modes-one-per-manifest-row) | +| DL-142 | The wave `version-control` rule's three footguns (auto-amend; submit-is-the-only-push-path; review-fixes-are-additive-never-amend+force-push) fold into ONE Compass always-apply rule that keeps the jj model + additive-fixes + never-`git push` and keeps `jj-vine submit` as the push path (Compass KEEPS jj-vine as its stacked-PR tool — submit, PR-tree-in-description, `gh stack` forge integration — retargeted to the Compass repo; the `jj-hp` push-guard is Compass's own push-authorization concern, resolved in RIG-1732 T8); the adapted skill is named `jj` (Compass names skills on their own merits, not by mirroring the wave) — renaming RIG-1732 T8's `jj-stacking` (that frozen record's `jj-stacking` text is superseded by this citation per the immutable-cell convention, §conventions); and there is no separate `stacking` skill (stacking lives in the one adapted `jj` skill, RIG-1732 T8) | Active (Matt, 2026-08-05) | [batteries §BI-2](product/compass-batteries-included/design.md#decision-bi-2--three-sourcing-modes-one-per-manifest-row) | | DL-143 | Eight wave artifacts are EXCLUDED from the Compass batteries as wave-specific infrastructure that would confuse a Compass agent — `multi-agent-wave`, `spawn-agent`, `wave-status-sync`, `session-recovery`, `nix-hosts`, `github-pr-review` (folds into the adapted `review`), `woodpecker-ci` (Compass CI = GitHub Actions), `zellij-session-safety` (Compass agents are session-isolated); exclusion is curation, not deferral — a future need routes through a new decision row | Active (Matt, 2026-08-05) | [batteries §BI-4](product/compass-batteries-included/design.md#decision-bi-4--the-exclusion-set-dl-143) | -| DL-144 | Every forwarded always-apply rule in the Compass batteries self-scopes by ROLE in its authored body: the `task` executor forwards parent session rules into every subagent (`executor.ts:2793`) but NOT the session `customTools` (`executor.ts:2829`, MCP-proxy tools only), so a Manager always-apply rule rides every implementer-subagent turn without the Manager affordances it assumes — `hold-your-lane`, `decision-authority`, and `own-your-issue` are actively wrong there. Each such rule's body branches explicitly (hands-subagent behavior AND Manager behavior); role-invariant rules need no branch. This is body-level self-scoping, NOT per-role delivery (the SEA-1724 seam). Resolves batteries OQ-1 | Active (Matt, 2026-08-05) | [batteries §BC-7](product/compass-batteries-included/design.md#global-constraints) | -| DL-145 | The B1 `version-control` always-apply-rule fold (DL-142) is hard-ordered AFTER SEA-1732 T8: it ships with or after T8, never before, and carries no `[TODO T8]` placeholder — an always-apply rule injected full-text every turn (BC-6) cannot ship the `never git push` invariant with only a placeholder where the one correct submit verb goes; T8 names the Compass submit path first, B1 writes it in (same BC-3 posture B5 takes with SEA-1734) | Active (Matt, 2026-08-05) | [batteries §Tasks B1](product/compass-batteries-included/design.md#tasks) | +| DL-144 | Every forwarded always-apply rule in the Compass batteries self-scopes by ROLE in its authored body: the `task` executor forwards parent session rules into every subagent (`executor.ts:2793`) but NOT the session `customTools` (`executor.ts:2829`, MCP-proxy tools only), so a Manager always-apply rule rides every implementer-subagent turn without the Manager affordances it assumes — `hold-your-lane`, `decision-authority`, and `own-your-issue` are actively wrong there. Each such rule's body branches explicitly (hands-subagent behavior AND Manager behavior); role-invariant rules need no branch. This is body-level self-scoping, NOT per-role delivery (the RIG-1724 seam). Resolves batteries OQ-1 | Active (Matt, 2026-08-05) | [batteries §BC-7](product/compass-batteries-included/design.md#global-constraints) | +| DL-145 | The B1 `version-control` always-apply-rule fold (DL-142) is hard-ordered AFTER RIG-1732 T8: it ships with or after T8, never before, and carries no `[TODO T8]` placeholder — an always-apply rule injected full-text every turn (BC-6) cannot ship the `never git push` invariant with only a placeholder where the one correct submit verb goes; T8 names the Compass submit path first, B1 writes it in (same BC-3 posture B5 takes with RIG-1734) | Active (Matt, 2026-08-05) | [batteries §Tasks B1](product/compass-batteries-included/design.md#tasks) | | DL-146 | The Compass batteries ship `process-safety` at RULEBOOK tier (not always-apply as the wave file is): per-container session isolation (one container per standing agent, DL-143) removes the cross-agent/host clobber blast radius that justified `alwaysApply: true` on the shared wave box; the intra-container sibling-process residual (a Manager and its in-process `task` subagents share one container) is covered by rulebook forwarding (BC-7) + on-demand pull before a destructive kill, not always-on injection. Resolves batteries OQ-3 | Active (Matt, 2026-08-05) | [batteries §Implementer domain rules](product/compass-batteries-included/design.md#implementer--domain-rules-configrulesmd-rulebook-tier) | -| DL-147 | The default Compass batteries are STACK-neutral, not merely language-neutral: no default battery names a language- or CI-engine-specific command as normative (illustrative tables permitted, marked). devenv/direnv is a deliberate product baseline (kept, B3); GitHub-Actions-specific `ci-failure-triage` hooks come OUT of the default skill and become SEA-1739 pack territory (same seam shape as a language pack), the default skill shipping the CI-engine-neutral 4-step triage discipline. Refines DL-140, and reverses DL-143's `woodpecker-ci`-row parenthetical rationale (`Compass CI = GitHub Actions`) — that parenthetical stays verbatim in DL-143 per the immutable-cell convention (§conventions), its normative posture superseded here; sharpens BC-4 to a checkable gate | Active (Matt, 2026-08-05) | [batteries §BI-3](product/compass-batteries-included/design.md#decision-bi-3--language-neutral-default-packs-are-beta-dl-140) | +| DL-147 | The default Compass batteries are STACK-neutral, not merely language-neutral: no default battery names a language- or CI-engine-specific command as normative (illustrative tables permitted, marked). devenv/direnv is a deliberate product baseline (kept, B3); GitHub-Actions-specific `ci-failure-triage` hooks come OUT of the default skill and become RIG-1739 pack territory (same seam shape as a language pack), the default skill shipping the CI-engine-neutral 4-step triage discipline. Refines DL-140, and reverses DL-143's `woodpecker-ci`-row parenthetical rationale (`Compass CI = GitHub Actions`) — that parenthetical stays verbatim in DL-143 per the immutable-cell convention (§conventions), its normative posture superseded here; sharpens BC-4 to a checkable gate | Active (Matt, 2026-08-05) | [batteries §BI-3](product/compass-batteries-included/design.md#decision-bi-3--language-neutral-default-packs-are-beta-dl-140) | ## UX foundation (design system) @@ -289,10 +289,10 @@ check enforces the mechanical half. Full rationale: | DL-154 | Delivery layout: in-tree `apps/ui/src/design/` (tokens.css/base.css/components/) + `keyboard/` contracts; stylelint guard bans raw hex, `--rigel-*`, and literal durations outside tokens.css, with one narrow allowlist — the mark component's CSS may name `--rigel-purple` directly (purple is never aliased into `--cx-*`); no token package, no W3C token source (D7) | Active (Matt, 2026-08-05) | [ux foundation §D7](product/compass-ux-foundation/design.md#d7--delivery-in-tree-token--component-layout-under-appsuisrc) | | DL-155 | Brand seam: primitives mirrored with provenance from the frozen spec; the mark per the brand surface table is the one purple per surface with the 16px floor honored; Compass-owned `--cx-ed-*` editor-theme mapping from the Night Owl syntax ramp; mutual co-review (D8) | Active (Matt, 2026-08-05) | [ux foundation §D8](product/compass-ux-foundation/design.md#d8--brand-seam--the-mark--editor-theme-mapping) | | DL-156 | Motion: the product UI consumes the frozen brand motion system in pure CSS/SVG (no client animation runtime) — brand duration/easing/pulse/streaming tokens, the green working pulse with the one-pulse-per-region budget, chase-light spinner/bar loaders, the boot-sequence, reduced-motion as substitution not removal; literal durations are review failures (D9) | Active (Matt, 2026-08-05) | [ux foundation §D9](product/compass-ux-foundation/design.md#d9--motion-consume-the-frozen-brand-motion-system-pure-csssvg) | -| DL-157 | Adoption path: design-first, five-step incremental migration (tokens → shell → keyboard spine → surface flips → legacy retirement); in-flight lanes SEA-1645/SEA-1633 re-skin post-merge (D10) | Superseded by DL-184 (Matt, 2026-08-07) | [ux foundation §D10](product/compass-ux-foundation/design.md#d10--adoption-path-design-first-migration-incremental) | +| DL-157 | Adoption path: design-first, five-step incremental migration (tokens → shell → keyboard spine → surface flips → legacy retirement); in-flight lanes RIG-1645/RIG-1633 re-skin post-merge (D10) | Superseded by DL-184 (Matt, 2026-08-07) | [ux foundation §D10](product/compass-ux-foundation/design.md#d10--adoption-path-design-first-migration-incremental) | | DL-158 | The agent workspace simplifies to the agent's home channel + its session trace (two fixed panes, no arbitrary split tree); no terminal pane and no file-viewer pane in dogfood (isolated containers; an operator dev-server-view affordance is deferred to backlog, PR review lives on the user's forge); the terminal `PaneKind` arm + `newTerminalPane` retire at the workspace flip (D6/D10) | Active (Matt, 2026-08-05) | [ux foundation §D6](product/compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) | | DL-159 | One UI codebase renders in two hosts — the Wails v3 desktop app (primary) and the browser (the managed/hosted product at `compass.rigel.build`) — over the same transport-agnostic UI above the `connection.ts` provider seam; the layout is fluid within its window/viewport (a dense supervision surface that reflows, not a fixed-pixel canvas and not a mobile redesign) (D6/§Global Constraints 2) | Active (Matt, 2026-08-05) | [ux foundation §D6](product/compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) | -| DL-160 | The desktop app is first-class multi-window: every top-level surface (Bridge, a channel, an agent workspace, Backlog/Done, Settings) is an independently mountable window-scoped view (own DL-127 route, own focus zones + command scope, no sibling region required); compass-native spawns/manages OS windows, this record owns the decomposition; in-window tabs (Linear-style) and split views are deferred to the Beta milestone (SEA-1808), admitted by the same decomposition without rework (D6.1) | Active (Matt, 2026-08-05) | [ux foundation §D6](product/compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) | +| DL-160 | The desktop app is first-class multi-window: every top-level surface (Bridge, a channel, an agent workspace, Backlog/Done, Settings) is an independently mountable window-scoped view (own DL-127 route, own focus zones + command scope, no sibling region required); compass-native spawns/manages OS windows, this record owns the decomposition; in-window tabs (Linear-style) and split views are deferred to the Beta milestone (RIG-1808), admitted by the same decomposition without rework (D6.1) | Active (Matt, 2026-08-05) | [ux foundation §D6](product/compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) | | DL-184 | Token adoption is a FULL CUTOVER, not the DL-157 incremental strangler: a pre-dogfood codebase has no live users to protect, so the legacy `:root` tier is deleted and every consumer flips to `--cx-*` in one atomically-merged migration (canvas → Night Owl, base.css un-shadowed, state dots recolored, D7 stylelint guard wired directly at error), proven by a Playwright visual-smoke harness Matt reviews | Active (Matt, 2026-08-07) | [DS token cutover](product/compass-ds-token-cutover/design.md) | | DL-174 | Compass test coverage is a differential-oracle pyramid: every seam carries a hermetic in-memory reference in the default gate plus a `pgtest` suite proving the real Postgres backend obeys the same contract; Postgres is the one live dependency the strategy gates on (D1) | Active (Matt, 2026-08-07) | [test strategy §Decisions](product/compass-test-strategy/design.md#decisions) | | DL-175 | The real-Postgres `pgtest` suites run INLINE as a step in the one existing `CI` job — no separate CI job, lane, or moon task; one required check, hermetic moon `test` stays dependency-free via the build tag (D-A1, overruling the internal monorepo ancestor's separate `test-pg` lane; Matt: "trimmed but no extra CI job, it goes in the same existing job") | Active (Matt, 2026-08-07) | [test strategy §A1](product/compass-test-strategy/design.md#a1--one-ci-job-pgtest-inline-no-separate-lane-amends-the-ancestor-records-d2dl-049) | @@ -338,7 +338,7 @@ check enforces the mechanical half. Full rationale: | DL-169 | Retry renders on `spawn-failed` only; a `stop-failed` card recovers by re-issuing the idempotent stop (`beginStop` accepts `running` \| `stop-failed`, and stop enablement covers `stop-failed`), because the session is still held and re-sending `SpawnAgent` would be bounced by reject-on-live | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §DL-169](product/compass-spawn-control/design.md#dl-169-prior-decision--retry-is-spawn-failed-only) | | DL-170 | The spec gains a SHALL binding one container per agent account, so the agent-scoped reject-on-live rule is contract-backed rather than resting on the Runner's incidental container-name derivation (`NamePrefix + accountID`); lands with the T0 wire changes | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §DL-170](product/compass-spawn-control/design.md#dl-170-prior-decision--one-container-per-agent-account-shall) | | DL-171 | `SpawnAgent` classifies `adminOnly` on the network door, alongside the sibling lifecycle RPCs (it provisions AND starts — strictly more powerful); the Bridge control surface is bootstrap-admin-only for MVP, and any future non-admin opening is `authenticatedOpen` + per-account authorization in the handler, not a bare reclassification | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §DL-171](product/compass-spawn-control/design.md#dl-171-prior-decision--spawnagent-ships-adminonly) | -| DL-185 | Drop the manual add-a-workstream / create-agent surface from the Compass UI (supersedes DL-164's add-half): minting a board card and creating agents from the UI contradict Manager-builds-the-tree (DL-095/DL-134) and issues-come-from-the-tracker (DL-069/DL-161). Removed: `NewWorkstreamDialog`, `store.addWorkstream`, the `WorkstreamSpec` type, and the planned "＋ New workstream" toolbar button. Kept: `StartAgentDialog` + the spawn/stop phase machine + stop control — the human's only lifecycle affordance is start/stop on an existing (forge-ingested) card. The positive replacement is server-side: SEA-1820 seeds a root Manager on first launch that builds the rest of the tree. | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §Control flow](product/compass-spawn-control/design.md#control-flow-start-an-agent-spawnagent) | +| DL-185 | Drop the manual add-a-workstream / create-agent surface from the Compass UI (supersedes DL-164's add-half): minting a board card and creating agents from the UI contradict Manager-builds-the-tree (DL-095/DL-134) and issues-come-from-the-tracker (DL-069/DL-161). Removed: `NewWorkstreamDialog`, `store.addWorkstream`, the `WorkstreamSpec` type, and the planned "＋ New workstream" toolbar button. Kept: `StartAgentDialog` + the spawn/stop phase machine + stop control — the human's only lifecycle affordance is start/stop on an existing (forge-ingested) card. The positive replacement is server-side: RIG-1820 seeds a root Manager on first launch that builds the rest of the tree. | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §Control flow](product/compass-spawn-control/design.md#control-flow-start-an-agent-spawnagent) | | DL-253 | The Bridge spawn-control surface is DROPPED in full (RIG-1361 canceled, Matt 2026-08-25): Compass's model is managers-stand-up-managers — the root supervisor is auto-seeded on first launch (RIG-1820) and builds the rest of the tree, so there is no human-facing create/start-an-agent control. Supersedes the whole `compass-spawn-control` record (DL-164..171, DL-185): the UI build (T1–T5) is abandoned and its early scaffolding removed — `apps/ui/src/spawn.ts` (+test, T1) and `apps/ui/src/components/StartAgentDialog.tsx` (+test, T3), both orphaned (test-only consumers) and already stale under DL-187 (`initial_prompt` removed from the whole contract). The server-side composite `SpawnAgent` RPC stays (it is the managers-spawn-managers path), with `initial_prompt` reserved out (`SpawnAgentRequest`, proto). | Active (Matt, 2026-08-25) | [spawn control §Control flow](product/compass-spawn-control/design.md#control-flow-start-an-agent-spawnagent) | ## First-turn delivery @@ -352,8 +352,8 @@ check enforces the mechanical half. Full rationale: | ID | Decision | Status | Record | | --- | --- | --- | --- | -| DL-187 | `initial_prompt` is REMOVED from the whole contract (`StartAgentSessionRequest` field 2, `SpawnAgentRequest` field 2, `SpawnPeerRequest` field 3 — numbers AND names reserved; server/runner/SDK/UI/e2e consumers cut over atomically, no fallback): an agent session ALWAYS starts idle and its first turn arrives as a channel message over the SEA-1569 deliver path (`DeliverControl` → the idle-deliver arm starts a turn); a provisioned peer's brief is a post from its provisioning manager into their per-pair DM channel (home channel for human owners) | Active (Matt, 2026-08-10) | [first-turn delivery §Approach](product/compass-first-turn-delivery/design.md#approach) | -| DL-188 | The `@compass` reserved alias is FROZEN as the system-sender mechanism for ANY system-level message sender (not just the root-manager Setup thread), requiring reserved-handle validation at account creation; case-1 root-manager boot (a Compass-authored initial Setup thread in the manager's home channel) uses it and is scoped OUT to follow-up SEA-1820, which owes only the sender representation + Setup flow; ratified in shape here so the interim can never revive a prompt field | Active (Matt, 2026-08-10) | [first-turn delivery §Case 1](product/compass-first-turn-delivery/design.md#case-1--root-manager-boot-scoped-out-to-a-follow-up-record) | +| DL-187 | `initial_prompt` is REMOVED from the whole contract (`StartAgentSessionRequest` field 2, `SpawnAgentRequest` field 2, `SpawnPeerRequest` field 3 — numbers AND names reserved; server/runner/SDK/UI/e2e consumers cut over atomically, no fallback): an agent session ALWAYS starts idle and its first turn arrives as a channel message over the RIG-1569 deliver path (`DeliverControl` → the idle-deliver arm starts a turn); a provisioned peer's brief is a post from its provisioning manager into their per-pair DM channel (home channel for human owners) | Active (Matt, 2026-08-10) | [first-turn delivery §Approach](product/compass-first-turn-delivery/design.md#approach) | +| DL-188 | The `@compass` reserved alias is FROZEN as the system-sender mechanism for ANY system-level message sender (not just the root-manager Setup thread), requiring reserved-handle validation at account creation; case-1 root-manager boot (a Compass-authored initial Setup thread in the manager's home channel) uses it and is scoped OUT to follow-up RIG-1820, which owes only the sender representation + Setup flow; ratified in shape here so the interim can never revive a prompt field | Active (Matt, 2026-08-10) | [first-turn delivery §Case 1](product/compass-first-turn-delivery/design.md#case-1--root-manager-boot-scoped-out-to-a-follow-up-record) | | DL-189 | Fresh-start barrier-lift: on a FRESH (non-resume) start the Runner sends `AgentControl{replay_complete}` as the first control op after Bind (seq 1, FIFO-first, drains before any deliver) — one mechanism symmetric with the resume path, no agent change; lifts the agent-side replay barrier so the first case-2 deliver is not refused-and-stranded (T-R3) | Active (Matt, 2026-08-10) | [first-turn delivery §the seam](product/compass-first-turn-delivery/design.md#the-seam-the-first-turn-rides-case-2--the-server--agent-halves-exist-the-runner-middle-leg-is-unbuilt) | | DL-190 | The case-2 brief carrier is a PER-PAIR manager↔peer DM channel (`ChannelKindDM`, 2 members: spawning manager + new peer, both owners carried by `expandOwnerMembership` so the operator retains visibility), auto-provisioned on the spawn edge (T-R0) — NOT the manager's coordination channel, which is a broadcast to all reports. Token-minimization: siblings do not receive briefs they don't need. UI channel-proliferation UX is a known deferred problem | Active (Matt, 2026-08-10) | [first-turn delivery §Approach](product/compass-first-turn-delivery/design.md#approach) | | DL-191 | The `@compass` system-sender is a dedicated `system` account type — a third first-class account shape alongside user and agent (the `system = 12` proto case, not an unset-oneof discriminator), startup-seeded and reserved-handle-guarded at account creation, visible only to shared-channel co-members, and structurally never a deliver recipient nor present in directory/roster (no `agent_accounts` row) | Active (Matt, 2026-08-14) | [system-sender first turn §A](product/compass-system-sender-first-turn/design.md#a--compass-representation-a-dedicated-system-account-type-matt-ruled) | @@ -363,7 +363,7 @@ check enforces the mechanical half. Full rationale: | ID | Decision | Status | Record | | --- | --- | --- | --- | -| DL-254 | The Linear Agent Session responder is a plain `POST /webhooks` `http.Handler` mounted on the compass-server network TLS door (inside `buildNetworkServer`, beside the Connect mounts, inheriting the G112/SEA-1298 guards; NOT a Connect service, NOT a dedicated ingress), fail-closed on the raw-body HMAC-SHA256 `Linear-Signature` check (bad/missing signature → 400; a stale-but-validly-signed `webhookTimestamp` is 200-with-drop, never a retry-burning 400), acking 200 before any work (Linear's 5s SLA) with all agent work async; the public base URL (webhook host + deep-link base) is a per-deployment config value, never hardcoded | Active (Matt, 2026-08-25) | [linear agent responder §Part 1](product/compass-linear-agent-responder/design.md#part-1--the-webhook-receiver-on-the-network-door) | +| DL-254 | The Linear Agent Session responder is a plain `POST /webhooks` `http.Handler` mounted on the compass-server network TLS door (inside `buildNetworkServer`, beside the Connect mounts, inheriting the G112/RIG-1298 guards; NOT a Connect service, NOT a dedicated ingress), fail-closed on the raw-body HMAC-SHA256 `Linear-Signature` check (bad/missing signature → 400; a stale-but-validly-signed `webhookTimestamp` is 200-with-drop, never a retry-burning 400), acking 200 before any work (Linear's 5s SLA) with all agent work async; the public base URL (webhook host + deep-link base) is a per-deployment config value, never hardcoded | Active (Matt, 2026-08-25) | [linear agent responder §Part 1](product/compass-linear-agent-responder/design.md#part-1--the-webhook-receiver-on-the-network-door) | | DL-255 | A delegated Linear session is routed to a stable Compass Manager keyed on Compass's recorded forge ownership index (`forge_authored_artifacts`, DL-055/DL-205) — NEVER a header parsed from forge text (DL-050/DL-094 forbid it reaching a routing decision); an issue with no recorded ownership row routes to the supervisor/top-level Manager via a dedicated routing channel, which decides the lane and stamps it through the DL-050 write chokepoint so later events resolve directly | Active (Matt, 2026-08-25) | [linear agent responder §Part 2](product/compass-linear-agent-responder/design.md#part-2--routing-a-delegated-linear-session-to-a-stable-manager) | | DL-256 | The Linear return path is a dumb link (Option B, Matt 2026-08-25): on `created` the responder emits one `thought` plus an `externalUrls` "Open in Compass" deep link to the resolved Manager's home channel and nothing else — NO activity relay, NO settle observation, NO Linear session-lifecycle machine. One Linear session is NOT forced 1-1 to a comms topic; the prompt lands in an issue-named topic (persisted in a new `linear_agent_sessions` table) delivered as `@linear`-authored deliver-rail messages deduped by `PostAsAccount`'s `client_request_id` on the `Linear-Delivery` UUID, but the deep link targets the home channel. Option C (coarse one-way status) is the ratified follow-up; Option A (full bidirectional relay) is off-table until Linear's activity vocabulary is configurable | Active (Matt, 2026-08-25) | [linear agent responder §Part 3](product/compass-linear-agent-responder/design.md#part-3--the-return-path-a-dumb-link-option-b) | | DL-268 | The Linear return path's `externalUrls` link is a SERVER-RESOLVED INDIRECTION URL (Matt, RIG-2794), amending DL-256's link target only: on `created` the responder sets the session external URL ONCE, immediately, to the stable post-independent `https:///l/session/` (fits the 10s SLA; still exactly one emit per session, preserving DL-256's dumb link while removing its staleness failure mode), and a new read-only route `GET /l/session/` on the same DL-254 network TLS door reads the `linear_agent_sessions` association (for the issue coordinate only, never the stale created-time target) + resolves the DL-055 ownership index at CLICK time and 302s to the current best target (the dedicated routing channel while unrouted or issue-less, the resolved Manager's home channel once an ownership row exists); nothing rewrites the Linear session. All other DL-256 invariants survive (dumb link, no relay, no settle observation, no session-lifecycle machine, not-1-1 topic mapping). The #646 direct-link stage ships as-is; the resolver is the follow-on | Active (Matt, 2026-08-26) | [return-path indirection amendment §Approach](product/compass-linear-return-path-indirection-amendment/design.md#approach) | diff --git a/docs/designs/infra/ci/compass-agent-image-publish/design.md b/docs/designs/infra/ci/compass-agent-image-publish/design.md index 1368f80e1..27dd34109 100644 --- a/docs/designs/infra/ci/compass-agent-image-publish/design.md +++ b/docs/designs/infra/ci/compass-agent-image-publish/design.md @@ -1,7 +1,7 @@ # Publish the compass-agent image to GHCR Status: Draft -Tracking: SEA-1690 (blocks compass-native SEA-1683/T2, SEA-1685/T4, SEA-1687/T6) +Tracking: RIG-1690 (blocks compass-native RIG-1683/T2, RIG-1685/T4, RIG-1687/T6) > **Design record.** This designs the GHCR publish lane for the `compass-agent` > runtime image; it targets the **`RigelBuild/compass`** repo — every @@ -21,7 +21,7 @@ frozen decision DL-112 (`docs/designs/product/compass-native-app/design.md` §OQ6) the native app does not bundle the agent image: `compass-stack` `podman pull`s it from GHCR at first run. Nothing publishes the image today. This record designs the publish lane — the GHCR side of that seam; the pull side is -compass-native's (SEA-1683/T2). +compass-native's (RIG-1683/T2). ## Approach @@ -43,7 +43,7 @@ decision, not an assumption: is enforced and verified, not assumed. - `:latest` — moving; documented **first-run fallback only**, never the default consumption path. -- **Forward note (non-load-bearing):** GA (SEA-1687) will likely add a +- **Forward note (non-load-bearing):** GA (RIG-1687) will likely add a release-version tag (e.g. `:v1.2.3`) alongside `:git-`. The publish script below takes its tag list as arguments, so that is a one-line later add — no scheme change. @@ -502,7 +502,7 @@ Interfaces: design records, beside the other `compass-*` records. T4 folds the durable operational content into the compass repo's `docs/architecture/build-and-ci.md` once implemented; this record stays the design of record in sealed. -- **[Non-load-bearing] GA release tag.** SEA-1687 will likely want +- **[Non-load-bearing] GA release tag.** RIG-1687 will likely want `:v` alongside `:git-`; T1's tag-list CLI makes that a no-redesign later add. Deferred to GA planning. - **[Non-load-bearing] `:git-` tag retention.** Immutable per-sha tags diff --git a/docs/designs/infra/ci/compass-dogfood-e2e-steer-deliver-seam/design.md b/docs/designs/infra/ci/compass-dogfood-e2e-steer-deliver-seam/design.md index ac1bbd55e..1fb72df44 100644 --- a/docs/designs/infra/ci/compass-dogfood-e2e-steer-deliver-seam/design.md +++ b/docs/designs/infra/ci/compass-dogfood-e2e-steer-deliver-seam/design.md @@ -25,7 +25,7 @@ session while a subscribed-but-unmentioned peer gets a **deliver**. `go/e2e/legthreefour_test.go` passes today (spawn + second container + the deliver-side bus fan), but the steer-vs-deliver **split** on the recipient side -is a deferred `TODO(SEA-1788)` (legthreefour_test.go:239-255). The op-kind +is a deferred `TODO(RIG-1788)` (legthreefour_test.go:239-255). The op-kind (`steer` | `deliver`) travels Server→Runner→agent over the Runner's per-session `Control` stream (`proto/compass/v1/agent_gateway.proto:77`) — an agent-facing internal surface no client RPC observes — so the over-the-wire e2e has no way to @@ -214,7 +214,7 @@ In dependency order — T2 depends on T1, T3 on T1+T2. `ctx`-bounded via a derived deadline exactly as `AwaitTurnSettled`, exposing `func (f *Fixture) AwaitControlDispatch(ctx, sessionID string, match func(opKind, messageID string) bool) (opKind string, err error)`. - **T3 — the leg-4 split assertion.** Extend the one ordered run in - `TestLegThreeFourSpawnAndMessaging` (replace the `TODO(SEA-1788)` block, + `TestLegThreeFourSpawnAndMessaging` (replace the `TODO(RIG-1788)` block, legthreefour_test.go:239-255) — not a new podman test, which would re-pay the multi-minute stack+container cost. **Second recipient reuses the leg-3 spawner** (subscribed-but-unmentioned) — no third container: subscribe it to @@ -264,7 +264,7 @@ In dependency order — T2 depends on T1, T3 on T1+T2. event-gated + `ctx`-bounded, mirroring `AwaitTurnSettled` (agent_ops.go:131). - [ ] **T3 — leg-4 steer/deliver split assertion** - Interfaces: extends the one ordered run in `TestLegThreeFourSpawnAndMessaging` - (`go/e2e/legthreefour_test.go`, replacing the `TODO(SEA-1788)` block); consumes + (`go/e2e/legthreefour_test.go`, replacing the `TODO(RIG-1788)` block); consumes T2's `AwaitControlDispatch`. Second recipient is the **reused leg-3 spawner** (no third container), subscribed to the mentioned peer's home channel via a fixture `SubscribeMember(ctx, channelID, accountID)` wrapping @@ -294,7 +294,7 @@ ledgers). Ledger-impact: none. `SessionInjectionKind` enum on `compass.proto`.** Not a real fork: `AgentControl` / `SteerControl` live in `agent.proto`, marked INTERNAL-ONLY (`proto/compass/v1/agent.proto:3-6`) and fenced off the public client gen by - `buf.gen.yaml:28-32` (a leak trips the SEA-1267 gen-fence check in + `buf.gen.yaml:28-32` (a leak trips the RIG-1267 gen-fence check in `proto/moon.yml`). `SessionEvent` is on the **public** `compass.proto` (`SubscribeAgentSession`'s payload), so its `SessionInjection` case cannot carry the internal discriminant — the public enum is the only option that keeps the diff --git a/docs/designs/infra/ci/compass-dogfood-e2e/design.md b/docs/designs/infra/ci/compass-dogfood-e2e/design.md index 165f75254..5ab22a332 100644 --- a/docs/designs/infra/ci/compass-dogfood-e2e/design.md +++ b/docs/designs/infra/ci/compass-dogfood-e2e/design.md @@ -1,4 +1,4 @@ -# Compass dogfood e2e harness — full-stack scenario testing (SEA-1681) +# Compass dogfood e2e harness — full-stack scenario testing (RIG-1681) Status: Draft @@ -31,7 +31,7 @@ drives the REAL deployable stack — real server, real runner, a real `compass-agent` container running a real model turn — end to end, and nothing composes the already-proven seams into one ordered, repeatable scenario. -SEA-1681 closes that gap, and Matt expanded its scope (direct, 2026-08-05): +RIG-1681 closes that gap, and Matt expanded its scope (direct, 2026-08-05): the deliverable is not one 5-leg test but a **reusable e2e harness** — test infrastructure that stands the full stack up once and exposes composable scenario primitives (create-agent, provision, start-session/drive-turn, @@ -67,9 +67,9 @@ its own. baked uid, and the engine's support for that remap is floor-checked by `VerifyUsernsRemapSupport` (`podman.go:415-438`, called from `main.go:97`). The once-blocking uid-1000-host requirement (`verifyRunnerUID`) has since been - lifted (SEA-1691), so the full-stack tier runs on ordinary arbitrary-uid CI + lifted (RIG-1691), so the full-stack tier runs on ordinary arbitrary-uid CI runners. The interim uid handling for embedded Dogfood is preflight-and-refuse - (compass-native T4, SEA-1685). + (compass-native T4, RIG-1685). - **AF_UNIX sun_path budget.** `stack.Config.Validate` rejects a `RuntimeDir` whose per-container agent-socket tail would overflow the platform sun_path cap — on Linux "a RuntimeDir over 38 bytes overflows the cap" @@ -105,8 +105,8 @@ its own. backend-only + deterministic-model configuration is the per-PR CI gate and regression base; live-model and UI-inclusive runs are on-demand/nightly (nondeterministic, keys + cost). The two once-blocking feasibility - prerequisites have since landed — agent-image distribution (SEA-1690, GHCR - publish) and the host-uid lift (SEA-1691, the userns keep-id remap) — so the + prerequisites have since landed — agent-image distribution (RIG-1690, GHCR + publish) and the host-uid lift (RIG-1691, the userns keep-id remap) — so the full-stack deterministic tier now runs as the required per-PR check directly on ordinary arbitrary-uid CI runners, with no interim merge-queue/nightly staging. This is the subject of Decision D2. @@ -202,7 +202,7 @@ H1's red case, with the adapter change preferred (mirror of the podman test's documented avoidance, `integration_podman_test.go:30-39`). The CI half is NOT small: the image is a large self-contained NixOS closure built only by that opt-in task, with no publish/cache pipeline to put it on a CI runner — that -distribution story is the GHCR publish pipeline (SEA-1690), folded into +distribution story is the GHCR publish pipeline (RIG-1690), folded into Decision D2, not an adapter tweak. ### A2 — Scenario-authoring API: composable primitives @@ -215,7 +215,7 @@ grounded wire contracts: | Primitive | Wire contract | | --- | --- | | `CreateAgent(handle, displayName)` | `CommsService.CreateAgent{handle, display_name, parent_agent_id}` → `{account}` (`proto/compass/v1/comms.proto:526-542`); find-or-create by handle via `ListAccounts` (CreateAgent has no idempotency key) | -| `Provision(accountID, reqID)` | `CompassService.ProvisionAgentWorkspace{agent_account_id, client_request_id, persona}` → `{container_name}` — repo carriage REMOVED (SEA-1527): "spawn/provision no longer clone a repo … the agent self-clones whatever it needs after launch"; tags 2-4 (`remote_url`/`local_path`/`ref`) are reserved (`proto/compass/v1/compass.proto:429-459`). Stable `client_request_id` so a timeout-retry dedups (`:442-447`) | +| `Provision(accountID, reqID)` | `CompassService.ProvisionAgentWorkspace{agent_account_id, client_request_id, persona}` → `{container_name}` — repo carriage REMOVED (RIG-1527): "spawn/provision no longer clone a repo … the agent self-clones whatever it needs after launch"; tags 2-4 (`remote_url`/`local_path`/`ref`) are reserved (`proto/compass/v1/compass.proto:429-459`). Stable `client_request_id` so a timeout-retry dedups (`:442-447`) | | `StartSession(container, prompt, resumeID)` | `CompassService.StartAgentSession{container_name, initial_prompt, resume_session_id}` → `{session_id}` (`compass.proto:480-500`); `resume_session_id` set ⇒ the server "reconstructs the stored transcript into a session-JSONL body the Runner materializes into the new container" (`:488-493`) | | `PostMessage(channel, blocks, reqID)` | `CommsService.PostMessage{channel_id, blocks, topic, client_request_id}` (`comms.proto:663-689`); an `@handle` token inside a text block is the mention surface (`go/internal/delivery/consumer.go:299-308` `mentionRE`) | | `SubscribeComms()` | `CommsService.SubscribeComms` streaming (`comms.proto:109`) — the event-gated wait source (Replay-then-Live, the `waitMessagePosted` shape, `integration_pgtest_test.go:434-449`) | @@ -414,14 +414,14 @@ harness implements that chain as library primitives against the same RPC contracts T5 specs, so T5's CLI can later wrap the same primitives, but the harness does NOT wait for T5's CLI to land (the RPC contracts are on main now; the sequencing note is OQ4-adjacent, resolved in-plan: no dependency). -What leg 2 DOES depend on is a runnable `compass-agent:latest` — SEA-1359's +What leg 2 DOES depend on is a runnable `compass-agent:latest` — RIG-1359's runtime activation (artifacts merged: `packages/compass-agent/src/cli.ts`, `agent-image/`, `devenv.nix:281` `--image compass-agent:latest`; final activation in progress) — flagged in H2's red case, not an open fork. ## Alternatives considered -- **Option B — `devenv up` (SEA-1360) + shell-script orchestration (the T7 +- **Option B — `devenv up` (RIG-1360) + shell-script orchestration (the T7 shape).** The dogfood loop's own mechanism: `processes.{compass-server, compass-runner}` + `services.postgres` with ordered start and a GetServerInfo readiness probe (`devenv.nix:166-290`), the real @@ -512,7 +512,7 @@ fixture reaches Ready with the REAL agent image configured, both clients answer an authenticated RPC, a configured `AgentModel`/`EgressAllow` reaches the runner's flags, and `Down` leaves no child processes. -As-built delta (SEA-1785, #181): H1 shipped a THIRD additive `stack.Config` +As-built delta (RIG-1785, #181): H1 shipped a THIRD additive `stack.Config` field beyond `{AgentModel, EgressAllow}` — `CheckoutDir string` (`go/internal/stack/config.go:52-59`), forwarded conditionally as `--checkout-dir` (`spec.go:67-71`, empty value omits the flag, same @@ -551,7 +551,7 @@ Interfaces: `integration_podman_test.go:20-28`). Test cycle: red — running the scenario against H1's fixture with today's -stack: the turn cannot complete without H3's model backend (and SEA-1359's +stack: the turn cannot complete without H3's model backend (and RIG-1359's final activation); the transcript assert stays empty. Green — with H3 landed, the scenario passes; the settle signal is the one confirmed with the compass-agent owner (H3 coordination). @@ -571,12 +571,12 @@ all of which must close before legs 3/4 are buildable — seam, beside createCommsTools)" (`packages/compass-agent/src/lifecycle.ts:137-141`; `comms.ts:204-206` carries the same notice). A canned model emitting `agents_spawn_peer` - today gets "unknown tool". This is tracked as **SEA-1741** (child of - SEA-1359), and is pure entrypoint wiring: the transport seam already + today gets "unknown tool". This is tracked as **RIG-1741** (child of + RIG-1359), and is pure entrypoint wiring: the transport seam already carries both arms (`transport/index.ts:57-58` `comms()`/`lifecycle()`, socket-wired `:103-104`), and natives registered at construction survive a later `config.tools` control via `agent.ts` `#withNatives` (DL-028; - SEA-1532) — so no new transport or config work, only constructing the + RIG-1532) — so no new transport or config work, only constructing the brokers in `cli.ts main()` and adding the returned tools alongside `customTools: mcp.tools`. 2. **The canned/scripted provider MECHANISM.** A deterministic provider @@ -587,7 +587,7 @@ all of which must close before legs 3/4 are buildable — mechanism (compass-agent owner, 2026-08-05): a `models.yml` custom entry whose `baseUrl` points at a stub OpenAI-compatible server the harness stands up, returning the canned tool-calls per turn — a test-fixture - concern, explicitly NOT part of SEA-1741. The injection point is the + concern, explicitly NOT part of RIG-1741. The injection point is the existing opaque-selector seam — no new selector wiring. 3. **Headless APPROVAL semantics.** All three native tools carry `approval: "write"` (`lifecycle.ts:146,191`; `comms.ts:212`) and neither @@ -596,8 +596,8 @@ all of which must close before legs 3/4 are buildable — auto-executing (yolo default) — there is no human to approve. This task pins that approval policy in the entrypoint. -**RECOMMENDED: fold gap (1) — tool registration (SEA-1741) — and gap (3) — -the headless approval policy — into SEA-1359's final runtime activation (its +**RECOMMENDED: fold gap (1) — tool registration (RIG-1741) — and gap (3) — +the headless approval policy — into RIG-1359's final runtime activation (its own recommended arm, OQ4): ONE image change, not separate respins.** Gap (2), the canned provider, is a harness-side test fixture (stub `baseUrl`) that rides H1/H2, not the agent image. H4's green condition depends on all three @@ -733,7 +733,7 @@ Actions (`.github/workflows/ci.yml`; the repo has no Woodpecker config, so any Woodpecker migration is out of scope for this record). Per Decision D2 the Dogfood end state — which this task now implements — is a required per-PR check running the full-stack deterministic tier on an ORDINARY arbitrary-uid -ubuntu-latest runner. Two once-blocking prerequisites have landed: SEA-1690 +ubuntu-latest runner. Two once-blocking prerequisites have landed: RIG-1690 published `compass-agent` to GHCR, and the uid-1000 requirement was lifted by the userns keep-id remap (`go/internal/runtime/podman.go`'s `--userns=keep-id:uid=%d,gid=%d`, `:389`, floor-checked by @@ -766,7 +766,7 @@ Interfaces: - Consumes: `go test -tags podman ./go/e2e/...` (mirroring the pgtest step shape, `.github/workflows/ci.yml`'s Real-Postgres suites); H3's documented - `COMPASS_MODEL` selector; the published `compass-agent:latest` image (SEA-1690) + `COMPASS_MODEL` selector; the published `compass-agent:latest` image (RIG-1690) OR — on an image-input-changing PR — the image built+loaded from the tree via `container copy agent`; the postgres toolchain (`initdb`/`postgres`/`createdb`) carried onto PATH from the devenv `packages` list (`devenv.nix`); live-mode @@ -790,12 +790,12 @@ reports without gating. - [ ] H1 [harness] harness core: bring-up fixture over `stack.Up`, real agent image, authenticated clients (red-green + clean-Down smoke) - [ ] H2 [harness] leg-2 primitives (CreateAgent → Provision → StartSession) + real-turn scenario with transcript assert (red-green) -- [ ] H3 [compass-agent] full agent-lane contract: native tool registration in the entrypoint + deterministic provider behind the `COMPASS_MODEL` seam + headless approval policy; canned scripts for all four turn shapes (red-green + zero-egress proof; recommended folded into SEA-1359's activation) -- [ ] H4 [harness] legs 3+4 scenario: agent-driven spawn (F2 ownership + second container) and cross-agent @mention (steer/deliver split) (red-green; green gated on H3 1-3, i.e. SEA-1741 tool registration + the canned provider) +- [ ] H3 [compass-agent] full agent-lane contract: native tool registration in the entrypoint + deterministic provider behind the `COMPASS_MODEL` seam + headless approval policy; canned scripts for all four turn shapes (red-green + zero-egress proof; recommended folded into RIG-1359's activation) +- [ ] H4 [harness] legs 3+4 scenario: agent-driven spawn (F2 ownership + second container) and cross-agent @mention (steer/deliver split) (red-green; green gated on H3 1-3, i.e. RIG-1741 tool registration + the canned provider) - [ ] H5 [harness] leg-5 scenario: remove → re-provision → resume across a real container boundary (red-green) - [ ] H6 [harness] teardown + idempotence: exact-name preflight/cleanup; double-run gate (red-green via second-run provision) - [ ] H7 [ui] UI-inclusive tier scenario — gated on OQ3 + compass-ui/compass-native coordination (fast-follow unless ruled otherwise) -- [ ] H8 [ci] GitHub Actions wiring (D2): a required per-PR full-stack e2e check (`go test -tags podman ./e2e/...`) on ordinary arbitrary-uid ubuntu-latest — SEA-1690 (GHCR image) + SEA-1691 (host-uid lift) both landed, so no interim staging; seeds the agent image per-PR (built-from-tree when the PR changes image inputs, else pull `:latest`); postgres toolchain on PATH via devenv `packages`; live tier on-demand/nightly +- [ ] H8 [ci] GitHub Actions wiring (D2): a required per-PR full-stack e2e check (`go test -tags podman ./e2e/...`) on ordinary arbitrary-uid ubuntu-latest — RIG-1690 (GHCR image) + RIG-1691 (host-uid lift) both landed, so no interim staging; seeds the agent image per-PR (built-from-tree when the PR changes image inputs, else pull `:latest`); postgres toolchain on PATH via devenv `packages`; live tier on-demand/nightly ## Decisions @@ -810,17 +810,17 @@ reports without gating. tasks H3/H8. 2. **D2 — Per-PR gate cadence (Decision, Matt, 2026-08-05).** The full-stack deterministic tier is the per-PR gate; the feasibility constraints in its way - are FIXED, not worked around. Agent-image distribution rides SEA-1690 + are FIXED, not worked around. Agent-image distribution rides RIG-1690 (publish `compass-agent` to GHCR), which is needed regardless and becomes part of getting this e2e test into CI. The runner's original uid-1000-on-the-HOST requirement was a known limitation that "can't be - required long term"; lifting it to arbitrary host uids (SEA-1691, the userns + required long term"; lifting it to arbitrary host uids (RIG-1691, the userns keep-id remap) lets the gate run on ordinary CI runners. Both once-blocking prerequisites have since landed, so the full-stack deterministic tier now runs as the required per-PR check directly on ordinary arbitrary-uid runners — no interim merge-queue/nightly staging. (The interim uid handling for embedded Dogfood remains the preflight-and-refuse of compass-native T4, - SEA-1685.) + RIG-1685.) Supersedes the drafted OQ5 arms: neither a bespoke uid-1000 runner ([A]) nor a permanent nightly-only fallback ([B]) — fix the constraints, gate per-PR. Folded through Global Constraints, Approach A1, and task H8. @@ -866,14 +866,14 @@ D2 (see §Decisions); OQ3/OQ4 remain open. native-client) is exactly what #1075 settles. So OQ3 is a recommended fast-follow (H7) off the capstone critical path; rule it once #1075 unparks and the shell is finalized, not against a moving target. -2. **OQ4 — Leg-2 activation dependency (SEA-1359).** Leg 2 needs a runnable +2. **OQ4 — Leg-2 activation dependency (RIG-1359).** Leg 2 needs a runnable `compass-agent:latest` doing a real (canned or live) turn. The artifacts are on main (`packages/compass-agent/src/cli.ts`, `agent-image/`, - `devenv.nix:281` runner `--image compass-agent:latest`) but SEA-1359's + `devenv.nix:281` runner `--image compass-agent:latest`) but RIG-1359's final runtime activation is In Progress. Is the capstone's H2/H3 sequenced - strictly after SEA-1359 closes, or may H3's deterministic backend land as + strictly after RIG-1359 closes, or may H3's deterministic backend land as part of the activation itself (one image change instead of two)? - **Recommended: coordinate H3 into the SEA-1359 owner's lane as a single + **Recommended: coordinate H3 into the RIG-1359 owner's lane as a single image change.** Load-bearing for sequencing only — the design is identical either way. @@ -887,4 +887,4 @@ the PG hot-tail transcript append, the session-status transition, and the `AwaitSessionSettled` primitive either way); whether `EnsureImage` grows a present-check vs the harness using a resolvable `containers-storage:` ref (H1, implementer's choice — the CI-distribution half of the image story is -Decision D2 via SEA-1690, not deferrable). +Decision D2 via RIG-1690, not deferrable). diff --git a/docs/designs/infra/ci/compass-dogfood-loop/design.md b/docs/designs/infra/ci/compass-dogfood-loop/design.md index 92834492d..5a98d2648 100644 --- a/docs/designs/infra/ci/compass-dogfood-loop/design.md +++ b/docs/designs/infra/ci/compass-dogfood-loop/design.md @@ -309,7 +309,7 @@ start and report, not crash on first call" container-spawn + session-start today. But spawn+idle does NOT satisfy the ruled acceptance ("runs an agent turn"), and a real turn needs BOTH a credential in the container AND the provider host in `--egress-allow` -(Approach §4). The production cred path IS being built: the SEA-1327 secrets +(Approach §4). The production cred path IS being built: the RIG-1327 secrets materializer (ITEM 7 — FetchSecrets → the runner writes the frozen `auth-seed.json`) is the writer the compass-server lane owns, so the real-turn leg sequences AFTER ITEM 7 rather than needing a throwaway seed. How and when @@ -592,10 +592,10 @@ were batched to Matt at the design-PR gate and ruled as noted. real-turn leg follows the ITEM 7 + driver chain.** The compass-repo enroll loop (postgres, server+TLS, mint, runner enrolled+idle) has no credential dependency and ships standalone as `[repo]` tasks T1-T4/T6/T7. The FULL - "runs a turn" acceptance completes once the SEA-1327 secrets materializer + "runs a turn" acceptance completes once the RIG-1327 secrets materializer (compass-server lane) and the driver (T5) land. A real turn needs three coupled pieces, all deferred to that chain: (i) the provider credential — - the frozen 0600 `$HOME/.compass/auth-seed.json` the SEA-1327 materializer + the frozen 0600 `$HOME/.compass/auth-seed.json` the RIG-1327 materializer writes (`packages/compass-agent/src/cli.ts:47-50,98-102`; `cli.test.ts:110-111`); (ii) the provider host in `--egress-allow` (default is pure default-deny, `go/internal/runtime/egress.go:29-31`, @@ -628,7 +628,7 @@ were batched to Matt at the design-PR gate and ruled as noted. brings up the light, idempotent enroll loop; the image build + real turn run on demand. -A related public-API fork in the ITEM 7 (SEA-1327 secrets) lane was ruled in +A related public-API fork in the ITEM 7 (RIG-1327 secrets) lane was ruled in the same batch: the `SetSecret`/`ListSecrets`/`DeleteSecret` RPCs go on a new `SecretsService` (not folded onto `CompassService`). That governs the ITEM 7 proto edit, not this record's tasks; noted here only for provenance. diff --git a/docs/designs/infra/ci/compass-local-dev/design.md b/docs/designs/infra/ci/compass-local-dev/design.md index 2923a8251..286249ac9 100644 --- a/docs/designs/infra/ci/compass-local-dev/design.md +++ b/docs/designs/infra/ci/compass-local-dev/design.md @@ -150,7 +150,7 @@ compass-ui = { never races the migrating store. The command matches the existing moon task (`apps/ui/moon.yml:11-12`: `dev: command: 'bunx vite'`) — one convention, two entry points. (The exec preamble above is grounded against current main; -SEA-1983 removes proto — see Global Constraints GC-1 — so the preamble +RIG-1983 removes proto — see Global Constraints GC-1 — so the preamble becomes a plain `exec bunx vite` after the cutover.) **Guard composition.** `processes` is one wholesale-guarded attrset today @@ -362,7 +362,7 @@ OQ4, not a task. ## Global Constraints -- **GC-1 — SEA-1983 sequencing (drop-proto).** SEA-1983's design froze +- **GC-1 — RIG-1983 sequencing (drop-proto).** RIG-1983's design froze (#300, squash bab90139) and its implementation is in flight (T1 = PR #308 nix pin files + toolchain-tools derivations; T2+T4 devenv cutover + toolchain-parity rework, atomic; T5 ci.yml two-phase). It reworks exactly @@ -372,11 +372,11 @@ OQ4, not a task. (devenv.nix:243-244). This record grounds against CURRENT main (still .prototools: bun 1.3.13, node 24.18.0, moon 2.4.2, go 1.26.5 — .prototools:6-13) and does NOT guess the post-cutover shape. - **Implementation of T3/T4/T5 MUST be sequenced after the SEA-1983 cutover + **Implementation of T3/T4/T5 MUST be sequenced after the RIG-1983 cutover lands and rebased onto it** — the toolchain block, the Linux-only guards, and the exec preambles may all move. All devenv.nix line-number citations in this record (:218, :243-244, - :253, :260, :265, etc.) DIE at the SEA-1983 rebase — the implementing + :253, :260, :265, etc.) DIE at the RIG-1983 rebase — the implementing agent MUST re-ground T3/T4/T5 against the post-cutover file, never pattern-match stale line numbers. - **Tool pins (as of this record):** bun 1.3.13 / node 24.18.0 / moon 2.4.2 / @@ -403,7 +403,7 @@ OQ4, not a task. Order: T1/T3 (UI-in-up — the compass-critical path), T2 (the direct-dial streaming smoke), then T4/T5/T6 (macOS), T7 (gate-hazard docs, small, can -land any time). T3–T5 rebase onto SEA-1983 per GC-1. +land any time). T3–T5 rebase onto RIG-1983 per GC-1. ### T1 — Wire the UI's base URL to the dev-http door (owner: compass-repo) @@ -450,7 +450,7 @@ subscribe). event never created) → green (running stack, frames arrive incrementally). -**Resolved (SEA-2001) — OQ5 decided: a documented manual smoke, not a bun +**Resolved (RIG-2001) — OQ5 decided: a documented manual smoke, not a bun test.** The hermetic-automated arm cannot faithfully cover this task's subject. A `SubscribeEvents` check against the *browser's own* direct-dial transport (`createCompassWebTransport` → gRPC-Web over real `fetch`, @@ -511,7 +511,7 @@ bunx vite` from `cwd = ${config.devenv.root}/apps/ui`, env `VITE_COMPASS_BASE_URL=http://127.0.0.1:${ports.devhttp.value}` (direct-dial, decided), `after = ["devenv:processes:compass-server"]`. Update the `devenv up` chain comment -(devenv.nix:174-196) to include the UI. **Rebase onto SEA-1983's cutover +(devenv.nix:174-196) to include the UI. **Rebase onto RIG-1983's cutover (GC-1): the exec preamble shape follows whatever toolchain activation the cutover leaves.** @@ -534,7 +534,7 @@ pkgs.stdenv.isLinux { ... }` (the devenv.nix:89/:127 env pattern). T4 moves the compass-server exec (including its `--listen` line) out of the guard UNCHANGED; T5 then adds the decided darwin variance to that same attr (§A2b's darwin `--listen` rebind) — the two tasks co-edit it. **Rebase -onto SEA-1983 (GC-1).** +onto RIG-1983 (GC-1).** - **Interfaces:** consumes the current guard structure (devenv.nix:211, :218, :346); produces `devenv up` on darwin = postgres, gen-cert, server, @@ -635,10 +635,10 @@ zireael/jj-hp lane. No behavioral change in this repo. - [ ] T2 — streaming e2e smoke against the direct dev-door (compass-repo; documented manual smoke per OQ5, resolved) - [ ] T3 — `compass-ui` process in `devenv up`, after compass-server ready - (compass-repo; rebase on SEA-1983) + (compass-repo; rebase on RIG-1983) - [ ] T4 — relax Linux guards: postgres/server/UI/gen-cert/mint cross-platform; runner/agent-image/clean/PKG_CONFIG_PATH stay Linux - (platform; rebase on SEA-1983; co-edits `--listen` attr with T5) + (platform; rebase on RIG-1983; co-edits `--listen` attr with T5) - [ ] T5 — darwin `--listen` bind spike + `dogfood:vm-runner` (podman machine) + `compass-gen-cert --san` (compass-runner) - [ ] T6 — darwin Wails entrypoint (`darwin && shell` opt-in) + welded-trio @@ -693,7 +693,7 @@ so OQ2 is intentionally absent — it was promoted to a decision, not dropped. devenv env the assertion is dead weight, and landing it now creates a compass-side change the harness fix immediately obsoletes. Revisit only if the zireael fix slips a month+. -- **OQ5 (non-load-bearing) — T2 automation depth. RESOLVED (SEA-2001): +- **OQ5 (non-load-bearing) — T2 automation depth. RESOLVED (RIG-2001): documented manual smoke, not a bun test** — the hermetic arm cannot cover the browser's real gRPC-Web-over-HTTP transport in-fence (`@connectrpc/connect-node` is fenced in `apps/ui`; the only in-fence fake, diff --git a/docs/designs/infra/ci/compass-pr-validation/design.md b/docs/designs/infra/ci/compass-pr-validation/design.md index 127fdf459..2936a555d 100644 --- a/docs/designs/infra/ci/compass-pr-validation/design.md +++ b/docs/designs/infra/ci/compass-pr-validation/design.md @@ -7,7 +7,7 @@ Status: Draft > results surfaced ON the PR, a previewable UI build, and a validation skill > bundled with the Compass agents — so review time is judgment, not > reproduction. Extends the existing e2e harness record -> (`docs/designs/platform/compass-dogfood-e2e/design.md`, SEA-1681, H1-H8). +> (`docs/designs/platform/compass-dogfood-e2e/design.md`, RIG-1681, H1-H8). > Local-dev / gate mechanics are a separate record > (`docs/designs/platform/compass-local-dev/design.md`). UI-visible changes > are additionally previewable in an isolated PR-preview environment defined diff --git a/docs/designs/infra/runtime/compass-elastic-session-runtime/design.md b/docs/designs/infra/runtime/compass-elastic-session-runtime/design.md index a010fd6ed..bb4bb7593 100644 --- a/docs/designs/infra/runtime/compass-elastic-session-runtime/design.md +++ b/docs/designs/infra/runtime/compass-elastic-session-runtime/design.md @@ -231,7 +231,7 @@ The hardening work reuses that discipline: `Exec` is completion-shaped; a **streaming variant is reserved in the seam now** (live stdio + kill/wait handle, mirroring how `ContainerRuntime` splits `Exec`/`ExecStreaming`, `go/internal/runtime/podman.go:293-307`) for - SEA-1720's agent-launched dev servers, even if unimplemented, so freezing + RIG-1720's agent-launched dev servers, even if unimplemented, so freezing the seam does not force a breaking change later. There is no placement seam for the agent process itself: the agent runs in @@ -545,7 +545,7 @@ configurations end to end, with `ContainerRuntime`'s existing verbs frozen: volume mount), and egress arming need without threading them through every `Exec` call. A streaming variant (`ExecStreaming`-shaped: live stdio + kill/wait handle, mirroring `go/internal/runtime/podman.go:299-307`) is - **reserved in the interface now** for SEA-1720, even if unimplemented. + **reserved in the interface now** for RIG-1720, even if unimplemented. Reuses `runtime.ExecOutput` (`go/internal/runtime/podman.go:139-146`) — fully buffered stdout/stderr, an accepted limit for whole-suite output until the streaming variant lands. `SpecBuilder` @@ -734,7 +734,7 @@ relaunch on activity. seamlessness ever depends on `$HOME` state surviving, that is a later decision to move `$HOME` onto the volume, not assumed here). Consequently **idle detection gates on there being no live streaming exec**: a running - dev server (SEA-1720) or an in-flight heavy op blocks suspend — suspending + dev server (RIG-1720) or an in-flight heavy op blocks suspend — suspending under one would kill it, which the user would see. Idle means the inner loop is quiescent *and* nothing long-lived is running. - **Resume:** on activity, relaunch through the standard `AgentRuntime.Launch` @@ -872,10 +872,10 @@ Nothing pinned in the Approach is re-opened here. 3. **[non-load-bearing] Volume expiry value.** Drafted default: 14 days after session close, tunable per deployment. Pure cost policy; M0's working-set GB distribution calibrates it. Deferred to measurement. -4. **[load-bearing] SEA-1720 streaming-exec seam shape.** `ComputeRuntime` +4. **[load-bearing] RIG-1720 streaming-exec seam shape.** `ComputeRuntime` reserves a streaming variant (live stdio + kill/wait handle) for agent-launched dev servers; the port-exposure and lifecycle wiring are - SEA-1720's scope. **Recommendation:** freeze the reserved signature in S1 + RIG-1720's scope. **Recommendation:** freeze the reserved signature in S1 mirroring `ContainerRuntime.ExecStreaming` (`go/internal/runtime/podman.go:299-307`); implement nothing here. 5. **[resolved — decided, now task I1] Inter-tenant isolation boundary = diff --git a/docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md b/docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md index 7284af853..a2ed75137 100644 --- a/docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md +++ b/docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md @@ -2,7 +2,7 @@ Status: Draft -Linear: SEA-1575. Follow-up Matt ordered when resolving the spawn/despawn +Linear: RIG-1575. Follow-up Matt ordered when resolving the spawn/despawn record's OQ-6 ("accept for MVP, file follow up to design fully later", 2026-07-29). @@ -39,7 +39,7 @@ runs under a deadline so a wedged provision fails the tool call in-band `go/internal/runner/gateway/lifecycle.go:46-47`: "The inbound deadline rides ctx into the forward"). It is the **sole** MVP guard: spawn caps were deferred (spawn/despawn record `:852-855`: "Proper spawn limits are deferred to -**SEA-1574**. Consequence for OQ-6: with no cap shipping, the **bounded relay +**RIG-1574**. Consequence for OQ-6: with no cap shipping, the **bounded relay deadline (Approach) is the sole MVP guard** on how long an agent can monopolize the Runner's serial command plane."). The deadline bounds how long one caller waits; it does nothing for the other commands queued behind the @@ -49,7 +49,7 @@ provision. Removing the head-of-line blocking requires concurrency. - **Single-Runner dogfood target.** The design serves the current one-Runner, one-stream deployment; multi-stream/high-volume hardening stays T9's - (SEA-1328) scope per `dispatch.go:85-87` ("A future high-volume / + (RIG-1328) scope per `dispatch.go:85-87` ("A future high-volume / multi-stream Runner needs bounded eviction + in-flight-sentinel dedup here; deferred to T9") — except the pieces this record deliberately pulls forward (in-flight sentinel, per-container transition lock; see Approach and OQ-1). @@ -75,7 +75,7 @@ provision. Removing the head-of-line blocking requires concurrency. existing config-worker discipline (`dispatch.go:174-177` — `defer func() { cancel(); <-d.configWorkerDone }()`). No leak under any Receive/Send error path. -- **Forward dependency on T9 (SEA-1328).** This record lands the scoped +- **Forward dependency on T9 (RIG-1328).** This record lands the scoped per-container transition lock T9's issue body lists as its own items (see OQ-1). Whoever picks up T9 MUST consume/extend that lock, not re-introduce it. T4 updates the code comments that currently defer to T9 @@ -279,8 +279,8 @@ the Start TOCTOU (`host.go:244-252`): > concurrent callers reachable" This record makes those callers reachable FIRST, so the lock cannot stay -deferred. Critically, this is not a new one-off lock: SEA-1575 and T9 share -the same locking machinery. T9's issue body (SEA-1328) documents the +deferred. Critically, this is not a new one-off lock: RIG-1575 and T9 share +the same locking machinery. T9's issue body (RIG-1328) documents the per-session transition lock and in-flight sentinel as its own items and notes the concurrent-host-caller races are "verified unreachable in the single-Runner MVP ... reachable only when T9 builds in-process reattach against a persistent @@ -393,7 +393,7 @@ in the spawned goroutine before `handle`), with zero interface change. One uniform dispatch path; every invariant handled once; Status latency decoupled from Provision by construction; mirrors the concurrency shape the Server side already ships (router sendMu + pendingCall join). -3. **Do nothing now; gate entirely on T9 (SEA-1328).** T9 is Backlog and +3. **Do nothing now; gate entirely on T9 (RIG-1328).** T9 is Backlog and genuinely not started (no owner, no assignee, no branch). Gating leaves the agent-facing HOL blocking — which the spawn/despawn record ships agent-triggerable in a loop — in place indefinitely, guarded only by the @@ -599,20 +599,20 @@ Concurrent dispatch makes concurrent `SessionHost` callers reachable before the per-session transition lock exists — `host.go:250-252` defers that lock to T9 ("A per-session transition lock is deferred to T9, where in-process reattach against a persistent host first makes concurrent callers reachable"). -SEA-1575 and T9 (SEA-1328) share the same locking machinery: T9's issue body +RIG-1575 and T9 (RIG-1328) share the same locking machinery: T9's issue body documents the per-session transition lock + in-flight sentinel as its own items and marks the concurrent-host-caller races "verified unreachable in the single-Runner MVP ... reachable only when T9 builds in-process reattach against a persistent host". This record makes them reachable first. Options: - **(A) Start T9's transition lock now, scoped to per-container lifecycle - serialization (RECOMMENDED — the record as written, T4).** SEA-1575 is + serialization (RECOMMENDED — the record as written, T4).** RIG-1575 is self-contained; the lock is small, local to `agentHost`, and is T9's OWN design built early — not a throwaway. Cost: if T9's eventual persistent-host redesign reshapes the host, the lock may need rework; mitigated by the forward-dependency note (T9 consumes/extends this lock, never re-introduces it) carried in Global Constraints and the T4 comment rewrite. -- **(B) Gate SEA-1575 entirely on full T9.** No duplicated machinery ever — +- **(B) Gate RIG-1575 entirely on full T9.** No duplicated machinery ever — but T9 is genuinely NOT started (Backlog, no owner, no assignee, no branch), so this gates the fix for an already-shipped, agent-triggerable HOL exposure on an unscheduled item of much larger scope (persistent host, in-process @@ -621,7 +621,7 @@ against a persistent host". This record makes them reachable first. Options: **Resolved (Matt, 2026-08-09): (A)** — build T9's per-container transition lock now, scoped to the lifecycle paths concurrent dispatch reaches (T4), with -the forward-dependency note so T9 (SEA-1328) consumes/extends it. The Approach, +the forward-dependency note so T9 (RIG-1328) consumes/extends it. The Approach, Global Constraints, and T4 are written to this ruling. ### OQ-2 (not load-bearing — default chosen; flag only if Matt objects): worker pool vs goroutine-per-command @@ -645,13 +645,13 @@ strict duplicate detection, the joiner should skip the Send instead (a one-line change in `handle`'s join arm). Recorded so the interaction is visible, not decided by accident. -### OQ-4 (LOAD-BEARING — blocks merge until Matt rules): Provision concurrency before SEA-1574 caps exist +### OQ-4 (LOAD-BEARING — blocks merge until Matt rules): Provision concurrency before RIG-1574 caps exist Today's serial dispatch loop is an accidental **concurrency-1 throttle** on agent-triggered Provisions: one agent looping spawns gets at most one podman build/pull at a time, because the loop can't start the next command until the current one returns. This record removes that throttle before any explicit cap -exists — spawn caps were explicitly deferred to **SEA-1574** (Problem section; +exists — spawn caps were explicitly deferred to **RIG-1574** (Problem section; the relay deadline is named there as the *sole* MVP guard). So N distinct-id Provisions become N concurrent podman launches, each up to `defaultCommandTimeout` (120s, `podman.go:329`) of CPU/disk/network — a @@ -672,12 +672,12 @@ bounds WAITERS, not Runner-side concurrent WORK. Options: (T-cap) and a test (a slow-Provision fan-out beyond the cap queues the overflow but a concurrent Stop still returns immediately). Restores a real, intentional throttle instead of silently deleting the accidental one. -- **(ii) Order SEA-1574 before SEA-1575.** No cap logic in this change, but it +- **(ii) Order RIG-1574 before RIG-1575.** No cap logic in this change, but it blocks a shipped-exposure fix behind an unscheduled cap design, and leaves - the window fully open until SEA-1574 lands. + the window fully open until RIG-1574 lands. - **(iii) Accept the widened window explicitly for the single-Runner dogfood.** Cheapest now; correct only if the dogfood Runner is never driven by an - adversarial/looping agent before SEA-1574. Makes the accidental-throttle + adversarial/looping agent before RIG-1574. Makes the accidental-throttle removal a conscious, recorded decision rather than an inherited one. **Resolved (Matt, 2026-08-09): (i)** — land the Provision-arm concurrency cap diff --git a/docs/designs/infra/runtime/compass-runner-gateway-error-sentinels/design.md b/docs/designs/infra/runtime/compass-runner-gateway-error-sentinels/design.md index 198610adf..c998da92c 100644 --- a/docs/designs/infra/runtime/compass-runner-gateway-error-sentinels/design.md +++ b/docs/designs/infra/runtime/compass-runner-gateway-error-sentinels/design.md @@ -2,7 +2,7 @@ Status: Active -Linear: SEA-1442. Approach ruled by Matt (full fix across all three lanes: +Linear: RIG-1442. Approach ruled by Matt (full fix across all three lanes: proto enum value + server mapping arm + runner sentinels); this record documents and decomposes the decided approach — it does not re-open the choice. @@ -53,7 +53,7 @@ The canonical operator-fault path is the socket-path-too-long check, a bare The diagnostic *message* survives the relay (`RunnerError.message` is carried; `commands.go:216` — `fmt.Errorf("runner: %s", e.GetMessage())`), but the *classification* is lost: the admin sees `Internal`, which reads as a Compass -bug rather than a knob to turn. Per SEA-1442, fix this as ONE change covering +bug rather than a knob to turn. Per RIG-1442, fix this as ONE change covering the sibling operator-fault paths, not a one-off for the too-long check. ## Global Constraints @@ -71,7 +71,7 @@ the sibling operator-fault paths, not a one-off for the too-long check. generated only into internal Go consumers, so no public TS client is affected. - **Enum precedent to mirror exactly**: `RUNNER_ERROR_CODE_RESOURCE_EXHAUSTED - = 4` added for SEA-1569 (`runner.proto:418-422`) — a new value with a doc + = 4` added for RIG-1569 (`runner.proto:418-422`) — a new value with a doc comment naming its Connect mapping ("-> Connect ResourceExhausted") and the distinguishing rationale. - **`go test -race` is the merge gate** (CGO_ENABLED=1); new tests must be @@ -401,7 +401,7 @@ Owned by compass-server; hand off after T1. Two edits: One integration-level test proving the full chain: a Runner whose provision fails on a wrapped operator-fault error surfaces to the Hub caller as `connect.CodeFailedPrecondition` with the diagnostic text intact — the -end-to-end contract SEA-1442 names (RED before the pair lands, GREEN after). +end-to-end contract RIG-1442 names (RED before the pair lands, GREEN after). Candidate home: the runnerhub test harness that already drives real dispatch/relay round-trips (e.g. beside `deliveryarm_test.go`, which asserts RunnerError codes over the relay at diff --git a/docs/designs/platform/compass-devenv-source-dry/design.md b/docs/designs/platform/compass-devenv-source-dry/design.md index bdf29cec2..06b4bc19b 100644 --- a/docs/designs/platform/compass-devenv-source-dry/design.md +++ b/docs/designs/platform/compass-devenv-source-dry/design.md @@ -234,7 +234,7 @@ delta is `devenv.yaml` + a relock (task T4). hazard is live, not hypothetical — ci.yml:1153's rev is only correct today by coincidence of the last manual sync, and the next `devenv update` in agent-image/ silently decouples the CI seed from the lock (the - SEA-1304/RIG-2245 regression class renovate.yml:106-108 names is exactly + RIG-1304/RIG-2245 regression class renovate.yml:106-108 names is exactly "silent divergence at a setup seam"). - **(b) A shared bash script.** The resolve logic (JSON parse → validate → compose flakeref → build → locate bin, with loud failure on shape drift) is diff --git a/docs/designs/platform/compass-e2e-mention-split-observation/design.md b/docs/designs/platform/compass-e2e-mention-split-observation/design.md index d445a8113..e58616b67 100644 --- a/docs/designs/platform/compass-e2e-mention-split-observation/design.md +++ b/docs/designs/platform/compass-e2e-mention-split-observation/design.md @@ -22,7 +22,7 @@ the unmentioned one" (`docs/designs/platform/compass-dogfood-e2e/design.md:663-6 The e2e test asserts everything else in H4 already; the split itself is an explicit deferral (`go/e2e/legthreefour_test.go:239-251`): -> `TODO(SEA-1788): assert the steer-vs-deliver SPLIT on the recipient side — +> `TODO(RIG-1788): assert the steer-vs-deliver SPLIT on the recipient side — > [...] This is unconfirmable from the e2e fixture as it stands: the > steer/deliver op-kind is an AgentControl the delivery consumer dispatches > over the Runner's per-session Control stream (agent-facing internal @@ -278,7 +278,7 @@ and the receipt arm's green on BOTH recipients depends on this (the leg-3 reachability). **Extend, not a new test.** The split assertions replace the -`TODO(SEA-1788)` block inside `TestLegThreeFourSpawnAndMessaging` +`TODO(RIG-1788)` block inside `TestLegThreeFourSpawnAndMessaging` (`legthreefour_test.go:239-255`) rather than standing up a new test: the frozen H4 green condition is "one ordered run" (frozen design.md:663), the spawner/peer/containers/tails the split needs are exactly the ones leg 3 built, @@ -472,7 +472,7 @@ Green — the two additions. ### T6 — The split assertion in `TestLegThreeFourSpawnAndMessaging` -Replace the `TODO(SEA-1788)` block (`legthreefour_test.go:239-255`) with the +Replace the `TODO(RIG-1788)` block (`legthreefour_test.go:239-255`) with the ordered split assertions; arm the fixture with `WithDispatchTap()` and extend the canned script/routing. diff --git a/docs/designs/platform/compass-initial-prompt-removal.md b/docs/designs/platform/compass-initial-prompt-removal.md index 64003928f..37e87fa32 100644 --- a/docs/designs/platform/compass-initial-prompt-removal.md +++ b/docs/designs/platform/compass-initial-prompt-removal.md @@ -1,7 +1,7 @@ # Remove dead `initial_prompt` from the agent-session start path Status: Active -Tracking: SEA-1959. Ruled by Matt as a separate cutover shipping ahead of the +Tracking: RIG-1959. Ruled by Matt as a separate cutover shipping ahead of the runner deliver-leg build (2026-08-12). > **Design record.** All file+line citations below are paths in @@ -16,7 +16,7 @@ runner deliver-leg build (2026-08-12). accepted on the wire but **never delivered to the agent** — dead plumbing. There is no working server-originated turn-driver in its place *yet*: the intended replacement is a message posted to the agent's home channel (the -SEA-1569 delivery path), but that leg is not wired end to end today (see "The +RIG-1569 delivery path), but that leg is not wired end to end today (see "The real turn-driver" below) and is being built as an immediately-following work item. Removing the dead field removes a misleading API surface that promises a first turn it never delivers — independent of when the replacement lands. @@ -133,7 +133,7 @@ the other session commands, none a deliver) — and the gateway parks can be sent (`go/internal/runner/gateway/control.go:190-215`, `errEmptyControlVariant` `:65-70`). So no server-originated control op drives a live agent turn yet. Building that deliver leg is a separate, -immediately-following work item (ruled by Matt 2026-08-12; the SEA-1728 e2e +immediately-following work item (ruled by Matt 2026-08-12; the RIG-1728 e2e real-turn coverage stacks on it). This record removes the dead `initial_prompt` field on its own; the replacement turn-driver it names becomes functional when the deliver leg lands. @@ -157,8 +157,8 @@ prevents any future field from silently decoding stale bytes. `buf breaking` is a non-issue here: the breaking gate was removed pre-dogfood (`buf.yaml:37` and `proto/moon.yml:165` both read "buf breaking gate removed -pre-dogfood (SEA-1922); RE-ADD AT GA / first pinned client (tracked: -SEA-1951)"). There is no `breaking` task in `proto/moon.yml` (its tasks are +pre-dogfood (RIG-1922); RE-ADD AT GA / first pinned client (tracked: +RIG-1951)"). There is no `breaking` task in `proto/moon.yml` (its tasks are lint/gen/drift/gen-fence/ci, `:25-169`) and no `FIELD_NO_DELETE` `ignore_only` list in `buf.yaml` (its only `ignore_only` block is for lint rules, `:28-36`). So the removal needs no exemption and satisfies no breaking check — `reserved` @@ -196,7 +196,7 @@ ignore (or reject) a non-empty value. Why it loses: The field is harmless at runtime but actively misleads: the e2e fixture (`go/e2e/agent_ops.go:50-52`, "brings the agent … online … with an initial prompt") and every `InitialPrompt: "go"` test literal encode the false belief -that the prompt seeds a turn. The recent SEA-1728 e2e work had to discover the +that the prompt seeds a turn. The recent RIG-1728 e2e work had to discover the hard way that the prompt is never delivered (and that the home-channel deliver leg meant to replace it is itself not yet wired); the next reader will too, until the field is gone. @@ -210,7 +210,7 @@ until the field is gone. - Buf discipline: field removals MUST `reserved` both the field number and the name in the same edit (forward-compat hygiene). There is no `buf breaking` gate to satisfy — it was removed pre-dogfood (`buf.yaml:37`, - `proto/moon.yml:165`; re-added at GA per SEA-1951) — so no `FIELD_NO_DELETE` + `proto/moon.yml:165`; re-added at GA per RIG-1951) — so no `FIELD_NO_DELETE` exemption is needed. - Regen ordering is proto → codegen → callers: edit the `.proto`, run `moon run proto:gen` (three buf lanes — public, agent-TS, internal-Go; diff --git a/docs/designs/platform/compass-runnerhub-send-queue/design.md b/docs/designs/platform/compass-runnerhub-send-queue/design.md index c6640ad90..f0b7d030c 100644 --- a/docs/designs/platform/compass-runnerhub-send-queue/design.md +++ b/docs/designs/platform/compass-runnerhub-send-queue/design.md @@ -4,11 +4,11 @@ Status: Draft Tracker: RIG-1611 — PR #75 review LOW #3, parked at review time ("no change for MVP, multi-Runner only"). Provenance: the parent product record -`docs/designs/product/compass-notification-delivery/design.md` (SEA-1569 T3) +`docs/designs/product/compass-notification-delivery/design.md` (RIG-1569 T3) ships the fan-out consumer whose head-of-line blocking motivates this record; that record is frozen (`Status: Active`) and is cited, never edited. This is the **SERVER-side counterpart** to the already-**MERGED** RUNNER-side work -`compass-runner-concurrent-dispatch` (SEA-1575, commit 2ebdf09d on main — +`compass-runner-concurrent-dispatch` (RIG-1575, commit 2ebdf09d on main — "feat(runner): concurrent per-command Sessions dispatch"; its record's `Status: Draft` header is stale, out of scope here): that change decoupled the Runner's serial Sessions *command-execution* loop @@ -155,7 +155,7 @@ order to the wire). context.WithCancelCause(ctx)`; `:251-253`: `cancelCause(nil); d.wg.Wait()`). - **AGENTS.md comment rules.** Code comments cite this record by path, never issue IDs; this record cites tracker IDs as bare plain text (RIG-1611, - SEA-1569, SEA-1575, RIG-1610) per `docs/designs/CONTRIBUTING.md` rule 1. + RIG-1569, RIG-1575, RIG-1610) per `docs/designs/CONTRIBUTING.md` rule 1. ## Approach @@ -571,7 +571,7 @@ Interfaces: none (docs only). wait cannot help. Residual: the bound VALUE only (below). - **OQ-3 — landing posture: land independently; the sibling is already MERGED.** The runner-side counterpart shipped as commit 2ebdf09d - ("feat(runner): concurrent per-command Sessions dispatch (SEA-1575)") on + ("feat(runner): concurrent per-command Sessions dispatch (RIG-1575)") on main. Nothing to gate on. (Aside, out of scope here: that record's `Status: Draft` header is stale — code merged, doc never flipped.) - **sendMu keep-vs-drop: DROP.** The single sender goroutine is the sole diff --git a/docs/designs/platform/compass-server-llm-gateway/design.md b/docs/designs/platform/compass-server-llm-gateway/design.md index 5153fc832..8af6d6853 100644 --- a/docs/designs/platform/compass-server-llm-gateway/design.md +++ b/docs/designs/platform/compass-server-llm-gateway/design.md @@ -314,7 +314,7 @@ the container). The gateway is the only runtime holder of upstream provider credentials at request time; the compass store is the durable source of truth. That needs a value-persisting store — and it is a NEW store, NOT an extension of the -SEA-1327 declared-secrets registry, which is names-only by invariant: it +RIG-1327 declared-secrets registry, which is names-only by invariant: it persists a secret's name/delivery/kind/provider but never its value ("Values live only in the provider and this process's memory during a resolve; they are never persisted by Compass", `go/internal/secrets/secrets.go:20-22`; diff --git a/docs/designs/platform/compass-server-runner-otel/design.md b/docs/designs/platform/compass-server-runner-otel/design.md index 2a8733dae..6e08905e1 100644 --- a/docs/designs/platform/compass-server-runner-otel/design.md +++ b/docs/designs/platform/compass-server-runner-otel/design.md @@ -146,7 +146,7 @@ causality is in scope: - `SessionInjection` (`proto/compass/v1/compass.proto:524-533`; next-free after `op_kind = 1`, `message_id = 2`, `from_handle = 3`) → `traceparent` = **field 4** (PUBLIC observation surface; Matt ruled OQ2 = yes). A plain - `string` add does NOT touch the gen-fenced enum (`SEA-1267`, + `string` add does NOT touch the gen-fenced enum (`RIG-1267`, `compass.proto:535-539` fences `SessionInjectionKind`, not scalar fields), so it is a clean additive public-API field. The agent EMITS it on the injection observation from the `traceparent` it decoded (#649 T3), giving public @@ -627,7 +627,7 @@ message SessionInjection { string from_handle = 3; // Trace the agent continued for this injection; lets a public // session-stream consumer join the observation to its trace. Scalar add — - // does not touch the SEA-1267 gen-fenced enum. + // does not touch the RIG-1267 gen-fenced enum. string traceparent = 4; } @@ -844,7 +844,7 @@ Interfaces: (`proto/compass/v1/compass.proto:524-533`; next-free field 4 after `op_kind=1, message_id=2, from_handle=3`) is the public `SessionEvent`/`SubscribeAgentSession` payload. Adding a scalar `string - traceparent` does NOT touch the gen-fenced enum (`SEA-1267`, + traceparent` does NOT touch the gen-fenced enum (`RIG-1267`, `compass.proto:535-539`, fences `SessionInjectionKind`), so it is a clean additive public-API field. The agent emits it from the `traceparent` it decoded (#649 T3), giving public session-stream consumers a direct diff --git a/docs/designs/product/compass-ade-shell/design.md b/docs/designs/product/compass-ade-shell/design.md index 57d124ee3..75950a6a3 100644 --- a/docs/designs/product/compass-ade-shell/design.md +++ b/docs/designs/product/compass-ade-shell/design.md @@ -274,7 +274,7 @@ confirmed by `AgentStateDot.test.ts`): | `error` | red dot (`bg-red-500`) | **crashed/failed session** — provider error, tool-failure loop, unrecoverable exception; the human restarts or investigates | **The agent dot is a UI projection over the daemon's `AgentSessionState`, not a -parallel enum.** #443 (SEA-1023, at the merge gate) lands the authoritative +parallel enum.** #443 (RIG-1023, at the merge gate) lands the authoritative agent-liveness contract in `compass.v1` (`crates/compass-proto/proto/compass/v1/compass.proto` on `livingstone-sea-1023-acp-impl`) — deliberately **coarse**, daemon-owned: @@ -339,7 +339,7 @@ active board, since every column is per-agent) has no jump target. This record is overwhelmingly **UI/app-state** (the `AppStore` seam, the fixture, the SolidJS surfaces) and touches no wire contract on its own. Two seams cross into daemon territory and are governed explicitly so this design does not collide -with the `compass.v1` owner's in-flight work (#443, SEA-1023): +with the `compass.v1` owner's in-flight work (#443, RIG-1023): - **Agent liveness** is owned by `compass.v1` `AgentSessionState` (#443). The UI *consumes* it and derives the presentation dot (D9); it never redefines it. The @@ -420,7 +420,7 @@ export interface Workstream { state: WorkstreamState; // canonical Compass state tracker?: { // the linked tracker issue, if any kind: TrackerKind; - id: string; // e.g. "SEA-1042" + id: string; // e.g. "RIG-1042" status: string; // the tracker's native status name url: string; }; @@ -702,7 +702,7 @@ contract and adds no `### Requirement:` to `docs/specs/product/compass.md`. But the record has a **contract dependency and a decided future impact** that the implementing PRs will carry: -- **Depends on #443 (SEA-1023).** #443 lands the `AgentSessionState` contract + +- **Depends on #443 (RIG-1023).** #443 lands the `AgentSessionState` contract + agent-session payloads in `compass.v1` and updates `docs/specs/product/compass.md` in that PR. This UI *consumes* it and derives the agent dot (D9); it never modifies it. The agent-state seam is untouched by this record. diff --git a/docs/designs/product/compass-agent-comms-tools/design.md b/docs/designs/product/compass-agent-comms-tools/design.md index a5bc22118..325d04a88 100644 --- a/docs/designs/product/compass-agent-comms-tools/design.md +++ b/docs/designs/product/compass-agent-comms-tools/design.md @@ -31,7 +31,7 @@ Named rather than blanket, because a line range is a claim about a commit and drifts silently as the file above it grows — a reader checking one against a later tree is seeing drift, not necessarily an error. -Tracker: SEA-1355. +Tracker: RIG-1355. ## Problem / Intent @@ -261,7 +261,7 @@ Every task below inherits these; they are not repeated per task. exists: `PostMessageRequest.blocks` can carry `ask` blocks (`comms.proto` MessageBlock), so `comms_post_message` can *raise* an ask — raising is allowed (it is a user-facing question), answering is not; the two ask-raising lanes - (this and the not-yet-built SEA-1310 outbound ask derivation) both only + (this and the not-yet-built RIG-1310 outbound ask derivation) both only raise, neither answers. - **Egress seal preserved.** No new network path out of the agent container. The comms transport is the frozen per-container Unix socket @@ -269,7 +269,7 @@ Every task below inherits these; they are not repeated per task. address; the nft mechanism and the future default-deny opt-in (`compass-agent-container-runtime.md:206-217`) are untouched. No bearer token, Server address, or account identity enters the agent container. -- **SEA-1267 gen-fence.** No internal symbol — `AgentFrame`, `AgentControl`, +- **RIG-1267 gen-fence.** No internal symbol — `AgentFrame`, `AgentControl`, `SessionFrame`, `RunnerService`, `RunnerError`, `compassv1internal` and the control/gateway names alongside them — may appear in the public gen trees `packages/compass-client/src/gen` or `go/gen`. The authoritative list is the @@ -642,7 +642,7 @@ In `packages/compass-agent/src/`: `[answered ${fence}] → `, resolving an option id to its label against `options` and falling back to the bare id. The fully-skipped ask — answered with every question left empty — stays indistinguishable until - `Ask.answered` reaches the wire (SEA-1519, compass-server's lane); the store + `Ask.answered` reaches the wire (RIG-1519, compass-server's lane); the store names this itself as the only reliable answered-signal. *Both renderers, not one.* The post path returns diff --git a/docs/designs/product/compass-agent-config-delivery/design.md b/docs/designs/product/compass-agent-config-delivery/design.md index 798ac666f..d707bc421 100644 --- a/docs/designs/product/compass-agent-config-delivery/design.md +++ b/docs/designs/product/compass-agent-config-delivery/design.md @@ -4,7 +4,7 @@ Status: Draft > Freezes on merge; later changes supersede by citation, never rewrite > (convention: `../compass-0.5/design.md:10-12`, restated -> `../compass-0.6/design.md:1116-1118`). Tracked as SEA-1568. +> `../compass-0.6/design.md:1116-1118`). Tracked as RIG-1568. > > **New named Decisions this record introduces (ledger rows DL-078..DL-081, > landed in DECISIONS.md in this same PR):** @@ -18,20 +18,20 @@ Status: Draft > `FetchAgentConfig` RPC on the Runner-dialed `RunnerService`, plus a > `ConfigVersion` signal on the `Sessions` response stream — > signal-then-pull over the frozen dial-out inversion, the exact pattern -> SEA-1327's `FetchSecrets`/`SecretsVersion` set; the inversion gains no +> RIG-1327's `FetchSecrets`/`SecretsVersion` set; the inversion gains no > inbound route. > - **CD-3** — Injection for skills/extensions/MCP-configs is a Runner-local, > Runner-materialized **read-only bind mount** of the **parent** config dir > at `/run/compass/agent-config` (the agent reads through `current/`), > realizing the v0.6 D11 mount spine; the MVP **forbids credentials in MCP -> configs** (SEA-1576 tracks the post-MVP credentialed path); env-vars are -> delivered **exclusively** via SEA-1327's +> configs** (RIG-1576 tracks the post-MVP credentialed path); env-vars are +> delivered **exclusively** via RIG-1327's > SecretMaterializer/`FetchSecrets` surface — this record builds no second > env channel. > - **CD-4** — The MVP update path is re-materialize + **in-place agent > Reload** (the exec-driven model), reserving the throwaway-container > restart for image changes; live structured injection into the running -> agent (the parked `ConfigControl`, SEA-1310) is the named future seam, +> agent (the parked `ConfigControl`, RIG-1310) is the named future seam, > referenced and left unbuilt. ## Problem / Intent @@ -46,7 +46,7 @@ declaration, carriage over the frozen Server↔Runner inversion, per-type injection into the container, and the update path. Per-agent differentiation is deliberately out of the MVP; post-MVP, config keys on a persona / agent-level role, never an individual agent id. Env-vars reuse -SEA-1327's secret surface; the new machinery here covers only the bulk +RIG-1327's secret surface; the new machinery here covers only the bulk config content (skills / extensions / MCP-server configs) that surface does not carry. @@ -93,7 +93,7 @@ Every task below inherits these; they are constraints, not choices. (`proto/compass/v1/runner.proto:5-11`). Every `.proto` delta in this record is a **held-for-review contract delta** landing in its implementation PR after `compass.v1`-owner review — the same "named here, - not written" posture SEA-1327 T4 set + not written" posture RIG-1327 T4 set (`compass-agent-container-runtime.md:742-747`). 3. **The container is immutable after create; the agent is exec-driven.** `createAndStart` sets `Command: []string{"sleep", "infinity"}` — "Keep the @@ -109,7 +109,7 @@ Every task below inherits these; they are constraints, not choices. new version dir + a symlink flip) without touching the create-time mount set. A pinned `/`-dir mount was rejected: a bind mount cannot see a later symlink flip. -4. **Env-vars ride SEA-1327's surface — no second env channel.** The frozen +4. **Env-vars ride RIG-1327's surface — no second env channel.** The frozen record `compass-agent-container-runtime.md` designs env/secret delivery end to end: `FetchSecrets` on RunnerService (its T4, `:750-754`), the `SecretMaterializer` with the file-vs-env `DeliveryKind` split and the @@ -125,7 +125,7 @@ Every task below inherits these; they are constraints, not choices. on-disk contract the compass-agent (`packages/compass-agent`) reads — paths and formats — but builds no reader. The live-config control shell exists and is parked: "`ConfigControl` carries a tool set … - payload fields parked (SEA-1310)" + payload fields parked (RIG-1310)" (`proto/compass/v1/agent.proto:148-155`, `message ConfigControl {}`). Referenced, not built. 6. **Go stack conventions.** All Runner/Server work is Go under @@ -142,7 +142,7 @@ Every task below inherits these; they are constraints, not choices. bind mount (`go/internal/runtime/podman.go:62-66`, `type Mount struct { HostPath, ContainerPath string; ReadOnly bool }`). MCP-server configs are **credential-free by MVP rule** (CD-3), so nothing - in the config bundle is secret-bearing; secret values ride SEA-1327's + in the config bundle is secret-bearing; secret values ride RIG-1327's surface, which already takes this posture. 8. **Fleet-config writes are operator-scoped.** Setting the fleet's config is an operator/admin action, not a per-tenant one: `PutAgentConfig` / @@ -159,7 +159,7 @@ Every task below inherits these; they are constraints, not choices. ## Approach -The seam mirrors, deliberately, the shape SEA-1327 already froze for secrets +The seam mirrors, deliberately, the shape RIG-1327 already froze for secrets — its Decision 3: "Distribution + rotation ride the v0.6 config spine (Runner fetches; `Sessions` stream signals; stdin-`exec` injection; the file-vs-env delivery split)" (`compass-agent-container-runtime.md:31-36`) — because @@ -168,7 +168,7 @@ spine that secrets ride ("the Runner pulls a hosted agent's config bundle over its existing gRPC connection and materializes it as a **Runner-local read-only bind mount** into the container", `compass-0.6/design.md:871-873`). One spine, two payload classes: secrets -(SEA-1327, built/landing) and config bundles (this record). +(RIG-1327, built/landing) and config bundles (this record). ### Decision CD-1 — declaration surface: a Server-side fleet-wide bundle store @@ -240,7 +240,7 @@ aggregate 0600 env file each wrapped exec reads at spawn)" (`go/internal/store/secrets.go:20-22`). Non-secret env values ride the same rows (a plain value in the secret store is safe; a secret in a config bundle would not be), keeping exactly one env channel and one rotation -semantics (SEA-1327 T6). +semantics (RIG-1327 T6). ### Decision CD-2 — carriage: streaming Runner-fetch over the frozen inversion @@ -259,11 +259,11 @@ the frozen dial-out shape is untouched: unpack) remain the guards, independent of transport. Additive to the service exactly as `RelayCommsCall` was ("A fourth RPC, additive to the frozen dial-out shape (the Runner still initiates; the Server gains no - inbound route)", `runner.proto:82-83`) and as SEA-1327's `FetchSecrets` + inbound route)", `runner.proto:82-83`) and as RIG-1327's `FetchSecrets` will be (`compass-agent-container-runtime.md:750-754`). - A `ConfigVersion { version }` variant on the `SessionsResponse` command oneof (`runner.proto:132-141`) — signal only, never bundle bytes; - fleet-wide, so it carries no agent key. The sibling of SEA-1327's + fleet-wide, so it carries no agent key. The sibling of RIG-1327's `SecretsVersion` signal (`compass-agent-container-runtime.md:763-767`) and the concrete cut of the v0.6 line "the Server signals 'config version N for agent X' over the `Sessions` bidi stream" @@ -275,7 +275,7 @@ Runner-opened `Sessions` stream — "the Server's RESPONSE stream pushes session *commands* downward" (`proto/compass/v1/runner.proto:53-56`) — and the Runner then re-fetches. No new inbound Server→Runner RPC exists; the frozen dial-out -inversion is untouched. This is exactly what SEA-1327 T6 wires for +inversion is untouched. This is exactly what RIG-1327 T6 wires for `SecretsVersion` (`compass-agent-container-runtime.md:844-856`); env-var updates ride that same secrets path — this record adds no env mechanism. @@ -290,8 +290,8 @@ newer than what it materialized re-fetches (T4/T6). | --- | --- | --- | | Skills | Runner-local dir, **read-only bind mount** at `/run/compass/agent-config` | Bulk file trees; mount is zero-copy into the container and tamper-proof from inside (`ReadOnly` mounts exist today: `go/internal/runtime/podman.go:62-66`) | | Extensions | Same mount, `extensions/` subtree | Same shape as skills | -| MCP-server configs | Same mount, `mcp/` subtree — **credential-free by MVP rule**: an MCP config MUST NOT embed a credential; MCP servers read their tokens from the aggregate env file (a declared env secret), inheriting SEA-1327 rotation/deletion for free. The better post-MVP shape (`secret://` resolution with correct rotation) is tracked as SEA-1576 | Config bodies are non-secret and mount fine; a Runner-resolved credential copy would escape SEA-1327 T6's rotation/deletion — its removal scan covers only `$HOME/.compass/secrets/` and its regeneration set is {aggregate env file, provider seed, gh `hosts.yml`} (`compass-agent-container-runtime.md:868-887`) — so the MVP forbids it rather than forking rotation | -| Env-vars | **SEA-1327's surface, unchanged**: declared-env secrets land in the 0600 aggregate `$HOME/.compass/env`, consumed via `podman exec --env-file` never `-e` (`compass-agent-container-runtime.md:819-836`) | One env channel, one rotation path; this record adds nothing here | +| MCP-server configs | Same mount, `mcp/` subtree — **credential-free by MVP rule**: an MCP config MUST NOT embed a credential; MCP servers read their tokens from the aggregate env file (a declared env secret), inheriting RIG-1327 rotation/deletion for free. The better post-MVP shape (`secret://` resolution with correct rotation) is tracked as RIG-1576 | Config bodies are non-secret and mount fine; a Runner-resolved credential copy would escape RIG-1327 T6's rotation/deletion — its removal scan covers only `$HOME/.compass/secrets/` and its regeneration set is {aggregate env file, provider seed, gh `hosts.yml`} (`compass-agent-container-runtime.md:868-887`) — so the MVP forbids it rather than forking rotation | +| Env-vars | **RIG-1327's surface, unchanged**: declared-env secrets land in the 0600 aggregate `$HOME/.compass/env`, consumed via `podman exec --env-file` never `-e` (`compass-agent-container-runtime.md:819-836`) | One env channel, one rotation path; this record adds nothing here | Concretely the Runner unpacks the fetched bundle into a versioned dir `/config//`, relabels it into the container's SELinux @@ -337,12 +337,12 @@ re-fetchable and the host keeps only `current` (T4; the retention twin of CD-1's current-only server rule). **Env-vars are fleet-global for the MVP — settled, and consistent with the -fleet-wide reshape:** SEA-1327's reused surface is store-global inject-all +fleet-wide reshape:** RIG-1327's reused surface is store-global inject-all — "the MVP **injects the whole store into every agent**" (`compass-agent-container-runtime.md:29-30`), and `FetchSecrets` takes "no names filter, no grants" (`compass-agent-container-runtime.md:750-753`) — which matches this record's scope exactly: one fleet config, one fleet env, -every agent. Per-agent/persona env scoping rides SEA-1327's named +every agent. Per-agent/persona env scoping rides RIG-1327's named grants/filter seam post-MVP, not a second channel here. **The in-container contract (named, not built here):** the compass-agent @@ -380,7 +380,7 @@ path) — never for config reload. Named future seam, explicitly unbuilt: live structured injection into the running agent over its control stream — the parked `ConfigControl` shell -("`ConfigControl` carries a tool set … parked (SEA-1310)", +("`ConfigControl` carries a tool set … parked (RIG-1310)", `proto/compass/v1/agent.proto:148-155`) realizing v0.6's "injected as structured state into the running first-party agent … the SDK's `setTools`/`setSystemPrompt`/`setModel` surface" @@ -420,14 +420,14 @@ survives in this record. `ContainerSpec.Env` exists (`podman.go:85-86`) and setting it at `Create` would be easy — and wrong: env fixed at create cannot rotate, values ride -`-e KEY=VALUE` into host-visible podman argv (the exposure SEA-1327 T5 +`-e KEY=VALUE` into host-visible podman argv (the exposure RIG-1327 T5 eliminates, `compass-agent-container-runtime.md:828-833`), and it forks delivery from the already-landed `SecretDeliveryEnv` store split (`go/internal/store/secrets.go:20-22`). Rejected outright. ### Per-item declaration RPCs (DeclareSkill / DeclareMCPConfig) -Mirror SEA-1327's per-item `DeclareSecret` shape instead of an opaque +Mirror RIG-1327's per-item `DeclareSecret` shape instead of an opaque tarball: one RPC per skill / extension / MCP config. Weighed and rejected for MVP: skills and extensions are arbitrary file *trees* whose value is the verbatim-tree property — per-item RPCs would need their own tree @@ -492,7 +492,7 @@ fleet, current-only retention. substitutes; the same caps are re-enforced at every Runner unpack, T4); `mcp/*.json` must parse as JSON. Rejected with a wrapped `%w` field error before a row is written (the - T3-of-SEA-1327 validate-at-the-door posture, `store/secrets.go:42-48`). + T3-of-RIG-1327 validate-at-the-door posture, `store/secrets.go:42-48`). - Consumes: `internal/store` migration harness. Produces: the resolve surface T2/T3 serve from. @@ -509,7 +509,7 @@ Constraint 8): - `rpc GetAgentConfigInfo(GetAgentConfigInfoRequest) returns (GetAgentConfigInfoResponse)` — request `{}`; response `{ string version = 1; repeated string skills = 2; repeated string extensions = 3; repeated string mcp_servers = 4; }` - — names only, never content (mirrors SEA-1327 T7's value-free status + — names only, never content (mirrors RIG-1327 T7's value-free status view, `compass-agent-container-runtime.md:898-902`). - `rpc DeleteAgentConfig(DeleteAgentConfigRequest) returns (DeleteAgentConfigResponse)` — request `{}` — the explicit return-to-unconfigured path (chosen over @@ -533,7 +533,7 @@ Constraint 8): - CLI: `compass agent-config push ` (tars + gzips the dir client-side), `compass agent-config show`, and `compass agent-config delete` over the three RPCs — the same CLI lane - as SEA-1327's `compass secrets set/list/delete` + as RIG-1327's `compass secrets set/list/delete` (`compass-agent-container-runtime.md:931`). - Consumes: T1. Produces: the declaration surface operators drive. @@ -566,9 +566,9 @@ The internal carriage (Global Constraint 1 shape; precedent the oneof text; this record designs the variant shape): the `SessionsResponse.command` oneof today uses only tags 2..6 (`provision = 6`, `runner.proto:132-141`), so `9` is collision-free, and - it is sequenced with SEA-1327's not-yet-numbered `SecretsVersion` variant + it is sequenced with RIG-1327's not-yet-numbered `SecretsVersion` variant on the same oneof so the two additive deltas cannot collide. - Signal only, never bytes; sibling to SEA-1327's `SecretsVersion` + Signal only, never bytes; sibling to RIG-1327's `SecretsVersion` signal (`compass-agent-container-runtime.md:763-767`). Note: `ConfigVersion` is not `request_id`-correlated and has NO `SessionsRequest` result variant — it is a notification, not a @@ -681,9 +681,9 @@ reshaping `AgentSpec`: `current` version against the Server via the version-only fetch (`FetchAgentConfigRequest.if_version`, T3 — on match the stream ends after the version frame, no chunks) and re-materializes + Reloads on - mismatch. SEA-1327's `SecretsVersion` has the identical latent gap; the + mismatch. RIG-1327's `SecretsVersion` has the identical latent gap; the pattern settles jointly. - - FUTURE seam (named, unbuilt): once SEA-1310 populates `ConfigControl` + - FUTURE seam (named, unbuilt): once RIG-1310 populates `ConfigControl` (`proto/compass/v1/agent.proto:148-155`), the same `ConfigVersion` handling swaps the Reload for a live control frame; the parent mount + symlink flip make that a drop-in (the agent need only @@ -696,7 +696,7 @@ reshaping `AgentSpec`: the active version's `skills//…`, `extensions//…`, `mcp/.json` (credential-free — the MVP forbids embedded credentials, CD-3), `version`. -- `$HOME/.compass/env` (0600): SEA-1327's aggregate env file; consumed at +- `$HOME/.compass/env` (0600): RIG-1327's aggregate env file; consumed at exec spawn via `--env-file`, not read by the agent. An MCP server needing auth reads its token from env (a declared env secret), never from its mounted config. @@ -721,14 +721,14 @@ reshaping `AgentSpec`: read-only parent-dir mount - [ ] T6 — Update loop: `ConfigVersion` → coalesced re-materialize → in-place agent Reload; reconnect reconciliation via the version-only - fetch; live `ConfigControl` injection named as the SEA-1310 seam + fetch; live `ConfigControl` injection named as the RIG-1310 seam ## Open Questions The seven load-bearing questions this draft batched are all ruled (Matt, 2026-07-30) and folded into the body above as decisions: fleet-wide bundle scope (CD-1), streaming transfer (CD-2), credential-free MCP configs for -the MVP (CD-3; SEA-1576 tracks the post-MVP credentialed path), +the MVP (CD-3; RIG-1576 tracks the post-MVP credentialed path), fleet-global env (CD-3), canonical content-hash versioning (CD-1/T1), the parent-dir mount target (CD-3), and reconnect reconciliation (T6). Two non-load-bearing deferrals remain; the record may merge with their diff --git a/docs/designs/product/compass-agent-config-passthrough/design.md b/docs/designs/product/compass-agent-config-passthrough/design.md index fa832b601..5b241a3b6 100644 --- a/docs/designs/product/compass-agent-config-passthrough/design.md +++ b/docs/designs/product/compass-agent-config-passthrough/design.md @@ -25,8 +25,8 @@ Status: Draft > for the shipped mechanism. > > Freezes on merge; later changes supersede by citation, never rewrite -> (convention: `../compass-0.5/design.md:10-12`). Tracked as SEA-1678. Extends -> the frozen SEA-1568 record +> (convention: `../compass-0.5/design.md:10-12`). Tracked as RIG-1678. Extends +> the frozen RIG-1568 record > [`../compass-agent-config-delivery/design.md`](../compass-agent-config-delivery/design.md) > (CD-1..CD-4) — this record adds bundle **categories** to that machinery and > builds no new channel. @@ -80,7 +80,7 @@ Status: Draft ## Problem / Intent -SEA-1568/SEA-1674 landed the config-delivery seam, but the bundle carries only +RIG-1568/RIG-1674 landed the config-delivery seam, but the bundle carries only three categories — the in-container reader "maps it into the three `createAgentSession` option surfaces the SDK exposes — skills, extensions, and MCP servers" (`packages/compass-agent/src/config-reader.ts:7-8`) — so a @@ -121,7 +121,7 @@ and restated where this record's tasks touch them: ContainerPath: agentConfigMountPath, ReadOnly: true})`) and a later `current` flip is live inside the running container. No mount-set change. 4. **One env channel** (sibling GC-4). The settings file is not an env - surface; env-vars stay exclusively on SEA-1327's secret surface. Nothing + surface; env-vars stay exclusively on RIG-1327's secret surface. Nothing here writes `-e`/`Env`. 5. **Nothing secret-bearing enters the bundle** (sibling GC-7 + CD-3's credential-free rule, extended): the OMP settings schema marks credential @@ -334,7 +334,7 @@ rather than by native user/project layering (which object injection collapses). One boot-once limit, named: `contextFiles` is resolved once at session build (`sdk.ts:1471-1473`) and reused by later system-prompt rebuilds (`sdk.ts:2476`), so this covers the boot cwd's repo — roaming -multi-repo pickup is SEA-1698 (filed, out of scope). +multi-repo pickup is RIG-1698 (filed, out of scope). **Persona overlap, reconciled.** `COMPASS_PERSONA` is a **system-prompt identity overlay** appended after the default prompt (`cli.ts:424-431`: @@ -369,9 +369,9 @@ HOME, empty unless we populate it), "project" = `.omp/` inside the checkout | --- | --- | --- | --- | --- | | Settings (`config.yml`, the "config.json" surface; bundle member yml-only per OQ-1) | overlay via the `configFiles` option (installed `@16.5.2` `config/settings.ts:269`), resolved as `settings ?? settingsManager ?? Settings.init` (`sdk.ts:1154-1156`); merge order `settings.ts:1376-1378` | No — SDK defaults | **Deliver (CP-1)** | The headline gap: compaction/context/model-roles/tool enablement all live here. Injected as a `Settings.loadIsolated` `settingsManager` (amended 2026-07-31) | | AGENTS.md (context files) | cwd walk-up `discovery/agents-md.ts:25-50` via `discoverContextFiles` (`sdk.ts:775-782`, project scope only); option short-circuit `sdk.ts:1177-1179` | No fleet channel (checkout's own loads) | **Deliver (CP-2)** | Fleet working conventions; injected as `contextFiles: [fleetGlobal, ...discoverContextFiles(cwd, agentDir)]` — COMPOSED, the agent re-runs project discovery itself (amended 2026-07-31) | -| Skills | `discovery/builtin.ts:276-289` (`.omp/skills`, `agentDir/skills`) | **Yes** — mount + `skills:` option (`config-reader.ts:75`, `cli.ts:417`) | Already delivered | SEA-1568/1674 | -| Extensions | `discovery/builtin.ts:473`, `:565` (`extensions/` per config dir) | **Yes** — `additionalExtensionPaths` + `disableExtensionDiscovery` (`cli.ts:418-419`) | Already delivered | SEA-1568/1674 | -| MCP servers (`mcp.json`/`.mcp.json`) | `discovery/builtin.ts:197-200` | **Yes** — mounted `mcp/*.json` + `enableMCP: false` (`cli.ts:420-421`) | Already delivered | SEA-1568/1674 | +| Skills | `discovery/builtin.ts:276-289` (`.omp/skills`, `agentDir/skills`) | **Yes** — mount + `skills:` option (`config-reader.ts:75`, `cli.ts:417`) | Already delivered | RIG-1568/1674 | +| Extensions | `discovery/builtin.ts:473`, `:565` (`extensions/` per config dir) | **Yes** — `additionalExtensionPaths` + `disableExtensionDiscovery` (`cli.ts:418-419`) | Already delivered | RIG-1568/1674 | +| MCP servers (`mcp.json`/`.mcp.json`) | `discovery/builtin.ts:197-200` | **Yes** — mounted `mcp/*.json` + `enableMCP: false` (`cli.ts:420-421`) | Already delivered | RIG-1568/1674 | | Slash commands (`commands/*.md`) | `discovery/builtin.ts:334-335`; `extensibility/custom-commands/loader.ts:106` | No | **Defer** | Interactive slash surface; the headless socket-driven agent takes no slash input | | Rules (`rules/*.md`,`*.mdc`) | option short-circuit: "`options.rules !== undefined ? { items: options.rules, warnings: undefined } : await loadCapability(ruleCapability.id, { cwd })`" (installed `@16.5.2` `sdk.ts:1434-1436`) | No | **Deliver (CP-4)** | The wave ships 18 rule files and the fleet AGENTS.md (CP-2) references them by `rule://` name — delivering AGENTS.md without rules/ ships dangling references. The fleet `Rule[]` (built from the mounted `rules/*.md` + `*.mdc` with `createSourceMeta` + `buildRuleFromMarkdown`) **composes** with the checkout's discovered rules: the entrypoint re-runs `loadCapability(ruleCapability.id, { cwd })` itself and passes `[...fleetRules, ...discovered]`, fleet-first (amended 2026-07-31) | | Prompts (`prompts/*.md`) | `discovery/builtin.ts:424-425` | No | **Defer** | TUI prompt-picker surface | @@ -387,11 +387,11 @@ HOME, empty unless we populate it), "project" = `.omp/` inside the checkout | `plugin-overrides.json` | `extensibility/plugins/loader.ts:61` (`getConfigDirPaths("plugin-overrides.json", { user: false })` — project-only) | No | **Defer** | Project-level only by loader contract; repo-controlled already | | LSP config | `lsp/config.ts:371-383` (filenames per config dir) | No | **Defer** | Devenv concern; DL-025 makes the image/agent own its devenv | | DAP config | `dap/config.ts:134-144` | No | **Defer** | Same as LSP | -| `.env` (SDK dotenv autoload) | eager **import-time** load of `$HOME/.env`, configRoot/.env, agentDir/.env, and **cwd/.env** (`env.ts:196-213`), with `OMP_*`→`PI_*` mirroring (`env.ts:169-173`) | **Yes** — the checkout's own `.env` autoloads (cwd is the checkout, `agent_exec.go:76-78`, `cli.ts:337`) | **Defer / never** | Env rides SEA-1327 / GC-4, never the bundle. (Historical: the frozen record's T4 cleared `PI_CONFIG_FILES`/`OMP_CONFIG_FILES` against a repo-`.env` injection vector; the installed 16.5.2 runtime never reads that env var and settings now ride the `settingsManager` object, so that vector does not exist — amended 2026-07-31) | +| `.env` (SDK dotenv autoload) | eager **import-time** load of `$HOME/.env`, configRoot/.env, agentDir/.env, and **cwd/.env** (`env.ts:196-213`), with `OMP_*`→`PI_*` mirroring (`env.ts:169-173`) | **Yes** — the checkout's own `.env` autoloads (cwd is the checkout, `agent_exec.go:76-78`, `cli.ts:337`) | **Defer / never** | Env rides RIG-1327 / GC-4, never the bundle. (Historical: the frozen record's T4 cleared `PI_CONFIG_FILES`/`OMP_CONFIG_FILES` against a repo-`.env` injection vector; the installed 16.5.2 runtime never reads that env var and settings now ride the `settingsManager` object, so that vector does not exist — amended 2026-07-31) | | `SYSTEM.md` (system-prompt customization) | `createAgentSession` → `buildSystemPromptInternal` (`sdk.ts:2720`) → `loadSystemPromptFiles` (`system-prompt.ts:391-399`) whenever no `customSystemPrompt` is passed (gate `callerControlsCustomPrompt`, `system-prompt.ts:653-658`); the builtin provider reads BOTH `getAgentDir()/SYSTEM.md` and the nearest project config dir's `SYSTEM.md` (`builtin.ts:235-259`); result feeds the prompt as `systemPromptCustomization` (`system-prompt.ts:822-838`) | **Yes (project level)** — the checkout's `.omp/SYSTEM.md` loads today: the compass entrypoint passes only `systemPrompt` (a post-processing fn, `cli.ts:424-431`), so the gate is open | **Defer** | An **ACTIVE in-container surface**, not TUI-only: user level would activate the moment a fleet file landed at `$HOME/.omp/agent/SYSTEM.md`. The checkout-controlled project SYSTEM.md is pre-existing behavior outside this record's delta | | `APPEND_SYSTEM.md` | `main.ts:817-825` (`findConfigFile`, consumed at `main.ts:864-866`) | N/A in-container | **Out of scope (structurally)** | Loaded by the **TUI/CLI entry** (`main.ts`) only — genuinely not on the `createAgentSession` path | | `TITLE_SYSTEM.md` | `system-prompt.ts:302-310`, consumed `main.ts:384` and `interactive-mode.ts:1149` | N/A in-container | **Out of scope (structurally)** | Same TUI-only path | -| Model auth / provider credentials | `sdk.ts:1201` (`discoverAuthStorage(agentDir)`); seed override `cli.ts:440` (`session.agent.getApiKey = createSeedApiKeyResolver(home)`) | **Yes** — SEA-1327 auth seed | Out of scope | Credentials never ride the bundle (GC-5) | +| Model auth / provider credentials | `sdk.ts:1201` (`discoverAuthStorage(agentDir)`); seed override `cli.ts:440` (`session.agent.getApiKey = createSeedApiKeyResolver(home)`) | **Yes** — RIG-1327 auth seed | Out of scope | Credentials never ride the bundle (GC-5) | The prevention property, restated: every config read above is anchored on `getAgentDir()` or the project config dir — but through **three resolvers**, diff --git a/docs/designs/product/compass-agent-container-runtime.md b/docs/designs/product/compass-agent-container-runtime.md index 2caa7b47e..bed8d0fcf 100644 --- a/docs/designs/product/compass-agent-container-runtime.md +++ b/docs/designs/product/compass-agent-container-runtime.md @@ -14,7 +14,7 @@ is against the working tree at `6b192e731` (branch `git ls-tree -r origin/main --name-only | grep -c compass-daemon` → `0`) and is never cited as live below. -> **Re-authored (SEA-1327 reopen).** A prior version of this record built a +> **Re-authored (RIG-1327 reopen).** A prior version of this record built a > cred-avoidance sandbox around Nix evaluation (host-store overlay, a dedicated > eval uid, capture-env-once, eval-phase egress narrowing). Matt's directives > invert that premise — see *Threat model* below — so Decisions 1–3 are @@ -357,7 +357,7 @@ model-scoped credential routing" (`pi-agent-core` `agent.d.ts:66-70`). So: agent restart, no env involvement. Provider creds never appear in `secretspec`-style env/file delivery, in exec env maps, or in argv. -This re-expresses SEA-1115's Rust-era `ProviderCredentials` intent +This re-expresses RIG-1115's Rust-era `ProviderCredentials` intent (`docs/designs/agents/sea-1115-agent-provisioning-cotal.md:113`, `:151`) on the Go stack, with the SDK auth surface replacing the harness-supplied env-var/file fork — the first-party agent has a first-party credential API, diff --git a/docs/designs/product/compass-agent-forge-tools/design.md b/docs/designs/product/compass-agent-forge-tools/design.md index 606442a29..487cdcc0d 100644 --- a/docs/designs/product/compass-agent-forge-tools/design.md +++ b/docs/designs/product/compass-agent-forge-tools/design.md @@ -390,7 +390,7 @@ Every task below inherits these; they are not repeated per task. - **No new wire surface.** This record adds no proto, no gen, no RPC. The `Forge` RPC, its envelopes, and the TS gen exist; `buf` tasks and the - SEA-1267 gen-fence are untouched (the fence already covers the `ForgeCall*` + RIG-1267 gen-fence are untouched (the fence already covers the `ForgeCall*` family and `AgentGateway` — `proto/moon.yml` `gen-fence` script — and no public tree is regenerated here). - **Egress seal preserved.** The forge call rides the existing per-container diff --git a/docs/designs/product/compass-agent-org-mgmt-tools/design.md b/docs/designs/product/compass-agent-org-mgmt-tools/design.md index 3a05ccbb2..ee015b961 100644 --- a/docs/designs/product/compass-agent-org-mgmt-tools/design.md +++ b/docs/designs/product/compass-agent-org-mgmt-tools/design.md @@ -51,7 +51,7 @@ Each new arm therefore needs only the thin `…AsAccount` adapter following the > > `go/server/lifecycle.go:345-357` (`provisionAndStart`): signature already carries `persona string, role string` and threads them to `ProvisionAgentWorkspaceRequest{ … Persona: persona, Role: role }`. > -> `go/internal/store/inputs.go:27-32`: "Role is the agent's operator-set block-0 selector (SEA-1732 T10). Empty means no role (default OMP block-0) … Unlike Persona (an append overlay), the label selects `config/prompts//SYSTEM.md`, delivered as the container's customSystemPrompt." +> `go/internal/store/inputs.go:27-32`: "Role is the agent's operator-set block-0 selector (RIG-1732 T10). Empty means no role (default OMP block-0) … Unlike Persona (an append overlay), the label selects `config/prompts//SYSTEM.md`, delivered as the container's customSystemPrompt." So the change is: add optional `role` + `persona` fields to `SpawnPeerRequest`, and in `SpawnAsAccount` replace the two hardcoded `""` with `req.GetRole()` / `req.GetPersona()`. compass-agent's existing `agents_spawn_peer` tool gains `role` and `persona` args — no new tool, no new arm, no new relay path. diff --git a/docs/designs/product/compass-agent-primary-lifecycle/design.md b/docs/designs/product/compass-agent-primary-lifecycle/design.md index 6c91251f2..ad7218e25 100644 --- a/docs/designs/product/compass-agent-primary-lifecycle/design.md +++ b/docs/designs/product/compass-agent-primary-lifecycle/design.md @@ -16,7 +16,7 @@ Tracker: SEA > the superseded *RPC* has shipped: grep of > `compass/proto/compass/v1/*.proto` this run finds no `UpdateIssueState` > RPC (verified absent). The `Issue`/`IssueState` READ types DID ship in -> SEA-1727 S1a (PR #145, `compass.proto:595` `enum IssueState`, +> RIG-1727 S1a (PR #145, `compass.proto:595` `enum IssueState`, > `compass.proto:645` `message Issue`) and survive unchanged — only the > `CompassService` write RPC was frozen on paper and is dropped before build. @@ -207,7 +207,7 @@ rather than re-homed, including the `seam.updateIssueStatus` mirror call inside promote (`store.ts:1859`). The board renders lifecycle from the frozen read path: the canonical `Issue` rides "`SubscribeEventsResponse` as a new oneof variant … `Issue issue = 16;` // the canonical board unit, pushed on -every change" (`compass-issue-model/design.md:284-297`), shipping in SEA-1727 +every change" (`compass-issue-model/design.md:284-297`), shipping in RIG-1727 S1a (PR #145). The `UpdateIssueState` RPC is **dropped from the contract before it is ever built** — grep of `compass/proto/compass/v1/` this run finds no `UpdateIssueState` RPC, so there is no wire build, no migration, and @@ -242,7 +242,7 @@ population: - The `Issue`/`PullRequest` canonical type family, the `IssueState` enum, and the `SubscribeEventsResponse.issue` READ path (DL-067, DL-069, - SEA-1727 S1a / PR #145) — untouched. + RIG-1727 S1a / PR #145) — untouched. - DL-033's seven working states + DL-091's terminal `ARCHIVED` as the state MODEL (`DECISIONS.md:145`, `:153`) — untouched; only the write surface moves. @@ -265,7 +265,7 @@ population: also create a conflict surface between two user intents; the ruling gives the user ONE write surface (the tracker) and the agents another, with the projection serializing both. -3. **Fold the agent op into the SEA-1731 `ForgeCall*` family vs a sibling +3. **Fold the agent op into the RIG-1731 `ForgeCall*` family vs a sibling family.** Weighed both: - *Fold into `ForgeCall`*: cheapest wire delta — one new oneof variant on `ForgeCallRequest`/`ForgeCallResult`, no new RPCs, the gen-fence @@ -310,7 +310,7 @@ population: `compass-agent-spawn-despawn/design.md:132-135`). The relay IS the agent-facing RPC edge; no task may add a public agent-callable state RPC. - **The read path is frozen.** `Issue`/`PullRequest`/`IssueState` and - `SubscribeEventsResponse.issue = 16` (SEA-1727 S1a, PR #145) are consumed + `SubscribeEventsResponse.issue = 16` (RIG-1727 S1a, PR #145) are consumed as-is; no task edits them. - **Additive proto only.** New RPCs, messages, and oneof variants at fresh tags behind the buf breaking gate; `UpdateIssueState` is never authored @@ -319,7 +319,7 @@ population: proto writer (coordinated, not read off the live proto — `compass-agent-spawn-despawn/design.md:447-448`). - **Gen-fence discipline.** `BoardCall*`/`RelayBoardCall*`/`SetIssueState*` - are internal-only symbols: extend the SEA-1267 gen-fence grep + are internal-only symbols: extend the RIG-1267 gen-fence grep (`proto/moon.yml:158`) with the unanchored `BoardCall|RelayBoardCall|SetIssueState` family, matching the `LifecycleCall|SpawnPeer|DespawnPeer|RelayLifecycleCall` entries already @@ -581,12 +581,12 @@ decisions the record is now designed against. tool and it isn't tracked by Compass already, Compass goes and fetches it, tracks it into the store, and then returns that." This is a **store-first read-through** model. The frozen `compass-server-ownership-layer` record - (SEA-1728) specified the opposite for forge reads — a **stateless + (RIG-1728) specified the opposite for forge reads — a **stateless pass-through relay**: "nothing is stored, nothing is resolved, and no coordinate can drift" (`compass-server-ownership-layer/design.md:352-354`). This does not change THIS amendment's issue-state WRITE path (the BoardCall - family + projection are unaffected), but it reshapes SEA-1731 (A1 - forge-carrier proto) and the SEA-1728 forge read path. **Impact:** the A1 + family + projection are unaffected), but it reshapes RIG-1731 (A1 + forge-carrier proto) and the RIG-1728 forge read path. **Impact:** the A1 proto's `ForgeCall*` read arms may need to become store-reads with a fetch-on-miss, and the naming/shape may change. Parked here because it is Matt's ruling to make on the frozen forge contract; A1 authoring holds on diff --git a/docs/designs/product/compass-agent-runner-transport/design.md b/docs/designs/product/compass-agent-runner-transport/design.md index ffcd20a73..3a64dd2e9 100644 --- a/docs/designs/product/compass-agent-runner-transport/design.md +++ b/docs/designs/product/compass-agent-runner-transport/design.md @@ -4,7 +4,7 @@ Status: Active > Freezes on merge; later changes supersede by citation, never rewrite > (`../compass-0.5/design.md:10-12`, convention restated in -> `../compass-0.6/design.md:1116-1118`). Tracked as SEA-1351. +> `../compass-0.6/design.md:1116-1118`). Tracked as RIG-1351. ## Problem / Intent @@ -210,7 +210,7 @@ path (OQ-3). - **Egress seal preserved.** The transport is a local Unix socket with no network path; it neither relies on nor perturbs the nft posture (`../compass-agent-container-runtime.md:206-217`). -- **SEA-1267 gen-fence: internal protos only + extend the symbol list.** The +- **RIG-1267 gen-fence: internal protos only + extend the symbol list.** The `AgentGateway` service and its messages are INTERNAL — new declarations in the owned `compass.v1` package, generated ONLY into the internal lanes (`go/internal/gen` via `buf.gen.internal-go.yaml`; `compass-agent/src/gen` via @@ -590,4 +590,4 @@ here. it into a request/response transport buys nothing. Non-load-bearing; recorded so the boundary is deliberate, not accidental. -*SEA-1351.* +*RIG-1351.* diff --git a/docs/designs/product/compass-agent-session-persistence/design.md b/docs/designs/product/compass-agent-session-persistence/design.md index 561561b0d..eb0877727 100644 --- a/docs/designs/product/compass-agent-session-persistence/design.md +++ b/docs/designs/product/compass-agent-session-persistence/design.md @@ -3,7 +3,7 @@ Status: Active > Freezes on merge; later changes supersede by citation, never rewrite. -> Implements Linear SEA-1570 (pre-dogfood item 4) against TWO fixed rulings: +> Implements Linear RIG-1570 (pre-dogfood item 4) against TWO fixed rulings: > Matt's storage-ownership ruling of 2026-07-31 (storage is SERVER-OWNED — the > agent emits its transcript over the existing durable frame channel and holds > zero S3 credentials), and Matt's collapse rulings of 2026-07-31, which @@ -15,11 +15,11 @@ Status: Active > the new container at provision, loaded by the agent through the SDK's own > native loader; a definitively-erred emit escalates and FAILS the session at > a bounded cap. The `TranscriptReplay` payload, the control-lane replay -> driver, the replay barrier, the replay admission bound, and the SEA-1310 +> driver, the replay barrier, the replay admission bound, and the RIG-1310 > co-ratification are all DEAD (inventoried in the second appendix; ledger -> DL-086 → DL-087). SEA-1310 no longer blocks anything here. The post-MVP +> DL-086 → DL-087). RIG-1310 no longer blocks anything here. The post-MVP > unification of the two wire streams into one token stream carrying log -> metadata is filed as SEA-1580, out of scope for this record. +> metadata is filed as RIG-1580, out of scope for this record. ## Problem / Intent @@ -34,7 +34,7 @@ to reclaim (`go/internal/runner/host.go:166-168`: "A crash instead leaves the socket files on disk, which the next Provision reclaims"), and the in-container transcript has no such reclaim path — it is simply gone with the container's writable layer. A crashed, reloaded-elsewhere, or re-provisioned agent loses -its whole conversation. SEA-1570 (pre-dogfood item 4) requires the session log +its whole conversation. RIG-1570 (pre-dogfood item 4) requires the session log to survive the container and a session to be resumable in a NEW container with its context intact. Durability is server-owned: the agent TEES each committed transcript entry upstream over the existing durable agent→Runner→Server frame @@ -65,7 +65,7 @@ native session loader, with no agent-side replay code at all. server-reconstructed JSONL body the Runner materializes into the new container's session dir at provision, loaded SDK-native by the agent — which kills the control-lane replay driver, the `TranscriptReplay` - payload, the replay barrier, the replay admission bound, and the SEA-1310 + payload, the replay barrier, the replay admission bound, and the RIG-1310 co-ratification in one stroke. R4: a definitively-erred emit buffers and retries under a bounded cap with escalating warn→error logs, and FAILS THE SESSION loudly at cap exhaustion. @@ -93,7 +93,7 @@ session entries; the SERVER persists them (it owns durable storage) AND projects the same entries to clients as the block-level trace. The lossy per-token stream survives only as a liveness layer (next section). The post-MVP follow-up that collapses the two wire streams into ONE token-by-token -stream carrying log metadata is filed as **SEA-1580** — referenced here, not +stream carrying log metadata is filed as **RIG-1580** — referenced here, not designed here. ### Liveness: two agent→server streams for MVP (R2) @@ -125,7 +125,7 @@ live leg is throwaway. The durable log stream rides infrastructure that is already on main; grounding is split by surface — proto + generated bindings at compass -origin/main `153a2a4` (SEA-1569 merged), hand-written Go/TS unchanged between +origin/main `153a2a4` (RIG-1569 merged), hand-written Go/TS unchanged between `335bb06` and `153a2a4`: - **Frame producer (agent).** `packages/compass-agent/src/transport/frame-sink.ts` @@ -143,7 +143,7 @@ origin/main `153a2a4` (SEA-1569 merged), hand-written Go/TS unchanged between `conversation_posted = 1`, `conversation_updated = 2`, `session = 3`, `replay_complete_ack = 4`, `control_ack = 5`, `delivery_ack = 6` (`agent.proto@153a2a4:40-75`). Additions to the oneof are additive and - buf-breaking-safe — the ack variants and SEA-1569's `delivery_ack` were + buf-breaking-safe — the ack variants and RIG-1569's `delivery_ack` were added exactly this way ("Additive to the frozen oneof; buf-breaking-safe", `agent_pb.ts@153a2a4:425-428`). - **Relay.** The Runner is a pure verbatim forwarder on both lanes. Durable: @@ -348,11 +348,11 @@ Properties the tee carries: ### The wire shape: TranscriptEntry -One additive oneof variant; SEA-1569 is the live precedent ("Additive to the +One additive oneof variant; RIG-1569 is the live precedent ("Additive to the frozen oneof; buf-breaking-safe", `agent_pb.ts@153a2a4:425-428`). No control- lane payload is added: the `TranscriptReplay` shell at `agent.proto@153a2a4:160` stays EMPTY — nothing in this record fills, consumes, or depends on it, and -the SEA-1310 co-ratification is retracted (peer-contract relief; see the +the RIG-1310 co-ratification is retracted (peer-contract relief; see the Open Questions dispositions). - **`TranscriptEntry transcript_entry = 7`** on the `AgentFrame` oneof (tags @@ -394,7 +394,7 @@ append throws it (`session-manager.ts:674`). not its eventual backend evolution. - **The post-MVP analytics/index layer + retention GC.** The opt-in analytics/index layer built OFF the archive (Loki/ES/ClickHouse-style, - rebuildable, never in the resume path — a new SEA-1580-adjacent follow-up) + rebuildable, never in the resume path — a new RIG-1580-adjacent follow-up) and the retention GC that reclaims ended-session PG hot-tails are both named seams, not built here. - **The socket/control transport.** Frozen by the consolidation record; @@ -403,7 +403,7 @@ append throws it (`session-manager.ts:674`). - **Runner-side shipping.** No step ships logs after teardown; the Runner remains a pure verbatim forwarder on both relay lanes (materializing a file at provision is provisioning, not relaying). -- **The single-stream unification (SEA-1580).** Collapsing the durable +- **The single-stream unification (RIG-1580).** Collapsing the durable settled-entry stream and the live per-token stream into ONE token stream carrying log metadata is the filed post-MVP follow-up; MVP ships the two streams above. @@ -427,7 +427,7 @@ the first appendix; the flipped ledger rows are DL-063/064/065/066/082/083. ### Control-lane replay resume — SUPERSEDED by the collapse (2026-07-31) The interim revision of THIS record designed resume as a server-driven replay -down the SEA-1569 control lane: the Server pushed each stored entry as a +down the RIG-1569 control lane: the Server pushed each stored entry as a `TranscriptReplay` op via `DispatchControl`, the agent applied it through `appendMessage`, a Runner replay barrier (`HoldForReplay`, gaining its first production caller) held live input until `ReplayCompleteAck`, and a replay @@ -553,11 +553,11 @@ the whole history and the archive tier is deferred. server-side, behind the transcript store) — this is the concrete form of "the Server can swap storage backends without touching the agent". - **Matt's collapse rulings (2026-07-31) are fixed inputs**: one canonical - artifact (the session log; the trace is a projection — SEA-1580 unifies + artifact (the session log; the trace is a projection — RIG-1580 unifies the wire streams post-MVP); two agent→server streams for MVP (durable settled-entry + ephemeral per-token); resume is a Runner-materialized file loaded SDK-native — no task may add agent-side replay consumption, a - replay barrier caller, a `TranscriptReplay` payload, or any SEA-1310 + replay barrier caller, a `TranscriptReplay` payload, or any RIG-1310 dependency. - **The durable emit lane's guarantees are the load-bearing invariant**: transcript frames ride the delivered-or-erred PostConversationFrame → @@ -581,7 +581,7 @@ the whole history and the archive tier is deferred. Silent give-up (`frame-sink.ts:109-115`) is telemetry-only behavior and MUST NOT apply to the transcript lane. - **Proto grounding is split by surface**: proto + generated bindings are - grounded at compass origin/main `153a2a4` (SEA-1569 merged: `delivery_ack + grounded at compass origin/main `153a2a4` (RIG-1569 merged: `delivery_ack = 6` taken); hand-written Go/TS (`control.go`, `hub.go`, `handler.go`, `relay_comms.go`, `agent.ts`, `frame-sink.ts`, `cli.ts`) is unchanged between `335bb06` and `153a2a4` and cited at those files' current state. @@ -592,11 +592,11 @@ the whole history and the archive tier is deferred. `session-loader.ts:202-228`, `#rewriteAtomically` at `session-manager.ts:621-635`, `appendCompaction` elision at `:1544-1545`). - **Proto changes are additive-only** (proto3 additions; buf-breaking-safe — - SEA-1569 is the live precedent for an added oneof variant): + RIG-1569 is the live precedent for an added oneof variant): `TranscriptEntry transcript_entry = 7` on the `AgentFrame` oneof (next free tag at `153a2a4`; re-confirm at authoring) and `resume_session_id` on the public `StartAgentSessionRequest`. The `TranscriptReplay` shell stays - EMPTY — this record adds no control-lane payload and carries no SEA-1310 + EMPTY — this record adds no control-lane payload and carries no RIG-1310 dependency. - **The checkpoint discriminator is mandatory on the emit path**: every `writeFull`-originated frame carries `checkpoint = true`; server-side @@ -623,18 +623,18 @@ the whole history and the archive tier is deferred. Ordered by dependency; owners in brackets. T1 is the shared proto surface (compass owns the repo's proto single-writer lane), T2–T3 compass-agent, T4–T6 compass-server, T7–T8 compass-runner, T9 the end-to-end smoke. No task -gates on any cross-owner ratification: SEA-1310 is off the critical path. +gates on any cross-owner ratification: RIG-1310 is off the critical path. ### T1 [compass] — additive proto: `TranscriptEntry` frame + `resume_session_id` Two additive changes, both buf-breaking-safe (proto3 field/variant -additions — the live precedent is SEA-1569, which added `delivery_ack = 6` to +additions — the live precedent is RIG-1569, which added `delivery_ack = 6` to the same oneof, `agent_pb.ts@153a2a4:425-428`): ```proto // proto/compass/v1/agent.proto — AgentFrame oneof, additive. Tags 1-6 are // taken at origin/main 153a2a4 (conversation_posted=1, conversation_updated=2, -// session=3, replay_complete_ack=4, control_ack=5, delivery_ack=6 — SEA-1569), +// session=3, replay_complete_ack=4, control_ack=5, delivery_ack=6 — RIG-1569), // so the next free tag is 7. Re-confirm at authoring time; the exact tag is // not load-bearing. message AgentFrame { @@ -696,7 +696,7 @@ message ResumeBody { // The reconstructed post-supersession session-JSONL body (T5) — string, // consistent with TranscriptEntry.entry_json above. string session_body = 1; - // Inline-image blob bytes are OUT of MVP scope (SEA-1582): no grounded + // Inline-image blob bytes are OUT of MVP scope (RIG-1582): no grounded // agent-side capture seam exists, so the carrier holds only the JSONL body. } @@ -1173,7 +1173,7 @@ latency/consistency never gates a container restart: resume path that touches the object store, and it does not fire in normal operation — normal sessions have no `safety_valve` segments, so resume stays PG-only. -- Inline-image blobs are out of MVP scope (SEA-1582): the reconstructed body +- Inline-image blobs are out of MVP scope (RIG-1582): the reconstructed body carries only the session-JSONL. On load the SDK still runs `resolveBlobRefsInEntries` / `resolveImageData` (`session-loader.ts:265-269`; `blob-store.ts:256-266`); with no blob dir a missing ref logs a warning and @@ -1183,7 +1183,7 @@ latency/consistency never gates a container restart: Interfaces: ```go -// go/internal/runnerhub (beside the SEA-1569 dispatch path) +// go/internal/runnerhub (beside the RIG-1569 dispatch path) // ReconstructSessionBody assembles the post-supersession session-JSONL body // for sessionID: the latest checkpoint's full body verbatim FIRST, then every @@ -1341,14 +1341,14 @@ mid-session compaction, the superseded entries are archived to an object-store segment AND an `agent_session_archive_segments` manifest row exists for it AND the PG hot-tail is pruned to `[checkpoint..now]`; the resume that follows reads PG-only — the object store is asserted NOT read on the normal resume path. This -is the acceptance gate for SEA-1570. +is the acceptance gate for RIG-1570. Test cycle: this IS the test — an integration test in the e2e suite (`go/internal/runner/e2e_transport_test.go` conventions). ## Tasks -- [ ] T1 [compass] additive proto: `TranscriptEntry transcript_entry = 7` on the AgentFrame oneof (tags 1-6 taken at 153a2a4; re-confirm at authoring), `TranscriptEntry{entry_json, checkpoint, entry_seq}` with the per-lifetime-stamped / server-rebased entry_seq comment, `resume_session_id` public on `StartAgentSessionRequest`; internal `ResumeBody` (`string session_body`; inline-image blobs OUT of MVP scope, SEA-1582) as a TOP-LEVEL sibling field on the INTERNAL `SessionsResponse` envelope (outside the `command` oneof, NOT inside `start`) on a fresh internal tag (never the retired `ResumeContext=12` slot); `TranscriptReplay` shell untouched (buf gates; round-trip tests) +- [ ] T1 [compass] additive proto: `TranscriptEntry transcript_entry = 7` on the AgentFrame oneof (tags 1-6 taken at 153a2a4; re-confirm at authoring), `TranscriptEntry{entry_json, checkpoint, entry_seq}` with the per-lifetime-stamped / server-rebased entry_seq comment, `resume_session_id` public on `StartAgentSessionRequest`; internal `ResumeBody` (`string session_body`; inline-image blobs OUT of MVP scope, RIG-1582) as a TOP-LEVEL sibling field on the INTERNAL `SessionsResponse` envelope (outside the `command` oneof, NOT inside `start`) on a fresh internal tag (never the retired `ResumeContext=12` slot); `TranscriptReplay` shell untouched (buf gates; round-trip tests) - [ ] T2 [compass-agent] `TranscriptTeeBackend` + `createTeeSessionStorage` in `packages/compass-agent/src/session-tee.ts`: local-FS read/write + awaited tee emit (append→delta frame, writeFull→checkpoint frame), real loadIndex over the session dir, R4 erred-emit buffer/escalate/fail-session, `OutboundFrame` + durable sink lane for `transcriptEntry`, `COMPASS_RESUME_SESSION_FILE` → `setSessionFile` at the composition root, drain barrier beside the sink drain, `MainDeps.createSessionStorage` seam (unit + cli tests) - [ ] T3 [compass-agent] resume proof-smoke: reconstruct a captured tee run into a session-JSONL body, restart `main()` with `COMPASS_RESUME_SESSION_FILE`, assert SDK-native context load (`setSessionFile`/`loadEntriesFromFile`), no tee emission during load, fresh per-lifetime entry_seq after resume; compaction-elision round-trip - [ ] T4a [compass-server] PG hot-tail tier: `NNNN_agent_session_transcript_entries.sql` (next contiguous slot, ≥0006 given `0005_agent_persona.sql`, exact NNNN assigned at merge; PK (session_id, entry_seq) with SESSION-scoped entry_seq via write-once lifetime-bind rebase base, UNIQUE idempotency_key, checkpoint flag; FK `agent_sessions`, created in `0003_agent_ownership.sql`) holding `[latest checkpoint..now]` (pruned at flush) + `AppendTranscriptEntry`/`SessionTranscript` store funcs + persist-on-receipt case in `Hub.CommitConversationFrame` + checkpoint-supersession read view + trace projection source + `agent_session_archive_segments` manifest table + PG-only reconstruction (store + hub tests) @@ -1357,7 +1357,7 @@ Test cycle: this IS the test — an integration test in the e2e suite - [ ] T6 [compass-server] resume identity + authz: `resume_session_id` gated by `RequireAgentSessionSubscriber` before any Runner call; stable logical id keys the stored transcript across resumes; NO pointer row, NO locator on any message; reconstructed body rides the INTERNAL `SessionsResponse` sibling field only (outside the `start` command, handler tests) - [ ] T7 [compass-runner] widen the durable-lane guard: `isConversationFrame` admits `transcript_entry` (today rejected `CodeInvalidArgument`; pairs with T4's hub `commitFrame` case + T1's C4 proto-comment revision); agent-side S3 provisioning/egress/env GUTTED — never built (gateway red→green tests) - [ ] T8 [compass-runner] `agentHost.Start` resume orchestration: force-teardown primary fence; materialize the reconstructed JSONL into the new container's session dir at provision (exec-write, credential-install pattern); exec the agent with `COMPASS_RESUME_SESSION_FILE`; NO barrier (host tests) -- [ ] T9 [all] end-to-end resume smoke against live Runner + Server — the SEA-1570 acceptance gate +- [ ] T9 [all] end-to-end resume smoke against live Runner + Server — the RIG-1570 acceptance gate ## Open Questions — all ruled (Matt, 2026-07-31); dispositions recorded @@ -1377,16 +1377,16 @@ no-op) died with the replay resume model: R3's resume loads a FILE through the SDK's own loader, so the backend must serve real reads (see Alternatives for the rejected read-shim variant). Decided design point, not a fork. -### OQ-R2 — SEA-1310 sequencing → DISSOLVED (peer-contract relief) +### OQ-R2 — RIG-1310 sequencing → DISSOLVED (peer-contract relief) The fork existed only because resume WAS `TranscriptReplay`. Under R3 resume never touches the control lane, the `TranscriptReplay` shell stays empty -(`agent.proto@153a2a4:160`), and no payload needs co-ratification. SEA-1310 -no longer blocks SEA-1570 in either direction — an explicit RELIEF on the +(`agent.proto@153a2a4:160`), and no payload needs co-ratification. RIG-1310 +no longer blocks RIG-1570 in either direction — an explicit RELIEF on the peer contract; the co-ratification request is retracted (the driver is messaging compass to retract it). The former T9 is deleted. -### OQ-R3 — inline-image blobs → OUT of MVP resume scope (deferred to SEA-1582) +### OQ-R3 — inline-image blobs → OUT of MVP resume scope (deferred to RIG-1582) MVP resume persists the SDK session-JSONL transcript losslessly — all text, tool-call, and reasoning context. Inline-image blob BYTES are out of MVP @@ -1403,7 +1403,7 @@ not image bytes. On resume the SDK's own load-time resolution still runs `BlobStore` (`blob-store.ts:256-266`); with no blob dir materialized a missing ref logs `Blob not found for image reference` and is returned unchanged — the SDK warns and does NOT crash, only inline-image context degrades. Agent-side -blob capture is deferred to SEA-1582. +blob capture is deferred to RIG-1582. ### OQ-R4 — ordering/durability of the emit lane → RESOLVED (R4 + await-per-op + entry_seq) @@ -1469,13 +1469,13 @@ it is build scope. per-entry durable frame emit + the same terminal `drain()` barrier (the loss-bound discussion carried over to the emit lane and is now closed by the R4 erred-emit ruling). -- **SEA-1310 independence (OQ-3, DL-066)** — first INVERTED by the interim +- **RIG-1310 independence (OQ-3, DL-066)** — first INVERTED by the interim replay model (co-ratification), then DISSOLVED by the collapse: no `TranscriptReplay` dependency remains in either direction (see the second appendix). - **Blobs to an S3 sibling keyspace (OQ-4)** — superseded; settled as the OQ-R3 outcome: inline-image blobs are out of MVP resume scope, deferred to - SEA-1582. + RIG-1582. - **OQ-5 endpoint provenance / OQ-6 ranged readSlices / OQ-7 creds-via-env** — moot: no agent-side endpoint, no agent-side remote reads, no agent-side credentials. @@ -1529,10 +1529,10 @@ None of it is build scope. - **The replay admission bound (OQ-R5)** — dissolved with the admission path itself. The in-place warning about filling the shell (`control.go:549-555`) stays with the shell, not with this record. -- **The SEA-1310 co-ratification (OQ-R2, the former T9)** — retracted. +- **The RIG-1310 co-ratification (OQ-R2, the former T9)** — retracted. Resume no longer depends on any `AgentControl` payload, so the - cross-record co-ratification is dropped and SEA-1310 is unblocked from - SEA-1570 in both directions (peer-contract relief; DL-086 → DL-087). + cross-record co-ratification is dropped and RIG-1310 is unblocked from + RIG-1570 in both directions (peer-contract relief; DL-086 → DL-087). - **The agent-side emit gate during replay** — dissolved. Replay applied entries through `appendMessage`, which would have re-emitted without a gate; the SDK-native load goes through the backend's READ methods, which diff --git a/docs/designs/product/compass-agent-spawn-despawn/design.md b/docs/designs/product/compass-agent-spawn-despawn/design.md index 162678244..05f7f49cd 100644 --- a/docs/designs/product/compass-agent-spawn-despawn/design.md +++ b/docs/designs/product/compass-agent-spawn-despawn/design.md @@ -317,7 +317,7 @@ whole wave's spawn/despawn capability. The surfaced `not_found` is also confusable — the caller cannot tell "target missing" from "your own session is unbound"; the handler knows which lookup failed, so the MVP surfaces a distinct in-band code for the caller-session-unbound case (cheap, since the -handler already distinguishes the two lookups), tracked in **SEA-1578**. +handler already distinguishes the two lookups), tracked in **RIG-1578**. The durable-placement fallback is deliberately NOT taken: resolving the caller from `agent_placements` instead of the live binding would reopen the misattribution enroll's `clear()` exists to close @@ -419,7 +419,7 @@ error the model reads; it never tears the transport down. `LifecycleStore` and making the CreateAgent/placement/session writes itself) — rejected: it duplicates `service.go`'s placement/session invariants (`service.go:118-135`, `:158-186`) across two packages — a - second copy that would drift (a SEA-1516 reattach change to the + second copy that would drift (a RIG-1516 reattach change to the server-side write would not reach the hub copy) — and widens the hub beyond its stated scope. The `CommsCaller`/`ForgeCaller` precedent delegates execution to the domain package and leaves the hub only @@ -448,7 +448,7 @@ Every task below inherits these; they are not repeated per task. live proto.** Four held-for-review variants converge on `SessionsResponse.command` (in-proto today: 2–6, `runner.proto:164-170`): the ownership-layer record's `forge_notification = 7` (its - design.md:1633), SEA-1327's `secrets_version = 8`, SEA-1568's + design.md:1633), RIG-1327's `secrets_version = 8`, RIG-1568's `config_version = 9`, and this record's `remove = 10` — allocated by compass-repo (the single proto-owner) against that reservation ledger at the coordinated impl PR, because "next free off the live proto" misses @@ -456,7 +456,7 @@ Every task below inherits these; they are not repeated per task. (the others are signal-only Server→Runner pushes): `remove = 8` in `SessionsRequest.result` (in-proto today 2–7, `error = 7`, `runner.proto:145-152`). The internal-only files stay internal-gen-only - (the SEA-1267 gen-fence: `LifecycleCall*` / `RelayLifecycleCall*` must be + (the RIG-1267 gen-fence: `LifecycleCall*` / `RelayLifecycleCall*` must be added to the fence grep alongside `CommsCall*`). `RemoveAgentWorkspace*` is deliberately **not** added to the fence: it is a PUBLIC `compass.proto` family (client-facing, like `ProvisionAgentWorkspace*`), @@ -823,13 +823,13 @@ lane). **Resolved (Matt, 2026-07-29): (a) same-owner for MVP** — "same owner for MVP. we'll do auth scopes after we get up and running." No new schema; the wave's supervisor topology is a convention the prompt enforces, not the authz layer. Finer-grained caller-scoped authz (spawner-only, role-scoped, or -a capability model) is deferred to **SEA-1573**. +a capability model) is deferred to **RIG-1573**. ### OQ-2 — Initial prompt vs persona for the spawned peer (non-load-bearing — RESOLVED) Reclassified non-load-bearing: its own recommendation leaves every task unchanged (the record's definition), and it has since been resolved -externally. Persona is owned by compass-agent via SEA-1571, and Matt ruled +externally. Persona is owned by compass-agent via RIG-1571, and Matt ruled the persona SOURCE is a field on `AgentAccount` (a `persona TEXT` column + `store.NewAgent`/`AgentAccount` field threaded through `CreateAgent`, materialized to `$HOME/.compass/persona.txt` by the Runner, read into @@ -837,7 +837,7 @@ materialized to `$HOME/.compass/persona.txt` by the Runner, read into spawn ships `initial_prompt` only — threaded to the existing `StartAgentSessionRequest.initial_prompt` ("Optional initial prompt to send once the session is ready", compass.proto:362-364) — while persona rides -the separate SEA-1571 AgentAccount-field seam; a `persona` field on +the separate RIG-1571 AgentAccount-field seam; a `persona` field on `SpawnPeerRequest` is an additive future add if spawn-time persona-set is ever wanted. @@ -850,7 +850,7 @@ live-container cap enforced at the spawn handler (count live placements, refuse above N with in-band `resource_exhausted`). **Resolved (Matt, 2026-07-29): (a) no limit for MVP** — "no limit for MVP, we can follow up with a better limits design later (per user, per agent, etc)." Proper spawn -limits are deferred to **SEA-1574**. Consequence for OQ-6: with no cap +limits are deferred to **RIG-1574**. Consequence for OQ-6: with no cap shipping, the **bounded relay deadline (Approach) is the sole MVP guard** on how long an agent can monopolize the Runner's serial command plane. @@ -889,4 +889,4 @@ fully later." The bounded relay deadline is the sole MVP guard (OQ-3 ships no cap). Concurrent per-command dispatch — the router already correlates out-of-order completions by request id (`router.go:33-36`), but concurrency touches the dispatcher idempotency map and the send-serialization invariant -(`sendMu`, `router.go:38-40`) — is deferred to **SEA-1575**. +(`sendMu`, `router.go:38-40`) — is deferred to **RIG-1575**. diff --git a/docs/designs/product/compass-agent-transport-consolidation/design.md b/docs/designs/product/compass-agent-transport-consolidation/design.md index 8fdc93e67..e3e7a7f3e 100644 --- a/docs/designs/product/compass-agent-transport-consolidation/design.md +++ b/docs/designs/product/compass-agent-transport-consolidation/design.md @@ -5,7 +5,7 @@ Status: Active > Freezes on merge; later changes supersede by > citation, never rewrite (`../compass-0.5/design.md:10-12`, convention restated > in `../compass-0.6/design.md:1116-1118`). Extends the frozen -> `../compass-agent-runner-transport/design.md` (merged as #849, SEA-1351) and +> `../compass-agent-runner-transport/design.md` (merged as #849, RIG-1351) and > supersedes-by-citation its Decision #2 and its OQ-8 (Matt's ruling, > 2026-07-22: "get everything onto the unix socket(s)"), plus the v0.6 §T5 > stdio-*carrier* clauses those two rest on (`../compass-0.6/design.md:1416-1418` @@ -85,7 +85,7 @@ the Runner (not the agent), gap-detectable upstream, malformed-frame tolerant.** Today's stdin lane: nothing. `AgentControl` is deliberately undefined on the wire (`proto/compass/v1/agent.proto:73-85` doc comment: it "lands -with its decoder once its payload shapes are settled" — SEA-1310's parked +with its decoder once its payload shapes are settled" — RIG-1310's parked payload decision); only the typed domain union + `ControlSource = AsyncIterable` exist (`packages/compass-agent/src/control.ts:30-58`), and the Runner @@ -186,7 +186,7 @@ inversion `RunnerService.Sessions` uses one hop up - **The wire message is the frozen-variant `AgentControl` oneof** — variant names/types per the v0.6 ratification (`../compass-0.6/design.md:1439-1451`), payload fields still owned by - SEA-1310's parked decision (`agent.proto:76-85`). This record moves the + RIG-1310's parked decision (`agent.proto:76-85`). This record moves the CARRIER; it does not decide the payload shape (OQ-1 flags the interaction). The agent-side `ControlSource` seam is already carrier-blind (`control.ts:55-58`: "The wire decode … lives entirely behind this") — the @@ -196,7 +196,7 @@ inversion `RunnerService.Sessions` uses one hop up oneof has SEVEN, adding `deliver` (`../compass-0.6/design.md:1442`). C1 lands all seven on the wire; C4's dispatcher fast-paths `deliver` (below) rather than through the domain union, so the union extension is deferred to when a - built `deliver` domain op exists (SEA-1310/RT-3) — the seam is carrier-blind + built `deliver` domain op exists (RIG-1310/RT-3) — the seam is carrier-blind for the six it knows and routes the seventh explicitly. - **Mid-turn delivery is off the turn's await — a dispatcher, with a stated ordering contract.** The agent's control loop is strictly sequential and its @@ -278,7 +278,7 @@ before socket close" in its red set. a migration at all. - **Migrate ONLY control; keep telemetry on stdout (the inverse half-move).** The strongest competitor, worth naming: control is unbuilt (zero-cost carrier - change, dissolves the SEA-1310 §2 mid-turn class), while telemetry is the one + change, dissolves the RIG-1310 §2 mid-turn class), while telemetry is the one LIVE, working channel — and migrating telemetry is precisely what introduces the OQ-2 loss model, the `ReadMaxBytes` question, and the teardown-ordering hazard. Foreclosed by Matt's ruling ("get EVERYTHING onto the unix @@ -325,7 +325,7 @@ before socket close" in its red set. on the socket handler covering `Publish`, `PostConversationFrame`, and `Comms`; a message past it is a stream/unary error routed to OQ-2's reconnect path, not an OOM. -- **SEA-1267 gen-fence: extend the symbol list for every new internal name.** +- **RIG-1267 gen-fence: extend the symbol list for every new internal name.** The fence is a fixed literal grep (`proto/moon.yml:123`: `AgentFrame|AgentControl|SessionFrame|RunnerService|RunnerError|compassv1internal`, with `AgentGateway|CommsCall` added by the frozen record's T1) with the @@ -346,7 +346,7 @@ before socket close" in its red set. cover them. No existing message/field changes (new oneof variants and a new field number are additive); the stdout relay retirement deletes Go/TS code, not proto surface (`AgentFrame` stays — it is the stream payload). -- **`AgentControl` payload fields stay SEA-1310's.** This record defines the +- **`AgentControl` payload fields stay RIG-1310's.** This record defines the oneof CARRIER message with the frozen variant names (`../compass-0.6/design.md:1439-1451`) but leaves the payload message fields exactly as parked (`proto/compass/v1/agent.proto:76-85`) — C1 @@ -421,7 +421,7 @@ message PublishFrameRequest { AgentFrame frame = 1; } // trace/session only; no message PublishFrameResponse {} // ack at stream close, mirrors PublishEventsResponse // The durable-frame unary carries the SAME AgentFrame message, constrained by // C4 to a conversation_posted/conversation_updated variant, plus an agent-minted -// idempotency_key (envelope field, C2 dedup — NOT a payload field, so SEA-1310's +// idempotency_key (envelope field, C2 dedup — NOT a payload field, so RIG-1310's // parked decision is untouched). Runner-sequenced upstream through the same // ordered per-session publisher as Publish frames (C2), so hub gap-detection is // identical; the difference is delivered-or-erred to the agent. @@ -438,7 +438,7 @@ message ControlSubscribeRequest {} // the socket IS the sess // v0.6 oneof; payload fields land per-variant as representable (OQ-1). The // envelope carries a Runner-assigned control_seq for retention/redelivery // (amended OQ-6) — an ENVELOPE field, not a payload field, so it does not touch -// SEA-1310's parked payload decision. +// RIG-1310's parked payload decision. message AgentControl { uint64 control_seq = 8; // Runner-assigned, monotonic per session; the redelivery cursor (amended OQ-6) oneof control { @@ -456,8 +456,8 @@ message AskAnswerControl { string ask_id = 1; repeated string chosen_option_ids message ReplayComplete {} // SteerControl / DeliverControl / TranscriptReplay carry an inbound SDK // AgentMessage; ConfigControl carries a tool set. Their FIELDS remain -// SEA-1310's parked decision (agent.proto:76-85) — defined here as empty -// shells so the oneof is complete on the wire, populated by SEA-1310's +// RIG-1310's parked decision (agent.proto:76-85) — defined here as empty +// shells so the oneof is complete on the wire, populated by RIG-1310's // stacked PR (OQ-1). message SteerControl {} message DeliverControl {} @@ -653,7 +653,7 @@ subscription, ops ≤ the cursor are NOT, and an op named in `applied_above` is re-sent even though it sits past the cursor; a barrier test asserting held live ops are released only after `ReleaseReplayBarrier` (P1 #3); a no-agent test asserting `ErrNoAgent`. GREEN: handler + sender + retention; all pass. Non-goal: -the Runner-side callers that DECIDE what to send (SEA-1310 / RT-3 lanes), and the +the Runner-side callers that DECIDE what to send (RIG-1310 / RT-3 lanes), and the `deliver` payload cursor those lanes reconcile with this `control_seq`. ### C4 — Agent-side: socket `FrameSink` (split by durability) + socket `ControlSource` + dispatcher @@ -748,7 +748,7 @@ the trace backlog within the shutdown deadline (P1 #2); a source test asserting yielded ops match the pushed stream; **the mid-turn test** (with the iterator consumer suspended awaiting a long `prompt` turn, a pushed `steer` reaches `immediate.steer` before the turn resolves — the -SEA-1310 §2 latent bug pinned red, deadlocks-by-queueing over a naive +RIG-1310 §2 latent bug pinned red, deadlocks-by-queueing over a naive pass-through source); an ordering-inversion test asserting prompt-then-steer applies steer first (invariant 2); a barrier test asserting a pre-`ReplayComplete` steer on the immediate path is refused-and-counted, not applied (invariant 1); a @@ -775,7 +775,7 @@ verbatim). `StreamingIO` and the exec spawn (`podman.go:438-455`) are untouched — pipes exist, protocol-idle. > **Amended — stderr unified under `drainToLog`, not kept verbatim (Matt, 2026-07-31).** -> As shipped (compass #16, SEA-1364 C5), stderr does **not** keep `drainStderr` +> As shipped (compass #16, RIG-1364 C5), stderr does **not** keep `drainStderr` > verbatim. `drainStderr` was retired and generalized into a single > `drainToLog` run on **both** pipes (in `go/internal/runner/agent_exec.go` — > stderr and stdout drains), backed by a bounded `readBoundedLine` in the same @@ -821,11 +821,11 @@ untouched — OQ-3's proof). **Note on the wire-level mid-turn assertion.** C4/C5's "mid-turn steer lands end-to-end" exercises the dispatcher MECHANISM (a `steer` op routed to `immediate.steer` ahead of the turn). Carrying a real `AgentMessage` steer -payload over the wire needs SEA-1310's payload decision; until then the E2E +payload over the wire needs RIG-1310's payload decision; until then the E2E drives the immediate path with the empty-shell `SteerControl` and asserts the dispatcher ROUTES it immediately (reaching `immediate.steer`, distinct from the iterator pull), not that a populated message reaches the SDK. The populated- -payload end-to-end assertion is owed to SEA-1310's stacked PR (OQ-1). Stated so +payload end-to-end assertion is owed to RIG-1310's stacked PR (OQ-1). Stated so the acceptance criterion is satisfiable against C1's empty shells. ## Tasks @@ -866,7 +866,7 @@ Batched for Matt; each carried this record's recommendation. **Matt ruled on accepted (LGTM).** Folded below as the frozen decisions this record merges on. - **OQ-1 (LOAD-BEARING; RESOLVED — Matt, 2026-07-22) — Does the parked `AgentMessage` payload decision - (SEA-1310) block the control-lane migration?** The stdin decoder was parked + (RIG-1310) block the control-lane migration?** The stdin decoder was parked because control ops carry an inbound SDK `AgentMessage` + a tool set no compass.v1 message represents (`proto/compass/v1/agent.proto:76-85`). Moving the CARRIER to a Connect stream does not resolve that — but it does @@ -875,21 +875,21 @@ accepted (LGTM).** Folded below as the frozen decisions this record merges on. (string / id+options / empty). *Recommendation:* control rides the socket NOW with `SteerControl`/`DeliverControl`/`TranscriptReplay`/`ConfigControl` landed as empty-shell messages (C1) — additive field population is - buf-breaking-safe when SEA-1310 rules — so consolidation resolves framing, + buf-breaking-safe when RIG-1310 rules — so consolidation resolves framing, correlation, and the mid-turn DISPATCH MECHANISM today, while the payload decision stays exactly as parked. **Sequencing constraint this creates:** an empty-shell `steer`/`deliver`/`replay`/`config` op is TRANSMITTABLE on the wire before its payload exists, so C3's Runner-side callers MUST NOT send - those variants until SEA-1310 populates them (the agent can only count them as - unmapped) — i.e. the RT-3/SEA-1310 lanes own the "start sending real payloads" + those variants until RIG-1310 populates them (the agent can only count them as + unmapped) — i.e. the RT-3/RIG-1310 lanes own the "start sending real payloads" switch, and this record lands only the carrier + the mechanism test. The claim is deliberately "resolves the mid-turn DISPATCH class," not "resolves mid-turn steer end-to-end" — the latter waits on the payload. The alternative - (hold C3/C4-control until SEA-1310 rules) re-couples two decisions the frozen + (hold C3/C4-control until RIG-1310 rules) re-couples two decisions the frozen record already decoupled. **Resolved — ratified (Matt, 2026-07-22).** Control rides the socket now with empty-shell control messages (C1); C3's Runner-side callers must not send the - `steer`/`deliver`/`replay`/`config` variants until SEA-1310 populates them. + `steer`/`deliver`/`replay`/`config` variants until RIG-1310 populates them. - **OQ-2 (LOAD-BEARING, security-relevant; RESOLVED — Matt, 2026-07-22) — Telemetry stream reconnect + the new loss model.** Today a broken relay ends telemetry for the session (`relay.go:162-166`: send failure logs + breaks; stdout EOF ends the loop) and @@ -994,7 +994,7 @@ accepted (LGTM).** Folded below as the frozen decisions this record merges on. (3) iterator-end is terminal (→ STOPPED) ONLY on a Runner-initiated clean close, distinguished from a transport drop (which triggers the retry, not a terminal status). Redelivery of missed prompt/steer/askAnswer across a control - drop is SEA-1310/RT-3's cursor problem, not this record's — noted so the + drop is RIG-1310/RT-3's cursor problem, not this record's — noted so the boundary is explicit. **Matt: confirm takeover + retry + clean-close-only- terminal, or flag if control-op redelivery must be designed here.** **Resolved — takeover + retry + clean-close-only-terminal (Matt, 2026-07-22).** @@ -1004,10 +1004,10 @@ accepted (LGTM).** Folded below as the frozen decisions this record merges on. a Runner-initiated clean close. **Amended — control-op redelivery designed IN THIS RECORD (Matt, 2026-07-23).** The 2026-07-22 resolution's out-of-scope clause ("missed prompt/steer/ - askAnswer redelivery is SEA-1310/RT-3's cursor problem") is superseded: the + askAnswer redelivery is RIG-1310/RT-3's cursor problem") is superseded: the control lane is now lossless end-to-end. Each `AgentControl` carries a Runner-assigned monotonic `control_seq` (envelope field, C1 — NOT a payload - field, so SEA-1310's parked payload decision is untouched); the Runner RETAINS + field, so RIG-1310's parked payload decision is untouched); the Runner RETAINS every op past the agent's `ControlAck` cursor and drops any op the ack reports individually applied (below); it TRANSFERS retained ops to the replacement subscription on takeover (C3) and REDELIVERS from the cursor on reconnect after @@ -1029,5 +1029,5 @@ accepted (LGTM).** Folded below as the frozen decisions this record merges on. makes `ControlSender.Send` success mean "durably queued until acked," closing the caller-already-got-success hazard (P1 #6). The RT-3 `deliver` cursor (`../compass-0.6/design.md:1452-1466`) is reconciled with `control_seq` by the - SEA-1310/RT-3 lanes; this record owns the generic control-op retention + RIG-1310/RT-3 lanes; this record owns the generic control-op retention mechanism, they own the `deliver`-specific payload semantics layered on it. diff --git a/docs/designs/product/compass-agent-trees/design.md b/docs/designs/product/compass-agent-trees/design.md index 152b72af6..0b7b0dadd 100644 --- a/docs/designs/product/compass-agent-trees/design.md +++ b/docs/designs/product/compass-agent-trees/design.md @@ -227,14 +227,14 @@ that" part. Per surface: here. - **User guidance (docs/onboarding).** See §How this informs usage below. - **Agent instructions.** See §How this informs agent instructions below. -- **Channels (SEA-1622).** Channels currently form their *own* tree via +- **Channels (RIG-1622).** Channels currently form their *own* tree via `ChannelGroup.parent_group_id` (`comms.proto:155-169`) — a parallel namespace hierarchy. Unifying them under the agent tree (an agent's - subtree implying its channel scope) is **SEA-1622, post-MVP**: this record - makes the agent tree the primitive SEA-1622 will fold channels into, and + subtree implying its channel scope) is **RIG-1622, post-MVP**: this record + makes the agent tree the primitive RIG-1622 will fold channels into, and deliberately does **not** do that folding — the two trees coexist until - SEA-1622 lands. -- **Roles (SEA-1623).** Roles compose onto the tree: a role applied to an + RIG-1622 lands. +- **Roles (RIG-1623).** Roles compose onto the tree: a role applied to an agent can scope to its subtree (everything under this parent inherits the posture). Referenced, not designed here. @@ -295,7 +295,7 @@ curated taxonomy that drifts from it. `comms.proto:134-137`); empty string = root, mirroring `ChannelGroup.parent_group_id` (`comms.proto:160-161`). - **Scope fence**: channels stay on their own `ChannelGroup` tree until - SEA-1622; roles-on-subtrees is SEA-1623; board grouping/filter UI and pins + RIG-1622; roles-on-subtrees is RIG-1623; board grouping/filter UI and pins are separate downstream records. This record establishes the primitive and its contracts, nothing more. - **Re-parenting is first-class** (Matt, 2026-08-01): `parent_agent_id` is @@ -445,7 +445,7 @@ record consumes. unchanged, but the comment narrates the retired moat convention on a surface this task lands in and must be rewritten to the issue-based reason. (The `AgentRole` vocabulary at `stub-data.ts:58` is roles, not - exclusion — SEA-1623, left alone.) + exclusion — RIG-1623, left alone.) The board Issues/PRs remodel record consumes these for its grouping and filter UI; no board UI changes in this task. @@ -488,7 +488,7 @@ Appended to `docs/designs/product/DECISIONS.md` in the same PR that freezes this record (touch-coupling), under **Strategy & positioning** — this is a product-thesis decision, not a UI-shell detail: -> | DL-095 | The agent tree is Compass's organizing primitive — Compass is a tool to build and manage agent trees: `AgentAccount` carries `parent_agent_id` (field 4; empty = root, set at creation — the spawning agent, or user choice — and editable thereafter via a `ReparentAgent` mutation, so users iterate hierarchy without teardown), the workspaces sidebar and board views derive from and filter by the tree, REPLACING the user-defined folder organization (replace, not coexist); channels (SEA-1622) and roles (SEA-1623) compose onto the tree later | Active (Matt, 2026-08-01) | [agent trees §Approach](compass-agent-trees/design.md#approach) | +> | DL-095 | The agent tree is Compass's organizing primitive — Compass is a tool to build and manage agent trees: `AgentAccount` carries `parent_agent_id` (field 4; empty = root, set at creation — the spawning agent, or user choice — and editable thereafter via a `ReparentAgent` mutation, so users iterate hierarchy without teardown), the workspaces sidebar and board views derive from and filter by the tree, REPLACING the user-defined folder organization (replace, not coexist); channels (RIG-1622) and roles (RIG-1623) compose onto the tree later | Active (Matt, 2026-08-01) | [agent trees §Approach](compass-agent-trees/design.md#approach) | **No existing row is superseded — the call, stated:** the user-defined folder organization this record replaces was never a ledgered decision. A diff --git a/docs/designs/product/compass-ask-comms-roundtrip/design.md b/docs/designs/product/compass-ask-comms-roundtrip/design.md index 9c271cb80..60c5a289e 100644 --- a/docs/designs/product/compass-ask-comms-roundtrip/design.md +++ b/docs/designs/product/compass-ask-comms-roundtrip/design.md @@ -147,7 +147,7 @@ Agent-side, the decode already exists: wire op into the domain union (`op: { kind: "askAnswer", askId: v.askId, answers: v.answers }`), typed at `control.ts:47-51`. The **apply arm is parked**: `agent.ts:519-529` surfaces it as a counted unmapped op — -`"ask_answer delivery staged — awaiting SEA-1310 ask correlation key"` — never +`"ask_answer delivery staged — awaiting RIG-1310 ask correlation key"` — never dropped. This record's consume task un-parks that arm: on a post-barrier `askAnswer`, format the answers into a prompt injection delivered on the agent's next turn, following the established turn-end-delivery pattern the @@ -229,7 +229,7 @@ there is **no Ask or conversation-block variant**; fields 1-2 the streaming conversation write-through is gone" (`agent.proto:47-49`). So the path `compass-ask-typed-derivation.md` (DL-043) specified — deriving an outbound Ask conversation frame from the OMP `ask` tool-call via the -`mapping.ts` `#deriveAsk` helper — is **dead**: SEA-1708 removed agent +`mapping.ts` `#deriveAsk` helper — is **dead**: RIG-1708 removed agent conversation-frame production, and `mapping.ts` has no ask arm today (grep for `deriveAsk`/`ask` in `packages/compass-agent/src/mapping.ts` matches only todo-plan extraction @@ -412,7 +412,7 @@ Interfaces: Flip the staged-arm pins: extend `packages/compass-agent/src/agent.test.ts:341-397` ("CompassAgent — -ask_answer is staged, never delivered to the SDK (SEA-1310)") so the +ask_answer is staged, never delivered to the SDK (RIG-1310)") so the post-barrier case asserts DELIVERY instead of staging: a post-`replayComplete` `askAnswer` whose `askId` is registered in `PendingAsks` is formatted and delivered to the SDK as a prompt (idle → starts a turn; mid-turn → coalesces diff --git a/docs/designs/product/compass-ask-in-channel/design.md b/docs/designs/product/compass-ask-in-channel/design.md index a14e38bb1..4b59b58bb 100644 --- a/docs/designs/product/compass-ask-in-channel/design.md +++ b/docs/designs/product/compass-ask-in-channel/design.md @@ -19,7 +19,7 @@ board fleet pane — with no rerouting. First-responder-wins is the sole settlement: the first answer locks the ask for everyone. First-responder-wins is the backend contract that landed with PR #810 -(SEA-1243, merged 2026-07-20): it reshapes +(RIG-1243, merged 2026-07-20): it reshapes `Ask` into per-question `Ask{AskID, Questions[]}`, makes `RespondToAsk` take `[]AskQuestionAnswer` keyed by `question_id` (every question covered exactly once), and adds a PERSISTED `Ask.Answered` flag — settlement is @@ -331,7 +331,7 @@ per-question decomposition lands in #821 as a behavior-preserving refactor, ahead of T1-T3; the #810 affordances that ride on top — free-text/`custom_text`, timeout, preview, and the atomic `[]AskQuestionAnswer` transport — stay Non-goals, deferred to the `@compass/client` swap -where the seam signature widens (tracked in SEA-1330). The stub carries only +where the seam signature widens (tracked in RIG-1330). The stub carries only single-question fixtures today, so per-question rendering is exercised but multi-question accumulation is not until the swap. diff --git a/docs/designs/product/compass-ask-typed-derivation.md b/docs/designs/product/compass-ask-typed-derivation.md index 1f36e9eef..8fcbbb587 100644 --- a/docs/designs/product/compass-ask-typed-derivation.md +++ b/docs/designs/product/compass-ask-typed-derivation.md @@ -2,7 +2,7 @@ Status: Active -Tracking: SEA-1243 (Go-port wave follow-up flagged at PR #771 merge). +Tracking: RIG-1243 (Go-port wave follow-up flagged at PR #771 merge). **This record supersedes design compass-0.5 D5's `Ask` shape by citation** (`docs/designs/product/compass-0.5/design.md:288`, "D5 — The UI pivots around @@ -149,7 +149,7 @@ message AskQuestion { // for allow_multiple, alongside) picking options. string custom_text = 8; // True when the answer was recorded by timeout auto-selection rather than a - // participant (SEA-1310 owns whether/when the Compass answer path can time + // participant (RIG-1310 owns whether/when the Compass answer path can time // out; the field is the audit carrier either way). bool timed_out = 9; } @@ -228,15 +228,15 @@ per-axis gap map in Alternatives shrinks to those two rather than to zero: | `OptionItem.label` / `.description?` (ask.ts:57-59) | `AskOption.label` / `.description` | | `OptionItem.preview?` (ask.ts:60) | `AskOption.preview` | | always-offered "Other (type your own)" → `QuestionResult.customInput` (ask.ts:48, 91) | free-text is always available at the contract level (no flag — mirrors the native tool, whose "Other" is unconditional, ask.ts:12 "Users will always be able to select \"Other\""); answer rides `AskQuestionAnswer.custom_text`, audit rides `AskQuestion.custom_text` | -| `QuestionResult.selectedOptions` labels (ask.ts:90) | `AskQuestionAnswer.chosen_option_ids` (ids; label reconstruction is SEA-1310's, see Mapping) | -| `QuestionResult.timedOut?` (ask.ts:94-95) | `AskQuestion.timed_out` (audit; SEA-1310 decides whether the Compass answer path times out at all) | +| `QuestionResult.selectedOptions` labels (ask.ts:90) | `AskQuestionAnswer.chosen_option_ids` (ids; label reconstruction is RIG-1310's, see Mapping) | +| `QuestionResult.timedOut?` (ask.ts:94-95) | `AskQuestion.timed_out` (audit; RIG-1310 decides whether the Compass answer path times out at all) | Deliberately dropped (no carrier), each an answer-side rich-dialog affordance with no Compass analogue in v1: - `QuestionResult.note` (ask.ts:92-93, "Optional note attached to the selected answer") — a free-form annotation beside the choice. Omitted now; `string - note = 4` on `AskQuestionAnswer` is a non-breaking addition if SEA-1310 finds + note = 4` on `AskQuestionAnswer` is a non-breaking addition if RIG-1310 finds it needed. - `AskToolDetails.chatRedirect` / the "Chat about this" reserved label (ask.ts:49, 110-112) — a native answer MODE that hands off to chat. Moot in @@ -249,7 +249,7 @@ rather than asked — see Resolved decisions for the reasoning): one `Ask` block = one server-minted `ask_id`; the native tool awaits one `QuestionResult[]` for the whole call (the single results array is built and returned once per call, ask.ts:1073-1089; the `QuestionResult` interface is - ask.ts:84-96), so SEA-1310 needs + ask.ts:84-96), so RIG-1310 needs exactly one `toolCallId ↔ ask_id` key. Questions are addressed *within* the Ask by the agent-supplied `question_id` (native `QuestionItem.id`, ask.ts:64). The store's `mintAskIDs` (blocks.go:80-90) keeps its @@ -268,11 +268,11 @@ rather than asked — see Resolved decisions for the reasoning): `chosen_option_ids`/`custom_text` — same pattern the frozen shape used for chosen ids ("kept for audit", comms.proto:286-287). Whether the Compass answer path ever *sets* it (native auto-selects on timeout, - `getAutoSelectionOnTimeout`, ask.ts:161-167) is SEA-1310's interception-seam + `getAutoSelectionOnTimeout`, ask.ts:161-167) is RIG-1310's interception-seam call; the carrier exists either way so the audit trail can distinguish a timeout from a participant choice. Carrier-now over omit-now (a `bool timed_out = 9` addition is non-breaking later) is chosen so the store/UI - mirror shape stays stable across SEA-1310's ruling rather than reshaping + mirror shape stays stable across RIG-1310's ruling rather than reshaping again when the answer path is designed. ### Server-side answer validation (contract semantics, not new code here) @@ -318,15 +318,15 @@ a 1:1 map of the native call, never decomposed — appended via the existing | `questions[i].recommended?` | `questions[i].recommended` (absent → unset) | | `questions[i].options[j].label` / `.description?` / `.preview?` | `options[j].label` / `.description` / `.preview` | | — (options keyed by label, no id: ask.ts:57-61) | `options[j].id` — mapper-minted, deterministic: the zero-based option index as a decimal string (`"0"`, `"1"`, …) | -| — | `chosen_option_ids` / `custom_text` / `timed_out` — empty/unset while pending (answer-side, SEA-1310) | +| — | `chosen_option_ids` / `custom_text` / `timed_out` — empty/unset while pending (answer-side, RIG-1310) | Option-id minting: native options carry no id (ask.ts:57-61, `OptionItem = { label, description?, preview? }`), so the mapper mints index-string ids. Index ids are safer than label-derived ids (labels can collide; the reserved-label `.narrow()` only excludes the three runtime -labels, ask.ts:70-76). SEA-1310 reconstructs the native label-keyed +labels, ask.ts:70-76). RIG-1310 reconstructs the native label-keyed `QuestionResult.selectedOptions` (ask.ts:90) from `chosen_option_ids` as -`questions[i].options[atoi(id)].label` — deterministic from state SEA-1310 +`questions[i].options[atoi(id)].label` — deterministic from state RIG-1310 already holds (the in-flight tool-call args plus the `toolCallId ↔ ask_id` key; the answered `Ask` block also carries the full options list), so no separate retention machinery is required. The mapper does not bounds-check the @@ -339,7 +339,7 @@ member shapes, non-object, OR a `questions` list carrying a duplicate or empty malformation — never a throw, never a silent `[]`. Because the map is 1:1 onto ONE atomic `Ask`, a single malformed member (question `k` of N) bounces the WHOLE ask as that one `UnmappedEvent` — there is no partial emission of the -valid questions, so no mixed-validity block ever reaches the store or SEA-1310. +valid questions, so no mixed-validity block ever reaches the store or RIG-1310. A zero-option question is NOT malformed (schema-valid natively, ask.ts:67); it maps as a free-text-only question (see Approach). @@ -356,7 +356,7 @@ The ask block appends into the block set of the assistant message that requested the tool: `#blocks` resets only at `message_start` (mapping.ts:95) and tool executions run after that message, so the ask sits mingled with that message's settled text (ask is conversation continuity). Because the map is -1:1, message-id ambiguity is harmless to SEA-1310: even two `ask` toolCalls in +1:1, message-id ambiguity is harmless to RIG-1310: even two `ask` toolCalls in one assistant turn produce two distinct `Ask` blocks, each with its own server-minted `ask_id`, and the one `toolCallId ↔ ask_id` key suffices — no grouping/ordering/partial-completion problem (the problem Option B would have @@ -365,9 +365,9 @@ created). Answer-side wiring (native `toolCallId ↔ ask_id` correlation, blocking the native tool on the Compass answer path instead of its own interactive prompt + timeout auto-select, and reconstructing `QuestionResult[]` from an answered -`Ask`) is SEA-1310 scope — the `ask_answer` control arm is itself staged +`Ask`) is RIG-1310 scope — the `ask_answer` control arm is itself staged awaiting that key (`packages/compass-agent/src/agent.ts:175-180`: -"ask_answer delivery staged — awaiting SEA-1310 ask correlation key") — and +"ask_answer delivery staged — awaiting RIG-1310 ask correlation key") — and stays out of this record, cited as the external dependency that makes the rendered ask live rather than decorative. @@ -399,7 +399,7 @@ and the prior version of this record recommended it. **Matt declined it**: it has no atomic multi-question form — N independent asks and N `RespondToAsk` round-trips, with partial answering able to strand the native tool call (which awaits ONE `QuestionResult[]`, ask.ts:84-96) and no grouping key in -the contract for SEA-1310 to gather N asks back into one result — and it +the contract for RIG-1310 to gather N asks back into one result — and it drops the `customInput`/`recommended`/`header`/`preview`/`timedOut` axes outright, where Matt ruled free-text MUST survive. @@ -428,8 +428,8 @@ no vestigial shape. ## Global Constraints - Baseline: `main` @ `06e9a170` (post-#771 merge: - `feat(compass): SEA-1243 T5 first-party agent package + internal proto gen - lane`). Tracking issue: SEA-1243. + `feat(compass): RIG-1243 T5 first-party agent package + internal proto gen + lane`). Tracking issue: RIG-1243. - **This record supersedes compass-0.5 D5's `Ask` shape by citation** (AGENTS.md freeze rule: a frozen record is never rewritten; a change ADDS a superseding record). D5's record file stays untouched; the reshaped contract @@ -469,7 +469,7 @@ no vestigial shape. path. The eventual Runner MUST reconcile server-minted ids into subsequent update frames (runner owner's scope; a constraint this mapping shape creates regardless of the reshape). -- **SEA-1310 owns the native-ask resolution seam + answer wiring**: the +- **RIG-1310 owns the native-ask resolution seam + answer wiring**: the `toolCallId ↔ ask_id` correlation, intercepting the native tool's own prompt/timeout resolution (`getAutoSelectionOnTimeout`, ask.ts:161-167) to block it on the Compass answer path, delivering `ask_answer` @@ -750,9 +750,9 @@ re-opens it: 3. **Free-text `customInput` → MUST survive** (Matt): carried flagless (always available, mirroring native's unconditional "Other", ask.ts:12, 48) via `AskQuestionAnswer.custom_text` + audit `AskQuestion.custom_text`. -4. **Native-ask resolution seam → SEA-1310** (Matt): interception of the +4. **Native-ask resolution seam → RIG-1310** (Matt): interception of the native prompt/timeout path, `toolCallId ↔ ask_id` correlation, and - `ask_answer` delivery are SEA-1310's scope; cited here as an external + `ask_answer` delivery are RIG-1310's scope; cited here as an external dependency. 5. **Correlation is per-Ask** (resolved at source): the native tool awaits one `QuestionResult[]` per call (results built/returned once per call, @@ -767,7 +767,7 @@ re-opens it: 6. **Zero-option questions map** as free-text-only (schema-valid natively, ask.ts:67; answerable via `custom_text` exactly as natively via "Other"). 7. **`timed_out` rides `AskQuestion`** as answer-side audit state; whether - the Compass answer path ever sets it is SEA-1310's interception-seam + the Compass answer path ever sets it is RIG-1310's interception-seam call. 8. **Message names `AskQuestion`/`AskQuestionAnswer`** (resolved at source): collision-free across all three `compass.v1` protos this run; extends the @@ -782,7 +782,7 @@ re-opens it: (every `question_id` answered exactly once) and per-answer multiplicity/option-id checks still apply; an empty entry is a present answer, not a missing one. Sets the T7 rejection matrix and the - answer-side contract SEA-1310 reconstructs against. + answer-side contract RIG-1310 reconstructs against. ## Open Questions @@ -791,8 +791,8 @@ re-opens it: set it via the reshaped RPC — a timeout auto-answer would have to arrive through some other write path (server-internal, or a privileged field added later). Whether Compass-side ask timeouts exist AT ALL is - SEA-1310's interception-seam design; if it rules "yes, and the runner + RIG-1310's interception-seam design; if it rules "yes, and the runner records them via RespondToAsk", the RPC needs an additive `timed_out`/actor field then (non-breaking addition). Left open because - it is decidable only inside SEA-1310's answer-path design, not at any + it is decidable only inside RIG-1310's answer-path design, not at any source verifiable this run. diff --git a/docs/designs/product/compass-badge-clarity/design.md b/docs/designs/product/compass-badge-clarity/design.md index ed5906405..0f7282eff 100644 --- a/docs/designs/product/compass-badge-clarity/design.md +++ b/docs/designs/product/compass-badge-clarity/design.md @@ -1,12 +1,12 @@ -# Compass badge clarity (SEA-2117) +# Compass badge clarity (RIG-2117) Status: Active Owner lane: compass-ux (design) → compass-ui (execution) -Refs: SEA-2117 (CI/review badges convey meaning by color alone, and the token tier maps +Refs: RIG-2117 (CI/review badges convey meaning by color alone, and the token tier maps CI-pass ≡ review-approved and CI-fail ≡ review-changes to the same hues). Sibling to the -SEA-2111 Bridge re-clothe (its T4 consumes whatever badge form this record freezes) and -sequenced after the SEA-2034 DS-token cutover (merged, main `18e988b5`). State-dot glyph -adoption is a separate lane (SEA-2118); this record is badges only. +RIG-2111 Bridge re-clothe (its T4 consumes whatever badge form this record freezes) and +sequenced after the RIG-2034 DS-token cutover (merged, main `18e988b5`). State-dot glyph +adoption is a separate lane (RIG-2118); this record is badges only. ## Problem / Intent @@ -293,7 +293,7 @@ render spec below — see the note on the emission precedent), 6 glyph grids add glyph (`components.md:93-95`) and the loader spinner (`loader.css:24-28`, `motion.md:81-86`) — note that both are documented specs, not shipped emitters (`StateDot.tsx` renders a color-only ``; the state-dot - glyph SVG is the SEA-2118 lane), so `BadgeGlyph` is built from the grids below as spec, + glyph SVG is the RIG-2118 lane), so `BadgeGlyph` is built from the grids below as spec, not copied from a rendered artifact. Review twin: `.cx-review-glyph[data-verdict]`. - Box: 9×9 CSS px, `display: inline-block`, no background, no border. - Color: `color: var(--cx-ci-pass|--cx-ci-pending|--cx-ci-fail)` / @@ -630,7 +630,7 @@ above). The rationale each proceeded on is kept below for the executor. Matt gives there should bind these glyphs too. - **Q5 (non-load-bearing): should the chosen option back-port to the internal monorepo's company-site board** (which has the same bare - squares)? Assumption: yes eventually, out of scope for SEA-2117. + squares)? Assumption: yes eventually, out of scope for RIG-2117. ## Plan / Tasks diff --git a/docs/designs/product/compass-batteries-included/design.md b/docs/designs/product/compass-batteries-included/design.md index 6c74a947b..c45015624 100644 --- a/docs/designs/product/compass-batteries-included/design.md +++ b/docs/designs/product/compass-batteries-included/design.md @@ -3,7 +3,7 @@ Status: Draft > Freezes on merge; later changes supersede by citation, never rewrite. -> Tracked as SEA-1738. Fast-follow to the SEA-1732 Manager+implementer prompt +> Tracked as RIG-1738. Fast-follow to the RIG-1732 Manager+implementer prompt > record ([compass-manager-prompt](../compass-manager-prompt/design.md), PR > #1089): #1089 freezes the two role prompts (Manager block-0 + implementer > block-0, MP-1..MP-5 / DL-129..DL-134); THIS record freezes the batteries @@ -12,7 +12,7 @@ Status: Draft > > New named Decisions this record introduces (ledger rows DL-140..DL-147, > landed in DECISIONS.md in this same PR): **DL-140** (language-neutral default -> bundle; Go pack deferred to SEA-1739/Beta), **DL-141** +> bundle; Go pack deferred to RIG-1739/Beta), **DL-141** > (delegated-implementation folds into management-trees, no separate skill), > **DL-142** (version-control's three footguns fold into one Compass > always-apply rule), **DL-143** (the wave-specific exclusion set), **DL-144** @@ -22,7 +22,7 @@ Status: Draft > always-apply — per-container isolation removes the shared-box clobber blast > radius), **DL-147** (the default batteries are stack-neutral, not merely > language-neutral — devenv/direnv is a kept product baseline, GitHub-Actions -> specifics leave `ci-failure-triage` for SEA-1739 pack territory). +> specifics leave `ci-failure-triage` for RIG-1739 pack territory). > > Grounding: every delivery-mechanism claim below was re-verified firsthand > against the compass repo at **`origin/main = cf048ca`** (read-only checkout, @@ -34,7 +34,7 @@ Status: Draft ## Problem / Intent -A freshly-spawned Compass agent gets the two role prompts (SEA-1732: Manager +A freshly-spawned Compass agent gets the two role prompts (RIG-1732: Manager block-0 via `customSystemPrompt`, implementer block-0 as a mounted `config/agents/` subagent def) — but **no skills and no rules**. The prompt tells it *what it is*; the batteries tell it *how work is done here*: the jj @@ -48,26 +48,26 @@ This record freezes the **default bundle manifest** for the Dogfood cut: per role (Manager, Implementer), which rules and skills ship, where each comes from (folded / adapted / authored new), and what is deliberately excluded and why. Scope boundaries, both Matt-ratified: the default is **language-neutral** -(no Go pack — that is the SEA-1739 "packs" feature, Beta; for Dogfood, +(no Go pack — that is the RIG-1739 "packs" feature, Beta; for Dogfood, Matt-as-user adds his Go skills via the normal user-skill path), and this is a **manifest + adaptation-decision record** — the skill/rule BODIES are authored -in the impl children below, matching the SEA-1732 T4–T9 pattern. +in the impl children below, matching the RIG-1732 T4–T9 pattern. ## Approach ### Decision BI-1 — two role bundles on one delivery surface -Two roles, two bundles, matching the SEA-1732 cost split (MP-2/DL-130): +Two roles, two bundles, matching the RIG-1732 cost split (MP-2/DL-130): - **Manager** — coordinator. Small always-on surface: the ~500-word block-0 - (SEA-1732 T1) + always-apply rules (full text every turn) + on-demand + (RIG-1732 T1) + always-apply rules (full text every turn) + on-demand skills (name + one-liner every turn, body via `skill://`). - **Implementer** — hands, an in-process `task` subagent (MP-5/DL-134). Large - block-0 (SEA-1732 T2, `config/agents/implementer.md`) + domain rules + block-0 (RIG-1732 T2, `config/agents/implementer.md`) + domain rules (rulebook tier: loaded on demand by description match). **How the bundle is consumed — grounded at `cf048ca`.** The batteries ship as -members of the config bundle SEA-1678's passthrough delivers (skills, rules, +members of the config bundle RIG-1678's passthrough delivers (skills, rules, agents, AGENTS.md), and the compass entrypoint maps each member onto a `createAgentSession` seam: @@ -137,18 +137,18 @@ is **fleet-flat** — one `config/rules/` dir, every rule visible to both roles, with the role split expressed as *tier* (always-apply = the Manager-facing invariants, which also inject into implementer subagents; rulebook/domain = loaded only when the description matches the work). Per-role bundle keying is -the named SEA-1724 seam (DL-078), not this record's scope. See OQ-1. +the named RIG-1724 seam (DL-078), not this record's scope. See OQ-1. ### Decision BI-2 — three sourcing modes, one per manifest row Every battery is one of: - **(a) Folded** — its content is absorbed into a role prompt or an existing - SEA-1732 task; no standalone artifact ships. Two folds are Matt-ratified; a + RIG-1732 task; no standalone artifact ships. Two folds are Matt-ratified; a third (`enumerate-pr-review-surfaces`) is added by this amendment to close a manifest gap the critique surfaced (it was unaccounted-for in shipped/folded/excluded): - - `delegated-implementation` → SEA-1732 **T5 management-trees** (DL-141). + - `delegated-implementation` → RIG-1732 **T5 management-trees** (DL-141). The stance is already in the Manager block-0 ("You are a COORDINATOR, not a typist … you never hand-write code"); the skill's unique value — the when-to-delegate litmus ("Delegate to an `implement` subagent when: the @@ -183,7 +183,7 @@ Every battery is one of: skill carries stacking (the wave `jj` skill already folds stacking into its references, "Deeper jj-vine mechanics/stacking and recovery live in references/", `~/.agents/skills/jj/SKILL.md:3`), and T8 adapts it directly. - - `enumerate-pr-review-surfaces` (rule) → SEA-1732 **T9 review** skill; no + - `enumerate-pr-review-surfaces` (rule) → RIG-1732 **T9 review** skill; no standalone artifact. The wave rule is the review-status-reporting discipline — enumerate every PR feedback surface (inline threads, review summary bodies, top-level comments, CI, our own review findings) with @@ -201,7 +201,7 @@ Every battery is one of: T9 as home, with the CI-bucket guard surfacing in B4. - **(b) Adapted-and-shipped** — the wave artifact ships under the same name with its invariant kept and its mechanics re-grounded in Compass (the GC-7 - discipline SEA-1732 froze). The adapt-not-copy passes beyond T3/T8/T9's + discipline RIG-1732 froze). The adapt-not-copy passes beyond T3/T8/T9's already-planned adaptations: - `decision-authority` — the wave rule routes design forks to **Matt-via-`ask`, never the supervisor** ("Design/scope/approach forks @@ -230,7 +230,7 @@ Every battery is one of: yours-vs-not-yours; classify code-vs-env/permission; verify in a reproducing env) as the CI-engine-NEUTRAL default; the GitHub-Actions tooling hooks (log-pull, check-decoding) leave the default for the - SEA-1739 CI pack seam, same shape as a language pack (DL-147). Moderate + RIG-1739 CI pack seam, same shape as a language pack (DL-147). Moderate revision, not verbatim. - The implementer domain rules `pre-finish-checks`, `no-retries`, `process-safety`, `planning-evidence` ship with invariants intact (each @@ -244,9 +244,9 @@ Every battery is one of: `AGENTS.md:9-11` at `cf048ca`), which a spawn only benefits from if it knows to look. Pairs with T6 compass-setup. - `issue-lifecycle` — own an issue end-to-end (take, drive state, close) - plus the PR review loop on the Compass surface. **Gated on SEA-1734's + plus the PR review loop on the Compass surface. **Gated on RIG-1734's issue/PR tools** (the same gate the Manager block-0's issue-ownership - lines carry as `[TODO SEA-1734]`, MP-4): the skill names concrete tools, + lines carry as `[TODO RIG-1734]`, MP-4): the skill names concrete tools, so it cannot ship before they land. ### Decision BI-3 — language-neutral default; packs are Beta (DL-140) @@ -255,7 +255,7 @@ The shipped default bundle contains **no language-specific content** — none of the wave's `go-*` rules or `golang-*` skills. Ratified rationale: for Dogfood, Matt-as-user adds the Go skills he wants via the normal user-skill path (they are his to add, not a Compass default); Beta ships the "packs" feature -(**SEA-1739**: per-repo language → skill-pack selection) so the Go skills +(**RIG-1739**: per-repo language → skill-pack selection) so the Go skills become easily usable by other users. The Beta boundary is a named seam, not a gap: nothing in this manifest needs reopening when packs land — a pack is additive bundle content on the same delivery surface (BI-1). @@ -269,7 +269,7 @@ territory — "devenv is baked into the product" (Matt, 2026-08-05); B3 ships it as a default skill. (2) CI-engine specifics (GitHub-Actions log-pull, check-decoding) ARE pack territory — the default `ci-failure-triage` skill ships CI-engine-neutral (the 4-step classification discipline) and the -GitHub-Actions hooks become an SEA-1739-shaped pack seam, same shape as a +GitHub-Actions hooks become an RIG-1739-shaped pack seam, same shape as a language pack. See BC-4 and B4. ### Decision BI-4 — the exclusion set (DL-143) @@ -289,21 +289,21 @@ what the no-revival posture governs. ## Global Constraints -Every task below inherits these (extending SEA-1732's GC set, which T-level +Every task below inherits these (extending RIG-1732's GC set, which T-level work under this record also inherits): - **BC-1 — Manifest-level record.** This record fixes names, sources, modes, tiers, and gates. Skill/rule BODIES are authored in the impl children; no body text is frozen here. -- **BC-2 — Adapt, don't fork** (SEA-1732 GC-7): keep the invariant, re-ground +- **BC-2 — Adapt, don't fork** (RIG-1732 GC-7): keep the invariant, re-ground the mechanics in Compass tools. Wave artifact names are kept unless the content's scope changed (see OQ-2). -- **BC-3 — Name only what exists** (SEA-1732 GC-3/MP-4): a skill/rule line may +- **BC-3 — Name only what exists** (RIG-1732 GC-3/MP-4): a skill/rule line may name a tool only if it exists at the commit it ships against; unshipped affordances are explicit `[TODO ]` lines. This is what gates - `issue-lifecycle` on SEA-1734. + `issue-lifecycle` on RIG-1734. - **BC-4 — Language-neutral** (BI-3): no `go-*`/`golang-*` content in any - default battery; a task that finds itself needing one has hit the SEA-1739 + default battery; a task that finds itself needing one has hit the RIG-1739 boundary and stops. - **BC-5 — Tier by frontmatter.** Always-apply rules carry `alwaysApply: true`; domain rules carry `description:` (and globs/conditions @@ -328,25 +328,25 @@ work under this record also inherits): role-invariant rule (`never-block`) needs no branch: its single behavior already applies to both. This is body-level self-scoping, the authored-body contract B2/B7 (and the cross-referenced T3 amendment to - `own-your-issue`) implement — NOT per-role delivery, which is the SEA-1724 + `own-your-issue`) implement — NOT per-role delivery, which is the RIG-1724 seam (OQ-1). (DL-144.) ## Plan -The manifest, per role. "Source" names the wave artifact (or the SEA-1732 +The manifest, per role. "Source" names the wave artifact (or the RIG-1732 task); "Mode" is BI-2's (a) fold / (b) adapt / (c) new, plus "T3/T4…" where -SEA-1732 already owns the row and this record only confirms it in the bundle. +RIG-1732 already owns the row and this record only confirms it in the bundle. ### Manager — always-apply rules (`config/rules/*.md`, `alwaysApply: true`) | Rule | Source | Mode | Adaptation note | | --- | --- | --- | --- | -| `never-block` | wave rule | adapt (SEA-1732 T3) | re-ground in comms tools + turn-yield loop | -| `own-your-issue` | wave rule | adapt (SEA-1732 T3) | re-ground in Compass issue surface (`[TODO SEA-1734]` on concrete tools); **role-aware body (BC-7)** — issue-state ownership is Manager-only; a hands subagent neither drives nor closes issues (cross-ref amendment to T3's brief) | -| `red-green-testing` | wave rule | adapt (SEA-1732 T3) | invariant unchanged; examples re-grounded | -| `never-merge` | new (SEA-1732 T3) | new one-liner | the human merges — already frozen in T3's set | -| `design-first` | new (SEA-1732 T3) | new one-liner | already frozen in T3's set | -| `compact-often` | new (SEA-1732 T3) | new one-liner | already frozen in T3's set | +| `never-block` | wave rule | adapt (RIG-1732 T3) | re-ground in comms tools + turn-yield loop | +| `own-your-issue` | wave rule | adapt (RIG-1732 T3) | re-ground in Compass issue surface (`[TODO RIG-1734]` on concrete tools); **role-aware body (BC-7)** — issue-state ownership is Manager-only; a hands subagent neither drives nor closes issues (cross-ref amendment to T3's brief) | +| `red-green-testing` | wave rule | adapt (RIG-1732 T3) | invariant unchanged; examples re-grounded | +| `never-merge` | new (RIG-1732 T3) | new one-liner | the human merges — already frozen in T3's set | +| `design-first` | new (RIG-1732 T3) | new one-liner | already frozen in T3's set | +| `compact-often` | new (RIG-1732 T3) | new one-liner | already frozen in T3's set | | `hold-your-lane` | wave rule | adapt (**this record**, B2) | merged-or-closed is done; re-ground review/CI/merge-gate references in T9's loop + the human merge gate; **role-aware body (BC-7)** — a hands subagent executes its slice and yields, it does not hold a lane | | `version-control` | wave rule (3 footguns) | fold (**this record**, B1 — DL-142) | keep jj model + auto-amend + additive-fixes + never-`git push`; keep jj-vine as the stacked-PR tool, push path = `jj-vine submit` retargeted to the Compass repo (push-guard mechanism T8's); **B1 ships with or after T8, never before (DL-145)** — no `[TODO T8]` placeholder in an always-apply rule | | `decision-authority` | wave rule | adapt (**this record**, B7) | Matt/`ask`/supervisor → operator (async, home channel) / parent Manager; **role-aware body (BC-7)** — a hands subagent cannot reach the home channel (comms tools are session `customTools`, not forwarded, executor.ts:2829), so its branch escalates forks to the parent Manager | @@ -355,17 +355,17 @@ SEA-1732 already owns the row and this record only confirms it in the bundle. | Skill | Source | Mode | Gated on | | --- | --- | --- | --- | -| `comms-playbook` | authored | SEA-1732 T4 | — (`[TODO SEA-1722]` lines inside) | -| `management-trees` | authored **+ delegated-implementation fold** | SEA-1732 T5 + fold (B6 — DL-141) | — | -| `compass-setup` | authored | SEA-1732 T6 | — | -| `supervisor-channel` | authored | SEA-1732 T7 | — | -| `manager-coordination-channel` | authored | SEA-1732 T7 | — | -| `jj` | wave `jj` skill | adapt, SEA-1732 T8 | — | -| `review` | wave `review` skill (+ `github-pr-review` **and `enumerate-pr-review-surfaces`** folded in) | adapt, SEA-1732 T9 | — | -| `design` | wave `design` skill | adapt, SEA-1732 T9 | — | +| `comms-playbook` | authored | RIG-1732 T4 | — (`[TODO RIG-1722]` lines inside) | +| `management-trees` | authored **+ delegated-implementation fold** | RIG-1732 T5 + fold (B6 — DL-141) | — | +| `compass-setup` | authored | RIG-1732 T6 | — | +| `supervisor-channel` | authored | RIG-1732 T7 | — | +| `manager-coordination-channel` | authored | RIG-1732 T7 | — | +| `jj` | wave `jj` skill | adapt, RIG-1732 T8 | — | +| `review` | wave `review` skill (+ `github-pr-review` **and `enumerate-pr-review-surfaces`** folded in) | adapt, RIG-1732 T9 | — | +| `design` | wave `design` skill | adapt, RIG-1732 T9 | — | | `devenv` | none (new) | new (**this record**, B3) | — | -| `ci-failure-triage` | wave skill | adapt (**this record**, B4) | ships **CI-engine-neutral** (the 4-step classification discipline); GitHub-Actions-specific hooks deferred to the SEA-1739 pack seam (DL-147) | -| `issue-lifecycle` | none (new) | new (**this record**, B5) | **SEA-1734** issue/PR tools | +| `ci-failure-triage` | wave skill | adapt (**this record**, B4) | ships **CI-engine-neutral** (the 4-step classification discipline); GitHub-Actions-specific hooks deferred to the RIG-1739 pack seam (DL-147) | +| `issue-lifecycle` | none (new) | new (**this record**, B5) | **RIG-1734** issue/PR tools | ### Implementer — domain rules (`config/rules/*.md`, rulebook tier) @@ -400,20 +400,20 @@ set (BI-1), and the skills above are deliberately role-neutral in body ### Gates and boundaries -- **SEA-1734** — the issue/PR tools (pre-Dogfood, operator-provisioned - surface). Gates B5 (`issue-lifecycle`) entirely, and the `[TODO SEA-1734]` +- **RIG-1734** — the issue/PR tools (pre-Dogfood, operator-provisioned + surface). Gates B5 (`issue-lifecycle`) entirely, and the `[TODO RIG-1734]` lines inside `own-your-issue`. B5 ships in the same PR that lands the tools or later, never before (BC-3). -- **SEA-1739** — the language-pack mechanism (Beta). Boundary only: nothing in +- **RIG-1739** — the language-pack mechanism (Beta). Boundary only: nothing in this record blocks on it, and no task may smuggle language content past it (BC-4). -- **PR #1089** — the SEA-1732 record. The T3/T4–T9 rows above are owned there; +- **PR #1089** — the RIG-1732 record. The T3/T4–T9 rows above are owned there; this record's tasks (B1–B8) are strictly additive to that set and B6 is an amendment to T5's brief, cross-referenced, not a rewrite. ## Tasks -Impl children that author the skill/rule bodies (mirroring SEA-1732's T4–T9 +Impl children that author the skill/rule bodies (mirroring RIG-1732's T4–T9 granularity: one artifact or one tight pair per review cycle). All are prose-authoring tasks; none touches entrypoint code. @@ -426,7 +426,7 @@ prose-authoring tasks; none touches entrypoint code. is naming the one correct push path, so it cannot ship the `never git push` invariant with only a `[TODO T8]` placeholder where the submit verb goes — the `[TODO T8]` escape hatch is struck. Same BC-3 posture B5 takes with - SEA-1734 ("ships with or after the tools, never before"): T8 names the + RIG-1734 ("ships with or after the tools, never before"): T8 names the Compass submit path first, B1 then writes it in. - [ ] **B2 — `hold-your-lane` always-apply rule.** Interfaces: consumes wave `~/.agents/rules/hold-your-lane.md` + T9's review-loop vocabulary → @@ -434,7 +434,7 @@ prose-authoring tasks; none touches entrypoint code. **Role-aware body (BC-7):** the rule forwards into every implementer subagent (executor.ts:2793), where "done means merged, hold your lane, don't pick up new work" contradicts the hands contract (execute one briefed - slice, report, then yield — SEA-1732 T2). The body MUST branch: "If you are + slice, report, then yield — RIG-1732 T2). The body MUST branch: "If you are a hands subagent: finish the briefed slice, report, and yield — you hold no lane. If you are the Manager: ." @@ -450,7 +450,7 @@ prose-authoring tasks; none touches entrypoint code. two-bucket false-green guard as a general principle. Do NOT hard-code GitHub-Actions log-pull or check-decoding as the default — those GHA-specific hooks are named as the Dogfood grounding that lives in the - SEA-1739 CI pack, not the default battery (same seam shape as a language + RIG-1739 CI pack, not the default battery (same seam shape as a language pack, BC-4). Interfaces: consumes wave `~/.agents/skills/ci-failure-triage/SKILL.md` → produces `config/skills/ci-failure-triage/SKILL.md`. **Cross-ref (BI-2(a) fold — do @@ -459,14 +459,14 @@ prose-authoring tasks; none touches entrypoint code. independent reporting channel, and a red on one is invisible if you read only another, so triage MUST read every surface on the exact head SHA before reporting green (the GitHub-API commit-status-vs-check-runs split - that concretizes this on the Compass forge is SEA-1739 pack detail). -- [ ] **B5 — `issue-lifecycle` skill (new, GATED SEA-1734).** Own an issue + that concretizes this on the Compass forge is RIG-1739 pack detail). +- [ ] **B5 — `issue-lifecycle` skill (new, GATED RIG-1734).** Own an issue end-to-end + the PR review loop on the Compass surface, naming the concrete - SEA-1734 tools. Interfaces: consumes the SEA-1734 tool surface (as landed) + + RIG-1734 tools. Interfaces: consumes the RIG-1734 tool surface (as landed) + the Manager block-0 work-loop lines → produces `config/skills/issue-lifecycle/SKILL.md`. Ships with or after the tools, never before (BC-3). -- [ ] **B6 — T5 management-trees fold (DL-141, cross-ref SEA-1732 T5).** Fold +- [ ] **B6 — T5 management-trees fold (DL-141, cross-ref RIG-1732 T5).** Fold the when-to-delegate litmus, review-every-diff discipline, and brief contract into T5's delegation-mechanics section; strip OMP tier naming (`implement`/`implement-hard`/thinking levels → the `task` mechanism + @@ -519,7 +519,7 @@ recommendation; the record is designed against the recommendation. two of these rules are not merely a token cost, they are actively WRONG on a subagent. `hold-your-lane` ("done means merged … hold your lane … don't pick up new work") contradicts the implementer's frozen hands contract - (execute one briefed slice, report, then yield — SEA-1732 T2); + (execute one briefed slice, report, then yield — RIG-1732 T2); `decision-authority` routes a design fork to the operator "on the home channel" — a channel the subagent mechanically CANNOT reach, because the comms native tools are session `customTools` and those are exactly what @@ -528,7 +528,7 @@ recommendation; the record is designed against the recommendation. fork): every forwarded always-apply rule is authored ROLE-AWARE (BC-7) — its body is correct for both roles, branching explicitly where behavior differs, so an implementer reads the branch written for it. Per-role rule *bucketing* - (delivering different rule sets per role) remains the SEA-1724 seam and is + (delivering different rule sets per role) remains the RIG-1724 seam and is not built early; role-awareness lives in the authored body instead.** 2. **Name of the footguns rule: keep `version-control` vs rename `version-control-footguns` — RESOLVED (Matt, 2026-08-05):** keep diff --git a/docs/designs/product/compass-board-view/design.md b/docs/designs/product/compass-board-view/design.md index 30b9c4585..0578e697b 100644 --- a/docs/designs/product/compass-board-view/design.md +++ b/docs/designs/product/compass-board-view/design.md @@ -2,7 +2,7 @@ Status: Active -Tracker: SEA-1633. +Tracker: RIG-1633. Ledger: this record's PR appends DL-097 to `docs/designs/product/DECISIONS.md` in the same diff (see §Ledger delta) and diff --git a/docs/designs/product/compass-bridge-reclothe/design.md b/docs/designs/product/compass-bridge-reclothe/design.md index ccde4dbf1..8ab85acaf 100644 --- a/docs/designs/product/compass-bridge-reclothe/design.md +++ b/docs/designs/product/compass-bridge-reclothe/design.md @@ -1,16 +1,16 @@ -# Design: Compass Bridge re-clothe (SEA-2111) +# Design: Compass Bridge re-clothe (RIG-2111) Status: Active Owner lane: compass-ux (design) → compass-ui (execution) -Refs: SEA-2111 (live board doesn't match the company-site reference render); -after the SEA-2034 DS-token cutover (merged, main `18e988b5`). Two adjacent +Refs: RIG-2111 (live board doesn't match the company-site reference render); +after the RIG-2034 DS-token cutover (merged, main `18e988b5`). Two adjacent concerns are split into their own lanes/PRs, not folded here: the state-dot -pixel-art glyph adoption → SEA-2118 (mechanical frozen-spec adoption, global -across surfaces); review/CI badge semantic clarity → SEA-2117 (its own design +pixel-art glyph adoption → RIG-2118 (mechanical frozen-spec adoption, global +across surfaces); review/CI badge semantic clarity → RIG-2117 (its own design pass — see T4). This record is the board-structure re-clothe and ships on the current state-dots. Governing spec: `apps/ui/src/design/surfaces.md` §"Bridge — the Issues and PRs -board" (L196–268, frozen T6/SEA-1816) +board" (L196–268, frozen T6/RIG-1816) Reference render: the canonical Rigel company-site board reference render (the brand reference for this surface — see [`docs/specs/brand/surfaces.md`](../../../specs/brand/surfaces.md) §"The board @@ -52,10 +52,10 @@ Every task below inherits these; none restates them. motion.md's primitive list — it ships as a dormant hook (T5, Decision D2), not a coined token. - **State-dots and badge-clarity are OUT of this lane.** The state-dot - pixel-art glyph adoption is SEA-2118 (its own global PR — Matt ruled the + pixel-art glyph adoption is RIG-2118 (its own global PR — Matt ruled the glyphs ship at 9px; grounded blast radius is 5 files + the `.r-tab` overlay, too wide to fold into a board-scoped PR). The review/CI badge semantic-clarity - redesign is SEA-2117 (its own design pass); T4 here recolors the existing + redesign is RIG-2117 (its own design pass); T4 here recolors the existing badges onto the semantic tier and consumes whatever badge FORM that design freezes. The board keeps today's `StateDot` unchanged; no `.state-dot` rule is touched here. @@ -105,19 +105,19 @@ written against them. motion tokens only; wired to no data until a real source lands. The motion-spec addition routes to D9/foundation-T8, the data field to the store lane. -- **D3 — CI/review badges: recolor onto the semantic tier; FORM per SEA-2117.** +- **D3 — CI/review badges: recolor onto the semantic tier; FORM per RIG-2117.** T4 re-points the badges from the raw `--cx-ok/error/warn` they use today onto the dedicated `--cx-ci-*`/`--cx-review-*` tier, and adopts whatever badge - form the SEA-2117 badge-clarity design freezes (pixel-art 1-bit glyphs + form the RIG-2117 badge-clarity design freezes (pixel-art 1-bit glyphs leading). The `.cx-badge` naming in `surfaces.md` is the token/vocabulary contract, not a labelled-DOM-box mandate. The live `commented` verdict maps - to `--cx-review-pending`. If SEA-2117 has not frozen by the time T4 runs, T4 + to `--cx-review-pending`. If RIG-2117 has not frozen by the time T4 runs, T4 ships the interim compact recolored pip and the glyph form lands as a fast follow — T4 does not block on it. - **D4 — roving-tabindex 2-D keyboard grid is OUT of scope** (was OQ-5): filed as a follow-up interaction issue at dispatch; this record changes only the clothing, not the keyboard model. -- **D5 — state-dot glyph adoption is a separate lane** (SEA-2118, see Global +- **D5 — state-dot glyph adoption is a separate lane** (RIG-2118, see Global Constraints); the board ships on the current `StateDot`. ## Approach @@ -195,7 +195,7 @@ field. Reference (the company-site board reference render, its rows cited below) vs live, each row mapped to the live file+line it changes and the token it lands on. Live line numbers at main `18e988b5`. (The former G9 state-dot row is removed — it is its own lane, -SEA-2118.) +RIG-2118.) | # | Reference has | Live has | Live change site | Token(s) | | --- | --- | --- | --- | --- | @@ -218,7 +218,7 @@ affordances): the `N agents · M in-flight` toolbar sub (`Bridge.tsx:140-142`), the Swimlanes/Status grouping toggle (`Bridge.tsx:160-175`), the gutter's `N items` meta + `→` open affordance (`Bridge.tsx:236-242`), the lane-head counts (`Bridge.tsx:193`), PR-chip and issue-chip cross-links, selection sync, -the current `StateDot` (untouched here — its glyph adoption is SEA-2118). +the current `StateDot` (untouched here — its glyph adoption is RIG-2118). ## Plan @@ -306,19 +306,19 @@ onto the `--cx-review-pending` color (D3). All three consumer sites (`Bridge.tsx:61,64`, `IssueCard.tsx:79,83`, `DoneView.tsx:37,41`) share the rules, so one edit covers them. -**Badge FORM per SEA-2117 (D3).** The badge-clarity design (SEA-2117, pixel-art +**Badge FORM per RIG-2117 (D3).** The badge-clarity design (RIG-2117, pixel-art 1-bit glyphs leading) owns what the badge *looks like*; T4 consumes that frozen -form. If SEA-2117 is frozen when T4 runs, T4 renders the chosen glyph/pip form +form. If RIG-2117 is frozen when T4 runs, T4 renders the chosen glyph/pip form (a `BadgeGlyph`-style inline SVG mirrors the state-dot emission contract and the -consumer sites flip from bare `` to the component). If SEA-2117 has NOT +consumer sites flip from bare `` to the component). If RIG-2117 has NOT frozen, T4 ships the interim compact square pip recolored onto the tier (7px, no radius — the reference render) and the glyph form lands as a fast follow — T4 -does not block on SEA-2117. +does not block on RIG-2117. Interfaces: consumes `ciBadge(pr): "pending" | "success" | "failure" | undefined` (`board-render.ts:119-121`) and `reviewBadge(pr): "changes" | "approved" | "commented" | undefined` (`board-render.ts:102-112`) unchanged; -produces the recolor + the SEA-2117 form (or interim pip). Test cycle: +produces the recolor + the RIG-2117 form (or interim pip). Test cycle: `Bridge.test.tsx:145-148` badge-presence assertions stay green; stylelint; harness. @@ -424,10 +424,10 @@ verified rather than vacuously green (G11). - **Roving-tabindex 2-D grid** (`surfaces.md:236-239,264-265` flip item 6) — a keyboard/interaction change, not clothing; filed as a follow-up issue at dispatch time (D4). -- **State-dot 1-bit glyph adoption** — its own lane, SEA-2118 (D5); the board +- **State-dot 1-bit glyph adoption** — its own lane, RIG-2118 (D5); the board ships on the current `StateDot`. -- **Review/CI badge form redesign** — its own design lane, SEA-2117 (D3); T4 - recolors onto the tier and consumes the badge form SEA-2117 freezes. +- **Review/CI badge form redesign** — its own design lane, RIG-2117 (D3); T4 + recolors onto the tier and consumes the badge form RIG-2117 freezes. - **Motion primitive spec authorship** — D9/foundation-T8 owns adding a card-advance topology to `motion.md`; T5 here only consumes tokens (D2). - **Merged-column retention windowing** — server-side / store lane (D1b); the diff --git a/docs/designs/product/compass-dev-boot-gate/design.md b/docs/designs/product/compass-dev-boot-gate/design.md index 436ebdac8..2650138be 100644 --- a/docs/designs/product/compass-dev-boot-gate/design.md +++ b/docs/designs/product/compass-dev-boot-gate/design.md @@ -206,7 +206,7 @@ dev server" check becomes a task. (`package.json:8`). Zero new dependencies; the gate is one spec file plus a moon task. - **`puppeteer-core` (the issue's proposal, rejected).** RIG-1536 predates the - repo's Playwright adoption (SEA-2034 T1); its claim "Chromium and + repo's Playwright adoption (RIG-2034 T1); its claim "Chromium and `puppeteer-core` are already in the environment" no longer describes the repo — `puppeteer-core` is not in `package.json` (its devDependencies are fully listed at `package.json:27-43`; no puppeteer entry), and diff --git a/docs/designs/product/compass-ds-token-cutover/design.md b/docs/designs/product/compass-ds-token-cutover/design.md index 054c135ee..a794629ba 100644 --- a/docs/designs/product/compass-ds-token-cutover/design.md +++ b/docs/designs/product/compass-ds-token-cutover/design.md @@ -1,7 +1,7 @@ # Design: Compass DS Token Full Cutover + Canvas Migration Status: Draft -Supersedes: the incremental/strangler framing of SEA-1876 (component-tier follow-up to PR #220) +Supersedes: the incremental/strangler framing of RIG-1876 (component-tier follow-up to PR #220) Owner lane: compass-ui · DS-tier owner: compass-ux (D2, `compass-ux-foundation/design.md`) ## Problem / Intent @@ -10,7 +10,7 @@ Compass has two parallel token tiers: the DS `--cx-*` semantic tier (`apps/ui/src/design/tokens.css`, merged) and a legacy GitHub-dark `:root` tier at the top of `apps/ui/src/app.css` (lines 7-58: `--bg: #0a0d12`, `--text`, `--st-*`, `--purple`, `--accent`, …) that ~540 `var()` references still -consume. The strangler plan (D10/DL-157, refined by SEA-1876) kept both tiers +consume. The strangler plan (D10/DL-157, refined by RIG-1876) kept both tiers alive and migrated surface by surface. Matt's ruling (2026-08-07): *"why do we have 'legacy' refs in a codebase that hasn't even been dogfooded yet?"* — a pre-dogfood codebase has no live users to protect, so the strangler frame is @@ -206,7 +206,7 @@ silent decision hides, but not batched to Matt as forks: ### Alternatives considered -**The incremental strangler (SEA-1876's original frame, D10/DL-157).** Keep +**The incremental strangler (RIG-1876's original frame, D10/DL-157).** Keep both tiers; flip surface-by-surface (content, board, composer, settings) over several PRs; retire the legacy `:root` last. Rejected: the strangler's whole value is protecting a live system's users from a big-bang restyle, and diff --git a/docs/designs/product/compass-first-turn-delivery/design.md b/docs/designs/product/compass-first-turn-delivery/design.md index b9edbab13..8fffa52f9 100644 --- a/docs/designs/product/compass-first-turn-delivery/design.md +++ b/docs/designs/product/compass-first-turn-delivery/design.md @@ -14,7 +14,7 @@ file), so every prompt riding the field is silently dropped and the agent idles forever. Matt has ruled the field out of existence: **remove `initial_prompt` from everything; an agent session always starts idle; its first turn arrives through its channel.** This record designs the removal and -the channel-first-turn model, and is what unblocks SEA-1792 H8 / PR #256 +the channel-first-turn model, and is what unblocks RIG-1792 H8 / PR #256 (dogfood e2e `TestLegTwoRealTurn` is red today precisely because its first turn rides the dropped field). @@ -292,7 +292,7 @@ a **reserved `@compass` system-sender alias**. Rationale for the split: dependency on — and no blocker for — the `initial_prompt` removal: nothing boots a root manager through `initial_prompt` today, so removing the field strands no existing case-1 path. -- Case 2 + the harness re-model unblock SEA-1792 H8 now; coupling them to the +- Case 2 + the harness re-model unblock RIG-1792 H8 now; coupling them to the system-sender design would serialize an unrelated, larger decision in front of a red CI gate. @@ -379,7 +379,7 @@ already live (`go/internal/runnerhub/dispatch_control.go:44-53`; `go/internal/runner/gateway/control.go:192-203` `representable()` currently returns `false` for `AgentControl_Deliver` and `AgentControl_Steer`. Both now -carry a comms `Message` (SEA-1569 populated the parked shells), so they ARE +carry a comms `Message` (RIG-1569 populated the parked shells), so they ARE representable — remove them from the reject set (leaving Replay/Config, still empty shells). Without this the send from T-R1 is dropped before it reaches the socket. @@ -508,7 +508,7 @@ Interfaces: action directly with `SpawnSpec` (`{agentAccountId, workstreamId}`; spawn is already guarded by the DL-164/168 live-session predicate and idempotent under its request id). This amends DL-185's "Kept: `StartAgentDialog`" clause — the - one status-flip, ordered after #267/SEA-1932 merges (see below). + one status-flip, ordered after #267/RIG-1932 merges (see below). - `apps/ui/src/spawn.test.ts:24,38,60,65-67,177,183` — drop prompt fixtures; the two `bindingDotState` running-arm cases collapse to one (`running` → `"idle"`). @@ -516,7 +516,7 @@ Interfaces: no-lifecycle-fields assert; update its comment (there is no prompt field anywhere anymore). -### T6 — e2e harness re-model onto the channel first-turn seam (lane: implement-hard, Go e2e) — unblocks SEA-1792 H8 / PR #256 +### T6 — e2e harness re-model onto the channel first-turn seam (lane: implement-hard, Go e2e) — unblocks RIG-1792 H8 / PR #256 Interfaces: @@ -550,15 +550,15 @@ Interfaces: The driver lands the ledger rows below in the same PR (`design-ledger-gate`), sets this record's `Status:` header on merge. The -case-1 follow-up is already tracked as **SEA-1820** ("Auto-seed root Manager -'supervisor' on embedded first-launch (dogfood)", parent SEA-1681) — updated +case-1 follow-up is already tracked as **RIG-1820** ("Auto-seed root Manager +'supervisor' on embedded first-launch (dogfood)", parent RIG-1681) — updated with the thread+sender specifics (Compass-authored Setup thread in the root manager's home channel; `@compass` reserved-alias system sender; no -`initial_prompt`). This record references SEA-1820 as the case-1 follow-up; it +`initial_prompt`). This record references RIG-1820 as the case-1 follow-up; it files no new issue. Exact `docs/designs/product/DECISIONS.md` delta (append under a new -`## First-turn delivery` section; DL-185 already landed on `main` (the SEA-1932 +`## First-turn delivery` section; DL-185 already landed on `main` (the RIG-1932 add-surface drop), so the highest row is now DL-185 and these are DL-186..189): ```markdown @@ -566,13 +566,13 @@ add-surface drop), so the highest row is now DL-185 and these are DL-186..189): | ID | Decision | Status | Record | | --- | --- | --- | --- | -| DL-186 | `initial_prompt` is REMOVED from the whole contract (`StartAgentSessionRequest` field 2, `SpawnAgentRequest` field 2, `SpawnPeerRequest` field 3 — numbers AND names reserved; server/runner/SDK/UI/e2e consumers cut over atomically, no fallback): an agent session ALWAYS starts idle and its first turn arrives as a channel message over the SEA-1569 deliver path (`DeliverControl` → the idle-deliver arm starts a turn); a provisioned peer's brief is a post from its provisioning manager into their per-pair DM channel (home channel for human owners) | Active (Matt, 2026-08-10) | [first-turn delivery §Approach](compass-first-turn-delivery/design.md#approach) | -| DL-187 | The `@compass` reserved alias is FROZEN as the system-sender mechanism for ANY system-level message sender (not just the root-manager Setup thread), requiring reserved-handle validation at account creation; case-1 root-manager boot (a Compass-authored initial Setup thread in the manager's home channel) uses it and is scoped OUT to follow-up SEA-1820, which owes only the sender representation + Setup flow; ratified in shape here so the interim can never revive a prompt field | Active (Matt, 2026-08-10) | [first-turn delivery §Case 1](compass-first-turn-delivery/design.md#case-1--root-manager-boot-scoped-out-to-a-follow-up-record) | +| DL-186 | `initial_prompt` is REMOVED from the whole contract (`StartAgentSessionRequest` field 2, `SpawnAgentRequest` field 2, `SpawnPeerRequest` field 3 — numbers AND names reserved; server/runner/SDK/UI/e2e consumers cut over atomically, no fallback): an agent session ALWAYS starts idle and its first turn arrives as a channel message over the RIG-1569 deliver path (`DeliverControl` → the idle-deliver arm starts a turn); a provisioned peer's brief is a post from its provisioning manager into their per-pair DM channel (home channel for human owners) | Active (Matt, 2026-08-10) | [first-turn delivery §Approach](compass-first-turn-delivery/design.md#approach) | +| DL-187 | The `@compass` reserved alias is FROZEN as the system-sender mechanism for ANY system-level message sender (not just the root-manager Setup thread), requiring reserved-handle validation at account creation; case-1 root-manager boot (a Compass-authored initial Setup thread in the manager's home channel) uses it and is scoped OUT to follow-up RIG-1820, which owes only the sender representation + Setup flow; ratified in shape here so the interim can never revive a prompt field | Active (Matt, 2026-08-10) | [first-turn delivery §Case 1](compass-first-turn-delivery/design.md#case-1--root-manager-boot-scoped-out-to-a-follow-up-record) | | DL-188 | Fresh-start barrier-lift: on a FRESH (non-resume) start the Runner sends `AgentControl{replay_complete}` as the first control op after Bind (seq 1, FIFO-first, drains before any deliver) — one mechanism symmetric with the resume path, no agent change; lifts the agent-side replay barrier so the first case-2 deliver is not refused-and-stranded (T-R3) | Active (Matt, 2026-08-10) | [first-turn delivery §the seam](compass-first-turn-delivery/design.md#the-seam-the-first-turn-rides-case-2--the-server--agent-halves-exist-the-runner-middle-leg-is-unbuilt) | | DL-189 | The case-2 brief carrier is a PER-PAIR manager↔peer DM channel (`ChannelKindDM`, 2 members: spawning manager + new peer, both owners carried by `expandOwnerMembership` so the operator retains visibility), auto-provisioned on the spawn edge (T-R0) — NOT the manager's coordination channel, which is a broadcast to all reports. Token-minimization: siblings do not receive briefs they don't need. UI channel-proliferation UX is a known deferred problem | Active (Matt, 2026-08-10) | [first-turn delivery §Approach](compass-first-turn-delivery/design.md#approach) | ``` -Note for the driver: DL-186's "first turn arrives over the SEA-1569 deliver +Note for the driver: DL-186's "first turn arrives over the RIG-1569 deliver path" is a DECISION, but the path's Runner middle leg (and the T-R0 DM auto-provision) is unbuilt today — PR-A (T-R0/T-R1/T-R2/T-R3) builds it. Do NOT land DL-186 as "verified end-to-end": the Runner leg is PR-A, not yet exercised. @@ -581,11 +581,11 @@ land DL-186 as "verified end-to-end": the Runner leg is PR-A, not yet exercised. `initial_prompt`, start-idle semantics, or first-turn carriage (verified: `DECISIONS.md` has no occurrence of "initial" or "prompt" in any Decision cell bearing on the prompt field; DL-166/DL-164 rule the composite-spawn and -start-affordance shapes without it). **DL-185 (SEA-1932, Active) explicitly +start-affordance shapes without it). **DL-185 (RIG-1932, Active) explicitly KEEPS `StartAgentDialog`** as the human's only start affordance — so T5's **deletion** of that dialog (OQ-1, Matt-ruled delete at this design-PR gate) amends DL-185's "Kept" clause. That amendment is NOT applied in this record: T5 -lands it in PR-B, ordered after #267/SEA-1932 merges so the "Kept" clause exists +lands it in PR-B, ordered after #267/RIG-1932 merges so the "Kept" clause exists to be amended. The driver records the flip on DL-185 in the design-ledger-gate PR at that point, not here. @@ -631,24 +631,24 @@ PR-B (atomic removal + harness re-model — greens leg-2, lands after PR-A): - [ ] T2 — server: drop `InitialPrompt` at `lifecycle.go:325` and `spawn.go:135` + pgtest fixtures (implement) - [ ] T3 — runner: compile against regenerated types; gateway fixture cleanup (no production change beyond PR-A's deliver-lane, which T-R1/T-R2 already landed) (implement) - [ ] T4 — agent SDK: spawn tool loses `initial_prompt?`; tests updated (drop the JSON key as hygiene; NO unknown-key reject assert — see arktype note) (implement) -- [ ] T5 — UI: promptless `SpawnSpec`/binding, `running`→`idle` dot, delete `StartAgentDialog` + test (OQ-1 Matt-ruled delete; board start affordance calls the spawn action directly; amends DL-185's "Kept" clause after #267/SEA-1932 merges) (implement) -- [ ] T6 — e2e harness re-model: promptless Start/Resume, home-channel `PostMessage` first turn, split into `OpenSessionTail`(before post) + `AwaitTurnSettled`(WORKING→READY), leg-2/leg-3-4 scenario updates (implement-hard; unblocks SEA-1792 H8 / PR #256) -- [ ] T7 — ledger rows DL-186/DL-187/DL-188/DL-189 + `Status:` header; references case-1 follow-up SEA-1820 (no new issue filed) (driver) +- [ ] T5 — UI: promptless `SpawnSpec`/binding, `running`→`idle` dot, delete `StartAgentDialog` + test (OQ-1 Matt-ruled delete; board start affordance calls the spawn action directly; amends DL-185's "Kept" clause after #267/RIG-1932 merges) (implement) +- [ ] T6 — e2e harness re-model: promptless Start/Resume, home-channel `PostMessage` first turn, split into `OpenSessionTail`(before post) + `AwaitTurnSettled`(WORKING→READY), leg-2/leg-3-4 scenario updates (implement-hard; unblocks RIG-1792 H8 / PR #256) +- [ ] T7 — ledger rows DL-186/DL-187/DL-188/DL-189 + `Status:` header; references case-1 follow-up RIG-1820 (no new issue filed) (driver) ## Open Questions All five design-fork OQs are resolved. The four load-bearing ones (case-1 scope, deliver-lane carrier, barrier-lift mechanism, system-sender freeze) are -Matt-ruled and folded above (DL-186..189 + SEA-1820). OQ-1 (`StartAgentDialog` +Matt-ruled and folded above (DL-186..189 + RIG-1820). OQ-1 (`StartAgentDialog` disposition) is Matt-ruled at this design-PR gate: 1. **`StartAgentDialog` disposition — RULED: delete (Matt, design-PR gate).** Removing `initial_prompt` empties this dialog (its only input was the prompt - textarea). DL-185 (SEA-1932, Active) explicitly KEEPS it, so this was a fork, + textarea). DL-185 (RIG-1932, Active) explicitly KEEPS it, so this was a fork, not a driver call. Matt ruled **delete**: the board start affordance invokes the spawn action directly with `{agentAccountId, workstreamId}` (spawn is already guarded by the DL-164/168 live-session predicate and idempotent under - its request id). T5 lands the deletion in PR-B, ordered after #267/SEA-1932 + its request id). T5 lands the deletion in PR-B, ordered after #267/RIG-1932 merges; it amends DL-185's "Kept" clause (the one status-flip above). (Ground check at ruling time: `StartAgentDialog.tsx` + `.test.tsx` still present on `main@origin`; no open PR removes them — the deletion is this diff --git a/docs/designs/product/compass-forge-agent-notification/design.md b/docs/designs/product/compass-forge-agent-notification/design.md index 21a714fb9..29320ed8e 100644 --- a/docs/designs/product/compass-forge-agent-notification/design.md +++ b/docs/designs/product/compass-forge-agent-notification/design.md @@ -64,7 +64,7 @@ premise has since dissolved: the compass-server network TLS door (mounted beside the Connect mounts in `buildNetworkServer`, `go/server/network_door.go:233-333`), raw-body HMAC-SHA256 fail-closed, ack-200-fast / work-async, inheriting the - G112/SEA-1298 body-read guards. The CODE is unlanded: the RIG-2717 + G112/RIG-1298 body-read guards. The CODE is unlanded: the RIG-2717 implementation stack (PRs #637-639 = its T1/T2/T3/T3a/T5) ships the verifiers and the `--public-url` / `$COMPASS_PUBLIC_URL` config (RIG-2717 T5, `compass-linear-agent-responder/design.md:728-734`) but @@ -200,7 +200,7 @@ See Resolved decisions (W1). Two mounts on the same network TLS door, sharing the RIG-2717 shape (fail-closed raw-body HMAC, ack-200-fast / work-async, bounded body, -G112/SEA-1298 inherited): +G112/RIG-1298 inherited): - **`POST /webhooks/github`** — NEW sibling mount beside the Connect mounts (`network_door.go:270-277`). GitHub signs with `X-Hub-Signature-256` diff --git a/docs/designs/product/compass-forge-poll-driver/design.md b/docs/designs/product/compass-forge-poll-driver/design.md index 5c911bb9c..5ff0a31bf 100644 --- a/docs/designs/product/compass-forge-poll-driver/design.md +++ b/docs/designs/product/compass-forge-poll-driver/design.md @@ -1,4 +1,4 @@ -# Compass forge-poll driver (SEA-1810) +# Compass forge-poll driver (RIG-1810) Status: Active Lane: compass-server @@ -84,7 +84,7 @@ no convergence refactor ever needed. (new, this record). A future reader maps `agent_forge_subscriptions` back to DL-053's `forge_subscriptions`. The rename is recorded in the ledger as DL-163 (rides THIS PR); the paired one-line forward annotation at the frozen - ownership-layer DDL is deferred to SEA-1883 (editing a frozen record needs + ownership-layer DDL is deferred to RIG-1883 (editing a frozen record needs Matt's call — see Open Questions → OQ-C). - **Provider domain `IN (1, 2, 3, 4)` on every 0015 table (OQ-D2, Matt 2026-08-08):** the proto enum already declares all four providers — @@ -179,7 +179,7 @@ DL-053's subscription model is **per-artifact**: "An agent subscribes to a *forge artifact*: an issue or a PR, named by `(provider, repo, kind, number)`" (`compass-server-ownership-layer/design.md:944-945`), and the FETCH cursor table is keyed the same way (`:1007-1019`, `PRIMARY KEY (provider, repo, kind, -number)`). SEA-1810's board ingestion is **per-repo LIST**: fetch every issue +number)`). RIG-1810's board ingestion is **per-repo LIST**: fetch every issue in a repo in one paginated `/issues?state=all` walk (`Ingester.Ingest` "fetches every issue for repo", `ingest.go:48`) and sink each. A list-page ETag is a caching fact about a URL (repo + filter + page), not about any one @@ -1151,7 +1151,7 @@ adapter over the open Interfaces: ```go -// server.ForgeConfig configures the board-ingestion poll driver (SEA-1810). +// server.ForgeConfig configures the board-ingestion poll driver (RIG-1810). // All-optional: polling disabled (empty SeedRepos, Poll false) leaves the // driver off (today's behavior). type ForgeConfig struct { @@ -1342,7 +1342,7 @@ Resolution, as applied through this record: `agent_forge_subscriptions`; see compass-forge-poll-driver" — so a reader entering from the frozen ownership-layer record who greps `forge_subscriptions` finds the mapping instead of nothing. Half (b) is - DEFERRED to SEA-1883, not folded here: it edits a frozen Active record, + DEFERRED to RIG-1883, not folded here: it edits a frozen Active record, which needs Matt's explicit call (flagged in OQ-C for his ratification at this design-PR review). This PR's ledger delta is DL-161/DL-162/DL-163 in DECISIONS.md. @@ -1392,7 +1392,7 @@ no CHECK-widening migration on any of them. The `issues` table's own ### OQ-E (out of scope — the Linear-ingestion prerequisite; follow-up filed by the driver) -SEA-1810's new tables are Linear-ready (their CHECKs admit 4), but actually +RIG-1810's new tables are Linear-ready (their CHECKs admit 4), but actually INGESTING Linear issues has three prerequisites, ALL out of scope for this GitHub-read slice and belonging to the future Linear-ingestion slice: @@ -1418,7 +1418,7 @@ Why the asymmetry (`issues` CHECK deferred in SQL, Go domain closed now) is deliberate: the Go constant `store.ForgeProviderLinear = 4` is required THIS slice because 0015's own store methods must be able to name domain value 4 (the four new tables' CHECKs admit it), while the `issues` CHECK guards a -table SEA-1810 never writes with provider=4 (the driver is bound to GITHUB; +table RIG-1810 never writes with provider=4 (the driver is bound to GITHUB; no Linear producer exists in the tree) — and widening a guard ahead of its producer would weaken 0013's "every issue is forge-backed" documentation, so the widening correctly waits for the Linear producer. This deferral is @@ -1429,6 +1429,6 @@ author-resolved pending Matt's review: he may tie-break to fold the Whether the dogfood demo shows LIVE GitHub issues — which would make this driver demo-critical and re-sequence its priority — is a later Matt scope -call per the SEA-1810 issue body's own escalation trip-wire. Recorded as an +call per the RIG-1810 issue body's own escalation trip-wire. Recorded as an explicitly non-load-bearing deferral: the design is correct regardless of the ruling; only scheduling changes. diff --git a/docs/designs/product/compass-handle-addressing-cutover/design.md b/docs/designs/product/compass-handle-addressing-cutover/design.md index c575efb7d..d62eddaa4 100644 --- a/docs/designs/product/compass-handle-addressing-cutover/design.md +++ b/docs/designs/product/compass-handle-addressing-cutover/design.md @@ -331,7 +331,7 @@ OQ-4 EXTEND, 2026-08-27) — inventory rows 14–16. every flipped field with its resolution semantics (mirror the `from_handle` comments, `agent.proto:194-199`). - **Pre-GA breaking allowance**: the buf breaking gate is removed pre-dogfood - (`proto/moon.yml:169` — "RE-ADD AT GA", SEA-1922/SEA-1951; RIG-2675). A + (`proto/moon.yml:169` — "RE-ADD AT GA", RIG-1922/RIG-1951; RIG-2675). A breaking rename is allowed and this record uses it; DL-186 (`docs/designs/DECISIONS.md:203`, Active) rules rename-in-place keeping field numbers — renumber+reserve would re-add `reserved` markers DL-186 diff --git a/docs/designs/product/compass-issue-model/design.md b/docs/designs/product/compass-issue-model/design.md index 91718fed2..427f280b0 100644 --- a/docs/designs/product/compass-issue-model/design.md +++ b/docs/designs/product/compass-issue-model/design.md @@ -245,7 +245,7 @@ message ChangedStats { // the fixture's TrackerRef (stub-data.ts:113-120). message TrackerRef { string kind = 1; // "linear" | "jira" | "github" — the tracker family - string id = 2; // the tracker's native issue id, e.g. "SEA-1042" + string id = 2; // the tracker's native issue id, e.g. "RIG-1042" string status = 3; // the tracker's native status name in the user's org string url = 4; } @@ -700,7 +700,7 @@ separate field (`forge_account`), which the `verified` cross-check reads. - **Card issue key.** Every board item is forge-backed, so the card key (`card-issue`, WorkstreamCard.tsx:25, currently the bare `ws.issue` string) becomes the tracker id when linked (`tracker.id`, rendered in the tracker's - native form — e.g. `SEA-1042`, not `SEA#1042`), else the forge coordinate. + native form — e.g. `RIG-1042`, not `SEA#1042`), else the forge coordinate. The coordinate is `${repo}#${number}` in the single-forge common case, but qualifies with the `ForgeRef` host — `${host}/${repo}#${number}` — when the board holds artifacts from more than one `ForgeRef`, so the DL-091 diff --git a/docs/designs/product/compass-linear-agent-responder/design.md b/docs/designs/product/compass-linear-agent-responder/design.md index 4cbc21e81..6dda9f47f 100644 --- a/docs/designs/product/compass-linear-agent-responder/design.md +++ b/docs/designs/product/compass-linear-agent-responder/design.md @@ -117,7 +117,7 @@ hardening a public receiver needs. `buildNetworkServer` http.NewServeMux()` (`network_door.go:270`) and mounts the Connect handlers on it (`netMux.Handle(netPath, netHandler)`, `network_door.go:271`); the whole mux is wrapped by the slow-body guard — "Outermost: bound the request-body read so -a slow-body drip cannot tie up a connection (SEA-1298)" +a slow-body drip cannot tie up a connection (RIG-1298)" (`network_door.go:306-310`) — and the server sets `ReadHeaderTimeout: 10 * time.Second` with the comment "G112: the network door is the internet-facing surface" (`network_door.go:315-323`). @@ -473,7 +473,7 @@ routing), the comms handler (PostAsAccount), and the secrets resolver — so a separate service would need its own authenticated channel back into compass-server carrying exactly the same data, doubling the surface instead of shrinking it. The network door already exists as the hardened internet-facing -surface (TLS, `ReadHeaderTimeout` G112, `withBodyReadDeadline` SEA-1298, +surface (TLS, `ReadHeaderTimeout` G112, `withBodyReadDeadline` RIG-1298, `network_door.go:306-323`). (Matt confirmed reuse of the network door, RIG-2729 OQ-2.) @@ -534,7 +534,7 @@ the Linear loop needs and a bespoke injection would have to rebuild. never-resolved → 503, never accept). A STALE `webhookTimestamp` on a valid signature is 200-with-drop (ack + discard), never 400 — no retry burn on a replayed signed body. The mount inherits - `withBodyReadDeadline` + `ReadHeaderTimeout` (G112/SEA-1298, + `withBodyReadDeadline` + `ReadHeaderTimeout` (G112/RIG-1298, `network_door.go:306-323`); additionally cap the webhook body read with `http.MaxBytesReader` (1 MiB) — webhook payloads are small. - Constant-time signature compare (`crypto/hmac.Equal`), raw-body HMAC (never @@ -976,7 +976,7 @@ Proposed rows: | ID | Decision | Status | Record | | --- | --- | --- | --- | -| DL-254 | The Linear Agent Session responder is a plain `POST /webhooks` `http.Handler` mounted on the compass-server network TLS door (inside `buildNetworkServer`, beside the Connect mounts, inheriting the G112/SEA-1298 guards; NOT a Connect service, NOT a dedicated ingress), fail-closed on the raw-body HMAC-SHA256 `Linear-Signature` check (bad/missing signature → 400; a stale-but-validly-signed `webhookTimestamp` is 200-with-drop, never a retry-burning 400), acking 200 before any work (Linear's 5s SLA) with all agent work async; the public base URL (webhook host + deep-link base) is a per-deployment config value, never hardcoded | Active (Matt, YYYY-MM-DD) | [linear agent responder §Part 1](product/compass-linear-agent-responder/design.md#part-1--the-webhook-receiver-on-the-network-door) | +| DL-254 | The Linear Agent Session responder is a plain `POST /webhooks` `http.Handler` mounted on the compass-server network TLS door (inside `buildNetworkServer`, beside the Connect mounts, inheriting the G112/RIG-1298 guards; NOT a Connect service, NOT a dedicated ingress), fail-closed on the raw-body HMAC-SHA256 `Linear-Signature` check (bad/missing signature → 400; a stale-but-validly-signed `webhookTimestamp` is 200-with-drop, never a retry-burning 400), acking 200 before any work (Linear's 5s SLA) with all agent work async; the public base URL (webhook host + deep-link base) is a per-deployment config value, never hardcoded | Active (Matt, YYYY-MM-DD) | [linear agent responder §Part 1](product/compass-linear-agent-responder/design.md#part-1--the-webhook-receiver-on-the-network-door) | | DL-255 | A delegated Linear session is routed to a stable Compass Manager keyed on Compass's recorded forge ownership index (`forge_authored_artifacts`, DL-055/DL-205) — NEVER a header parsed from forge text (DL-050/DL-094 forbid it reaching a routing decision); an issue with no recorded ownership row routes to the supervisor/top-level Manager via a dedicated routing channel, which decides the lane and stamps it through the DL-050 write chokepoint so later events resolve directly | Active (Matt, YYYY-MM-DD) | [linear agent responder §Part 2](product/compass-linear-agent-responder/design.md#part-2--routing-a-delegated-linear-session-to-a-stable-manager) | | DL-256 | The Linear return path is a dumb link (Option B, Matt 2026-08-25): on `created` the responder emits one `thought` plus an `externalUrls` "Open in Compass" deep link to the resolved Manager's home channel and nothing else — NO activity relay, NO settle observation, NO Linear session-lifecycle machine. One Linear session is NOT forced 1-1 to a comms topic; the prompt lands in an issue-named topic (persisted in a new `linear_agent_sessions` table) delivered as `@linear`-authored deliver-rail messages deduped by `PostAsAccount`'s `client_request_id` on the `Linear-Delivery` UUID, but the deep link targets the home channel. Option C (coarse one-way status) is the ratified follow-up; Option A (full bidirectional relay) is off-table until Linear's activity vocabulary is configurable | Active (Matt, YYYY-MM-DD) | [linear agent responder §Part 3](product/compass-linear-agent-responder/design.md#part-3--the-return-path-a-dumb-link-option-b) | diff --git a/docs/designs/product/compass-live-roster/design.md b/docs/designs/product/compass-live-roster/design.md index 666830c3e..de5a07f72 100644 --- a/docs/designs/product/compass-live-roster/design.md +++ b/docs/designs/product/compass-live-roster/design.md @@ -1,4 +1,4 @@ -# Compass Live Roster — the agent tree reads the live roster (SEA-2033) +# Compass Live Roster — the agent tree reads the live roster (RIG-2033) Status: Draft @@ -186,7 +186,7 @@ decisions): tree-empty state the surfaces spec already defines (`design/surfaces.md:129-131`: "Tree-empty (no agents yet) renders a real empty-state row set: a one-line explanation and the palette hint ... not a - blank column"). No client-side fake supervisor: SEA-1820 / DL-192 seed the + blank column"). No client-side fake supervisor: RIG-1820 / DL-192 seed the root manager server-side (`seedRootSupervisor`, DL-192), so a live empty tree is a legitimate transient, not a state to paper over. (The empty-state VISUALS are the disjoint compass-ux styling lane; this record owes only the @@ -223,7 +223,7 @@ decisions): - **Presence/activity on `Account` + `accountChanged` (server-side), eliminating the client join:** structurally the cleanest long-term shape — one identity source, no client join — but a proto + comms-server lane far - outside SEA-2033's UI scope. Noted as the rejected long-term direction, not + outside RIG-2033's UI scope. Noted as the rejected long-term direction, not taken now. No new abstraction is introduced: the change is one new `CommsState` @@ -374,7 +374,7 @@ Convert the dead const to the documented reactive seam. renders the stopped dot; account order is preserved. Store tests — offline store returns the fixture through `agents()`; a store with a fake comms state joins live accounts + presence; `agentById` reacts to an agent-set change - (the SEA-1645 reactivity the comment at `store.ts:790-795` owes). + (the RIG-1645 reactivity the comment at `store.ts:790-795` owes). ### T4 — component cutover (retire STUB_AGENTS as render source) @@ -504,7 +504,7 @@ the frozen contract. worse than none). A live `role`/`model`/`cwd` later is a server-field lane (proto addition), parked. - **R4 (empty roster) — surfaces-spec tree-empty row, no client-seeded fake - supervisor.** Render the tree-empty row (`surfaces.md:129-131`); SEA-1820/ + supervisor.** Render the tree-empty row (`surfaces.md:129-131`); RIG-1820/ DL-192 seed the root manager server-side, so a live-empty tree is transient and honest. (Gated on `firstSnapshotArrived()` so the connect-window is not a false empty — see T5.) diff --git a/docs/designs/product/compass-manager-comms-substrate/design.md b/docs/designs/product/compass-manager-comms-substrate/design.md index a026ddfef..5098bbd78 100644 --- a/docs/designs/product/compass-manager-comms-substrate/design.md +++ b/docs/designs/product/compass-manager-comms-substrate/design.md @@ -1,12 +1,12 @@ # Compass Manager comms substrate — roster query, coordination channel, pinned board Status: Draft -Tracker: SEA-1721, SEA-1722, SEA-1723 +Tracker: RIG-1721, RIG-1722, RIG-1723 > DRAFT — all nine Open Questions ratified by Matt 2026-07-31 (see Decisions > section); freezes at merge. -> Cards: SEA-1721 (agent roster query), SEA-1722 (manager-owned coordination -> channel), SEA-1723 (pinned board). One record because the three primitives +> Cards: RIG-1721 (agent roster query), RIG-1722 (manager-owned coordination +> channel), RIG-1723 (pinned board). One record because the three primitives > compose: the roster and the coordination channel both derive from the agent > tree (DL-095), and the pinned board's first two homes are the root > #announcements-class channel and the coordination channel this record mints. @@ -17,7 +17,7 @@ The Compass Manager operating model — a root Manager coordinating mid-level Managers, each coordinating its own reports — needs three comms primitives that do not exist today: -1. **No roster pull (SEA-1721).** Presence is an *event only*: +1. **No roster pull (RIG-1721).** Presence is an *event only*: `AgentPresenceChanged { agent_account_id, presence }` (`compass/proto/compass/v1/comms.proto:498-503`) rides `SubscribeComms`, and no query RPC exists — the `CommsService` block (`comms.proto:34-110`) @@ -26,7 +26,7 @@ do not exist today: drop) cannot ask "who is in my tree, who is online, what is each doing." The event also carries **no activity string** — the enum is bare 4-state (`AgentPresence`, `comms.proto:507-513`, per DL-074). -2. **No restricted-post / mandatory-subscribe channel (SEA-1722).** A mid-level +2. **No restricted-post / mandatory-subscribe channel (RIG-1722).** A mid-level Manager needs a coordination channel for its reports — built on the same missing primitive as top-level #announcements/#incidents: a post ACL (owner-only where wanted) plus every report subscribed and unable to @@ -41,7 +41,7 @@ do not exist today: member may post. `ChannelGroupVisibility` (OWNER/SHARED, `comms.proto:196-201`) is a *visibility* axis and must not be overloaded to mean post permission. -3. **No pinned board (SEA-1723).** There is no server-side "editable headline +3. **No pinned board (RIG-1723).** There is no server-side "editable headline every Manager sees on startup, re-pushed on edit" (e.g. "CI is red — see Thread 12344 in #incidents"). This is explicitly NOT DL-096's sidebar pins, which are a per-user, client-local, `localStorage`-backed *presentation* @@ -69,7 +69,7 @@ tracks them. The pinned board is channel content delivered over DL-071/072/073 `compass-agent-comms-tools/design.md:182-197` fixed: "No new authz code is written; no new authz policy is invented"). -### A1 — SEA-1721: roster query — a `GetRoster` RPC + `compass_roster` tool over the D4 presence snapshot +### A1 — RIG-1721: roster query — a `GetRoster` RPC + `compass_roster` tool over the D4 presence snapshot **Read path, not a new projection.** DL-074 froze presence as a 4-state in-memory projection: "the hub keeps the last-published state per agent in @@ -111,7 +111,7 @@ Server restart recovers every agent's activity string from Postgres; the agent-side re-publish on session (re)attach is kept as a FRESHNESS mechanism, not the recovery path. See OQ-1 (resolved). -### A2 — SEA-1722: coordination channel — a channel-level `post_policy` + `mandatory_subscription`, auto-provisioned from tree edges +### A2 — RIG-1722: coordination channel — a channel-level `post_policy` + `mandatory_subscription`, auto-provisioned from tree edges **Model it on `Channel`, as policy fields — not a new `ChannelKind`, not visibility.** Two additive fields on `Channel` (`comms.proto:204-221`): @@ -209,21 +209,21 @@ majority of manager↔report coordination need not be seen by every other report, and an OPEN channel would burn every subscribed report's tokens broadcasting it. -**Relationship to SEA-1622 — precursor, not part-of.** SEA-1622 (unify +**Relationship to RIG-1622 — precursor, not part-of.** RIG-1622 (unify channels + workspaces under the agent tree) is post-MVP and depends on -agent-trees: "Unifying them under the agent tree … is SEA-1622, post-MVP … -the two trees coexist until SEA-1622 lands" +agent-trees: "Unifying them under the agent tree … is RIG-1622, post-MVP … +the two trees coexist until RIG-1622 lands" (`compass-agent-trees/design.md:230-236`; DL-095, `DECISIONS.md:43`). This -record builds the *ACL + mandatory-subscription mechanism* SEA-1622 will later +record builds the *ACL + mandatory-subscription mechanism* RIG-1622 will later compose onto tree-derived channel scoping. The fields live on `Channel`, not on the `ChannelGroup` namespace tree, precisely so the later folding moves the channel's *location* without touching its *policy*. -### A3 — SEA-1723: pinned board — a pure pointer set over existing topic-scoped messages; edit = topic-mandatory post + repoint, so redelivery IS delivery +### A3 — RIG-1723: pinned board — a pure pointer set over existing topic-scoped messages; edit = topic-mandatory post + repoint, so redelivery IS delivery **Not DL-096.** Stated once more for the freeze: DL-096's sidebar pins are "a per-user client-local UI preference (`localStorage`-backed …)" -(`DECISIONS.md:156`) — presentation, no server state. SEA-1723's pinned board +(`DECISIONS.md:156`) — presentation, no server state. RIG-1723's pinned board is server-side channel content: authored by the channel owner, stored in Postgres, broadcast to every subscriber, redelivered on edit. The two share a word, nothing else; neither supersedes the other. @@ -297,7 +297,7 @@ Every task below inherits these; task briefs do not restate them. below are into the compass clone. - **Additive-only proto changes.** New fields, new enum values, new RPCs, new oneof arms only — no renumbering, no wire-type changes, buf-breaking-safe. -- **SEA-1267 gen fence.** Presence/roster surfaces are PUBLIC, not gen-fenced +- **RIG-1267 gen fence.** Presence/roster surfaces are PUBLIC, not gen-fenced (matching `AgentPresenceChanged`'s "PUBLIC … NOT gen-fenced" posture, `comms.proto:496-497`); the `CommsCallRequest`/`RelayCommsCall` carrier family keeps its existing fence classification. compass-repo is the sole @@ -324,7 +324,7 @@ Every task below inherits these; task briefs do not restate them. ## Plan -### T1 — proto delta (gates all others) — [compass-repo] [SEA-1721 + SEA-1722 + SEA-1723] +### T1 — proto delta (gates all others) — [compass-repo] [RIG-1721 + RIG-1722 + RIG-1723] One additive change-set to `proto/compass/v1/`: @@ -380,7 +380,7 @@ One additive change-set to `proto/compass/v1/`: Interfaces: the proto messages/RPCs above, verbatim; `buf lint` + `buf breaking` clean; regenerated Go/TS in the single buf.gen lane. -### T2 — roster read path: hub snapshot join + durable activity store + `GetRoster` handler — [compass-comms] SEA-1721 +### T2 — roster read path: hub snapshot join + durable activity store + `GetRoster` handler — [compass-comms] RIG-1721 The hub's in-memory presence map (DL-074) stays ENUM-only; the activity string lives in a new durable store table; the handler joins hub + tree + @@ -451,7 +451,7 @@ RESTART — write via `SetActivity`, rebuild the hub state from scratch (fresh hub, same store), and `GetRoster` still returns the string (reloaded from the table, not the hub). -### T3 — agent tool leg: `compass_roster` + `compass_set_status` — [compass-agent] SEA-1721 +### T3 — agent tool leg: `compass_roster` + `compass_set_status` — [compass-agent] RIG-1721 Two new `AgentTool`s in `createCommsTools` (`compass-agent-comms-tools/design.md:484-485` shape) over the broker; new @@ -485,7 +485,7 @@ agent id (session-resolved); set_status → durable row upserted AND immediate `AgentPresenceChanged` with activity; over-cap activity truncated server-side (the truncated value is what lands in the table). -### T4 — channel policy store + enforcement — [compass-comms] SEA-1722 +### T4 — channel policy store + enforcement — [compass-comms] RIG-1722 Migration adds `post_policy`, `owner_account_id`, `mandatory_subscription` to `channels`; enforcement in the comms handlers. @@ -527,7 +527,7 @@ mandatory channel rejected; delivery reaches a member whose row says unsubscribed members seeds a cursor row for each of them in the same txn (no un-seeded delivery target). -### T5 — coordination-channel auto-provision + tree reconciliation — [compass-comms] SEA-1722 +### T5 — coordination-channel auto-provision + tree reconciliation — [compass-comms] RIG-1722 Hook the two STORE-level writers of `agent_accounts.parent_agent_id`: `store.CreateAgent` (`accounts.go:131`, INSERT at `:156-158`) and @@ -591,7 +591,7 @@ DL-077); collision with a manager-owned channel resumes; collision with a user-owned channel does NOT adopt but suffixes, AND the parent-edge write still succeeds (the reconcile hook never rolls back the spawn/reparent). -### T6 — pinned-board store + `UpdatePinnedBoard` — [compass-comms] SEA-1723 +### T6 — pinned-board store + `UpdatePinnedBoard` — [compass-comms] RIG-1723 Migration: `channel_pins (channel_id, message_id, position, pinned_at, pinned_by_account_id, PRIMARY KEY (channel_id, message_id))`, per-channel cap @@ -636,7 +636,7 @@ position preserved); replace naming a no-longer-pinned id fails in-band rejected in-band at cap+1; non-owner pin on OWNER_ONLY rejected; `ChannelChanged` carries the updated board. -### T7 — pinned-board delivery: the pin sweep — [compass-comms] SEA-1723 +### T7 — pinned-board delivery: the pin sweep — [compass-comms] RIG-1723 Extend the D2 session-start sweep (`compass-notification-delivery/design.md:340-346`) with a sibling pin step, and let live edits ride D1 unchanged (the edit's new @@ -662,7 +662,7 @@ session receives current pins even when `acked_seq` ≥ pin seq; edited board (new message id) delivers to all subscribers at author settle; a message pinned and swept in the same session is injected once (dedup). -### T8 — UI render: board strip + policy affordances — [compass-ui] [SEA-1722 + SEA-1723] +### T8 — UI render: board strip + policy affordances — [compass-ui] [RIG-1722 + RIG-1723] - Channel header renders `Channel.pinned_entries` as a compact board strip (resolve message ids via the query layer, DL-128); edit/unpin affordances @@ -685,29 +685,29 @@ non-owner composer disabled; pin strip renders and updates on `GetRoster`, `AgentPresenceChanged.activity`, `PinnedEntry` + `UpdatePinnedBoard` (pin-by-existing-message_id), `SetChannelPolicy`, `CommsCallRequest`/`Result` arms (`roster`, `set_status`, `pin`); buf - lint/breaking clean. [compass-repo] [SEA-1721/1722/1723] — gates T2-T8. + lint/breaking clean. [compass-repo] [RIG-1721/1722/1723] — gates T2-T8. - [ ] **T2** — hub presence snapshot (enum-only), durable `agent_activity` table + store activity read/write, store tree reads, `GetRoster` handler (account-visibility-scoped, `accountVisibleFromWhere`; - presence events keep the shared-channel rule). [compass-comms] SEA-1721 + presence events keep the shared-channel rule). [compass-comms] RIG-1721 - [ ] **T3** — `compass_roster` + `compass_set_status` (durable write-through - event publish) tools + relay arms. - [compass-agent] SEA-1721 + [compass-agent] RIG-1721 - [ ] **T4** — channel policy migration + `PostMessage`/`UpdateChannelMembers` enforcement + D1 mandatory-subscription disjunct + `SetChannelPolicy` - (cursor-seeding txn). [compass-comms] SEA-1722 + (cursor-seeding txn). [compass-comms] RIG-1722 - [ ] **T5** — coordination-channel auto-provision hooked at the two store-level `parent_agent_id` writers (spawn + public CreateAgent + reparent by construction) + membership reconciliation, ownership-checked - resume. [compass-comms] SEA-1722 + resume. [compass-comms] RIG-1722 - [ ] **T6** — `channel_pins` store + `UpdatePinnedBoard` (pointer-only pin/unpin/repoint over existing message_ids; CAS repoint + FOR UPDATE - serialization; cap). [compass-comms] SEA-1723 + serialization; cap). [compass-comms] RIG-1723 - [ ] **T7** — session-start pin sweep beside the D2 cursor sweep; live edits - ride D1 unchanged. [compass-comms] SEA-1723 + ride D1 unchanged. [compass-comms] RIG-1723 - [ ] **T8** — UI: board strip, owner-only composer gating, hidden subscribe toggle on mandatory channels, activity string in presence renders. - [compass-ui] [SEA-1722/1723] + [compass-ui] [RIG-1722/1723] ## Decisions (ratified by Matt 2026-07-31) @@ -768,7 +768,7 @@ vs a per-member role/locked-subscribe bit. **Resolved: the channel-level fields**: kind encodes conversation topology (`comms.proto:226-230`), not authority — a kind forks a matrix; per-member bits invite row drift and don't express "same policy as #announcements" (all members, always). Channel-level -policy also composes cleanly into SEA-1622's later tree-folding: the policy +policy also composes cleanly into RIG-1622's later tree-folding: the policy travels with the channel wherever the namespace lands, and a later `OWNER_AND_PARENTS`/role-based enum value is additive. The `mandatory_subscription` guarantee is enforced read-side in D1's subscriber @@ -819,12 +819,12 @@ channel-scoped broadcast content delivered as chat via the existing rail, with no centre/badge/read-state; the delivery cursor is plumbing, not user-facing read state. But it IS a new notification-shaped primitive, so the call is surfaced rather than assumed. **Resolved: compatible, no DL-054 amendment** — -Matt confirmed the judgment; the fallback (scoping SEA-1723 to agent-side +Matt confirmed the judgment; the fallback (scoping RIG-1723 to agent-side delivery only, no UI board strip) was not needed. ### OQ-7 — RESOLVED (Matt 2026-07-31): SetChannelPolicy ships as the enabler; top-level provisioning stays out of scope -SEA-1722's brief says the coordination channel is "the SAME missing primitive +RIG-1722's brief says the coordination channel is "the SAME missing primitive behind restricted-post #announcements / #incidents". This record designs the PRIMITIVE (post_policy + mandatory_subscription + board) and the coordination-channel auto-provisioning; it does NOT auto-provision @@ -887,7 +887,7 @@ The #announcements-class channels themselves stay OWNER_ONLY (unchanged). ## Ledger impact Appended to `docs/designs/product/DECISIONS.md` (§ Comms & tools) in the same -PR — DL-135/136/137 (main's max row was DL-128; #1089 (SEA-1732) took the +PR — DL-135/136/137 (main's max row was DL-128; #1089 (RIG-1732) took the DL-129..134 block first, so this record shifts to the next free block (deconflicted via the wave coordinator; the gate has no contiguity check). Status `Active (Matt, 2026-07-31)`. The rows below are the wording as written there: @@ -906,7 +906,7 @@ DL-129..134 block first, so this record shifts to the next free block DL-074's in-memory posture for the STRING; the presence enum stays in-memory. Presence EVENTS keep the shared-channel visibility rule while the roster uses account visibility (divergence stated: an owner sharing no - channel with its agent gets snapshot-only presence). SEA-1721 + channel with its agent gets snapshot-only presence). RIG-1721 - **DL-136** (new, § Comms & tools) — Channel post authority and forced subscription are channel-level policy fields (`post_policy` OPEN/OWNER_ONLY + `owner_account_id` + `mandatory_subscription`), never a @@ -926,7 +926,7 @@ DL-129..134 block first, so this record shifts to the next free block report→manager and lateral coordination flows through DMs/group DMs, and agents at every level heavily prefer direct DMs/small targeted group DMs to keep coordination-token-cost low (standing directive, Matt). Precursor - primitive to SEA-1622, not part of it. SEA-1722 + primitive to RIG-1622, not part of it. RIG-1722 - **DL-137** (new, § Comms & tools) — The pinned board is a server-side per-channel capped ordered POINTER set over existing topic-scoped messages: pinning references an existing `message_id` (validated to a @@ -938,7 +938,7 @@ DL-129..134 block first, so this record shifts to the next free block sweep beside the D2 cursor sweep dispatching current pins regardless of cursor position; edits land at turn-settle (never steer); explicitly distinct from DL-096's client-local sidebar pins, and compatible with - DL-054 (no centre/badge/read state). SEA-1723 + DL-054 (no centre/badge/read state). RIG-1723 Existing rows touched (cited; DL-074 AMENDED, none superseded): @@ -951,7 +951,7 @@ Existing rows touched (cited; DL-074 AMENDED, none superseded): no-durable-table posture, ratified by Matt 2026-07-31. - **DL-075/077** — spawn/despawn semantics consumed by T5's lifecycle rules. - **DL-095** — the tree remains the organizing primitive; roster and - coordination channels derive from it; SEA-1622 relationship restated + coordination channels derive from it; RIG-1622 relationship restated (precursor, not part-of). - **DL-096** — cited only to disambiguate; untouched. - **DL-098** — composed with, not amended: pins point at topic-scoped diff --git a/docs/designs/product/compass-manager-prompt/design.md b/docs/designs/product/compass-manager-prompt/design.md index f0763dad2..91a8669c9 100644 --- a/docs/designs/product/compass-manager-prompt/design.md +++ b/docs/designs/product/compass-manager-prompt/design.md @@ -3,7 +3,7 @@ Status: Draft > Freezes on merge; later changes supersede by citation, never rewrite. -> Tracked as SEA-1732. Parent primitive-gaps: §3.5 of the source distillation +> Tracked as RIG-1732. Parent primitive-gaps: §3.5 of the source distillation > (`manager-prompt-distillation.md`, Matt's ratified draft, §0.5 decisions > ratified 2026-08). > @@ -13,9 +13,9 @@ Status: Draft > label, not a rename), **DL-132** (v0→target prompt versioning), **DL-133** > (layer split + the Dogfood first-skills set, incl. the name-by-function > tenet), **DL-134** (Dogfood implementers are in-process subagents briefed by -> the Manager; non-subagent implementers gate on SEA-1717), **DL-135** (the +> the Manager; non-subagent implementers gate on RIG-1717), **DL-135** (the > `task`-subagent prompt seam is ADDITIVE, so the Dogfood implementer def is a -> thin ROLE delta and the full block-0 is the future SEA-1717 artifact). +> thin ROLE delta and the full block-0 is the future RIG-1717 artifact). > > Grounding: all fork/agent mechanism claims below were re-verified firsthand > against the compass repo at **`origin/main = cf048ca`** (2026-08-04), per the @@ -28,14 +28,14 @@ Status: Draft A freshly-spawned Compass agent comes up with **no role prompt** — it does not know it is a Manager (or a worker), what tree it sits in, that comms are async-only, or what its work loop is. The delivery machinery already exists -(config-delivery, DL-078/079/080/081; SEA-1568/1674 Done — a spawn is +(config-delivery, DL-078/079/080/081; RIG-1568/1674 Done — a spawn is provisioned with skills + extensions + MCP, and the entrypoint owns the system-prompt seam). This record freezes the **content**: the Manager block-0 prompt, the block-0 REPLACE mechanism it rides, and the first skills a spawn needs to be self-directing; the implementer block-0 is an ACTIVE deliverable too (T2 — a Manager hands its in-process `task` subagents a thin ROLE delta via a mounted `config/agents/` def whose body splices INTO the default OMP block-0, -MP-5/DL-134; the full standalone block-0 is kept as the future SEA-1717 artifact). +MP-5/DL-134; the full standalone block-0 is kept as the future RIG-1717 artifact). Content + freeze, not plumbing. ## Approach @@ -150,7 +150,7 @@ Under replace, OMP's block-0 prose is dropped for **every** role — nothing is never-block) to a line each. OMP's block 0 is the style/quality reference, never the source text. - **Implementer block-0: a THIN ROLE DELTA at Dogfood; the full copy-and-adapt is - the FUTURE SEA-1717 artifact** (both frozen in §Implementer block-0 below). + the FUTURE RIG-1717 artifact** (both frozen in §Implementer block-0 below). Because a Dogfood implementer is a `task` subagent, its def body is spliced INTO the full default OMP block-0, not swapped for it (`forks/oh-my-pi/packages/coding-agent/src/task/executor.ts:2808-2810`), so the @@ -160,7 +160,7 @@ Under replace, OMP's block-0 prose is dropped for **every** role — nothing is tool, one-slice-then-yield, jj-stacking push, operator-not-user framing) and drops everything the default supplies. The full copy-and-adapt of OMP's block 0 (`forks/oh-my-pi/packages/coding-agent/src/prompts/system/system-prompt.md`, 283 - lines) is retained as the standalone-container artifact for SEA-1717, where a + lines) is retained as the standalone-container artifact for RIG-1717, where a Compass mechanism REPLACES the subagent default (a mechanism absent at `cf048ca`); it keeps the `[runtime-injected]` placeholders that future path's own injector fills, which is exactly why it is not a valid Dogfood def body @@ -176,7 +176,7 @@ the ADDITIVE `task`-subagent splice (`executor.ts:2808-2810`) — OMP's full block-0 co-renders around the def body — so the implementer inherits that contract (the years-of-failure-modes prose an implementer needs) for free and the Dogfood def carries ONLY the Compass delta. The full standalone block-0 is -authored for the day SEA-1717 gives the implementer a REPLACE path too. +authored for the day RIG-1717 gives the implementer a REPLACE path too. Two delivery notes. First, the two prompts ship on DIFFERENT surfaces: the Manager block-0 rides `customSystemPrompt` (T10 wiring), while the implementer @@ -184,7 +184,7 @@ block-0 ships as a mounted subagent def under `config/agents/` — the `task` tool + `discoverAgents` already consume it at `cf048ca` (MP-5), so it needs no `cli.ts` change (MP-5). At Dogfood, T1 ships the full Manager block-0 and T2 ships the thin implementer delta; the full implementer block-0 is the future -SEA-1717 artifact. Second, T3's always-apply rules are load-bearing for prompt +RIG-1717 artifact. Second, T3's always-apply rules are load-bearing for prompt safety: the ~500-word Manager block compresses each invariant to a line precisely because the always-apply tier carries them full-text every turn (MP-1 evidence) — thinning T3 thins the @@ -198,7 +198,7 @@ Ratified (Matt, 2026-08; distillation §5). Proto/Go/UI types stay hundreds of files including the shipped `parent_agent_id` field). "Manager" appears in prompts, docs, UI labels, and marketing. A Manager IS an Agent whose role is manager. The role *mechanism* (role field, per-role bundles, per-role -model/thinking) is **SEA-1724 (Beta)** — forward-referenced, not designed here. +model/thinking) is **RIG-1724 (Beta)** — forward-referenced, not designed here. ### Decision MP-4 — v0→target prompt versioning (DL-132) @@ -215,7 +215,7 @@ exist (a Manager that calls a phantom tool wedges). So the record freezes a - The flip is prompt-content versioning, not delivery redesign: the updated prompt rides the existing bundle update path (DL-081 re-materialize + Reload). Per-role bundle *keying* stays the named post-MVP seam (DL-078) owned by - SEA-1724. + RIG-1724. **Primitives map — current, re-grounded at `cf048ca`** (supersedes the distillation §3.5 snapshot where marked ★): @@ -224,15 +224,15 @@ distillation §3.5 snapshot where marked ★): | --- | --- | --- | | `comms_post_message` / `comms_list_messages` | DEFINED; not yet registered on a session — registered by T10 (live in v0) | defined at `packages/compass-agent/src/comms.ts:210,271`; the factory carries an explicit "NOT YET WIRED … registration leg tracked separately" header (`comms.ts:204-206` — its "no entrypoint in this repo" line is stale, `cli.ts` is the entrypoint now); the entrypoint passes `customTools: mcp.tools` ONLY (`cli.ts:633`) and imports neither factory (`cli.ts:31-68`) | | **Named topics** ★ | **EXISTS — merged** (#109/#129/#134/#139), further along than the distillation's "in flight" | post takes `topic` ("Named conversation within the channel; an unknown name creates the topic", `comms.ts:123-127`); list output is "GROUPED BY TOPIC. Field 2 (`topic_id`) replaced the removed per-message `parent_message_id`" (`comms.ts:381-385`); `rpc ListTopics` (`proto/compass/v1/comms.proto:89`) | -| **Mid-turn @mention steer** ★ | **EXISTS — wired end-to-end**, contradicting the distillation's "payload UNWIRED (SEA-1310)" | server routes @-mentions as steer ops (`go/internal/delivery/consumer.go:289-296`, `Steer: &compassv1internal.SteerControl{Message: msg}`); agent decodes and dispatches: "As of SEA-1310 §8 the handle carries the full comms `Message` (`.id` intact) — no longer the empty shell of C4b" (`packages/compass-agent/src/transport/control-source.ts:155-158`); the steer arm injects mid-turn (`packages/compass-agent/src/agent.ts:247-251`) | +| **Mid-turn @mention steer** ★ | **EXISTS — wired end-to-end**, contradicting the distillation's "payload UNWIRED (RIG-1310)" | server routes @-mentions as steer ops (`go/internal/delivery/consumer.go:289-296`, `Steer: &compassv1internal.SteerControl{Message: msg}`); agent decodes and dispatches: "As of RIG-1310 §8 the handle carries the full comms `Message` (`.id` intact) — no longer the empty shell of C4b" (`packages/compass-agent/src/transport/control-source.ts:155-158`); the steer arm injects mid-turn (`packages/compass-agent/src/agent.ts:247-251`) | | Spawn/despawn tools | DEFINED; not yet registered on a session — registered by T10, named only in the standing-child-Manager line | defined at `packages/compass-agent/src/lifecycle.ts:144,189`; same "NOT YET WIRED" header (`lifecycle.ts:137-140`); `cli.ts:633` (`customTools: mcp.tools` only). The distillation's "no agent tool wired" was and remains CORRECT at `cf048ca`. The server leg IS built end-to-end — `RunnerTransport.lifecycle` (`transport/index.ts:58`), Runner gateway (`go/internal/runner/gateway/lifecycle.go:54`), server relay + caller wired in production (`go/internal/runnerhub/relay_lifecycle.go:57`, `go/server/sinks.go:88`) — registration is the ONLY missing leg | | In-process subagent delegation (`task`) | EXISTS — live | `createAgentSession` is called with no tool-disabling option (`cli.ts:608-659`), so the SDK's default tool set — including `task` — is present; the config-passthrough probe queries "the SDK exactly as the `task` tool would" and finds mounted `agents/` defs (`config-passthrough-probe.ts:17-18,44-48`, `cli.config-passthrough.test.ts` §(g)) | | Spawn **operator-approval gate** | ABSENT (unchanged) | no approval construct in `lifecycle.ts` or the server lifecycle path; grep for an approval gate over spawn returns nothing | | `parent_agent_id` + `ReparentAgent` ★ | **EXIST in proto**, contradicting the distillation's "not yet in comms.proto" | `string parent_agent_id = 4;` (`proto/compass/v1/comms.proto:162`); `rpc ReparentAgent(...)` (`comms.proto:72`) | | `compass_tree` tool | ABSENT (unchanged) | no such tool; the only native agent tools DEFINED in the package are the two comms + two lifecycle tools above — and none is registered at `cf048ca` (grep `name: "` across `packages/compass-agent/src`; `cli.ts:633`) | -| Roster/presence **query** | ABSENT (unchanged; event only) | no roster tool/RPC; presence rides the event stream (SEA-1721 files the query) | -| Coordination-channel ACL + auto-subscribe | ABSENT (unchanged) | no restricted-post/auto-subscribe construct in `comms.proto` (grep empty; SEA-1722) | -| Pinned board | ABSENT (unchanged) | no such primitive (SEA-1723; DL-096 sidebar-pins is unrelated UI) | +| Roster/presence **query** | ABSENT (unchanged; event only) | no roster tool/RPC; presence rides the event stream (RIG-1721 files the query) | +| Coordination-channel ACL + auto-subscribe | ABSENT (unchanged) | no restricted-post/auto-subscribe construct in `comms.proto` (grep empty; RIG-1722) | +| Pinned board | ABSENT (unchanged) | no such primitive (RIG-1723; DL-096 sidebar-pins is unrelated UI) | **Consequence:** v0 is closer to target than the distillation assumed — but not because the native tools are live: at `cf048ca` a booted agent has ZERO @@ -242,12 +242,12 @@ registers them). The v0 prompt names topics and mid-turn steers as live MP-5), and names the comms + lifecycle tools ONLY because T10 — in this same record's plan — registers them onto the session (GC-3 holds because the prompt line and the registration ship together). The remaining `[TODO]` lines -are: `compass_tree` (tree epic), roster query (SEA-1721) — which also gates +are: `compass_tree` (tree epic), roster query (RIG-1721) — which also gates the "read your parent fresh" line (see block-0), coordination-channel ACL -(SEA-1722), pinned board (SEA-1723), the spawn **approval gate** (spawn +(RIG-1722), pinned board (RIG-1723), the spawn **approval gate** (spawn epic) — until the gate lands, "ask the operator before spawning a child Manager" ships as a behavioral rule, not a tool-enforced one — and the -issue/PR tools the work-loop's issue-ownership lines depend on (SEA-1734: +issue/PR tools the work-loop's issue-ownership lines depend on (RIG-1734: they land pre-Dogfood as an operator-provisioned surface; the block-0 lines name the concrete tools once they land). @@ -273,7 +273,7 @@ rules/skills (name + one-liner every turn, body on demand via **Name-by-function tenet (frozen):** a Manager is named for the team/department it is — CI Manager, Observability Manager, Payments Manager — never for the tool it uses (no `aws`/`grafana` agents). The function is stable; tools are an -implementation detail. Composes with SEA-1724 roles: the role sets capability; +implementation detail. Composes with RIG-1724 roles: the role sets capability; the name states the function. ### Decision MP-5 — Dogfood implementers are in-process subagents (DL-134) @@ -296,10 +296,10 @@ would get heavy very fast." - **`agents_spawn_peer` / `agents_despawn_peer` are for standing PEER/CHILD MANAGERS** — containerized, long-lived tree nodes — never per-task implementers. They are registered onto the session by T10 (MP-4 table). -- **The containerized-implementer model is SEA-1717 (Beta)**: the brain/hands +- **The containerized-implementer model is RIG-1717 (Beta)**: the brain/hands split ("an agent needs a computer, not a container") separates the lightweight portable brain from on-demand heavy compute; per-implementer - containers become cheap only after that split. Distinct from SEA-1724, the + containers become cheap only after that split. Distinct from RIG-1724, the role-mechanism issue — two different Beta issues. - **Consequences in this record:** the implementer block-0 (T2) is an ACTIVE Dogfood deliverable — the consumer exists at `cf048ca`. A fleet-delivered @@ -312,7 +312,7 @@ would get heavy very fast." (`executor.ts:2808-2810`), which co-renders around it — there is NO mechanism at `cf048ca` that replaces the subagent default. So the Dogfood def is a THIN ROLE DELTA — identity + the Compass divergences only — not a full block-0 (see - §Implementer block-0). What SEA-1717/SEA-1724 defer is the *containerized, + §Implementer block-0). What RIG-1717/RIG-1724 defer is the *containerized, non-subagent* implementer (a peer/child tree node with its own compute) AND its standalone-block-0 REPLACE path: the full authored block-0 kept in §Implementer block-0 is ready to serve THAT path when it lands. The Dogfood deliverable this @@ -338,7 +338,7 @@ build software under a human operator's merge gate. implementation runs in SUBAGENTS inside your own session — briefed by you, ephemeral, never tree nodes. [TODO compass_tree: `compass_tree` shows the tree.] Your parent is recorded on your account. [TODO compass_tree / - SEA-1721: it can change (re-parenting) — read it fresh via the tree/roster + RIG-1721: it can change (re-parenting) — read it fresh via the tree/roster query when you act on it, never cache it.] - Report results UP to your parent; delegate work DOWN. - You are a COORDINATOR, not a typist. Implementation is done by SUBAGENTS you @@ -371,7 +371,7 @@ build software under a human operator's merge gate. ## Your work loop - You are assigned ISSUES and own each end-to-end: move its state as the work moves; close it yourself when the ask is satisfied. Nothing closes an issue - for you. [TODO SEA-1734: the issue/PR tools land pre-Dogfood (operator-provisioned + for you. [TODO RIG-1734: the issue/PR tools land pre-Dogfood (operator-provisioned surface, like the Linear/GitHub tools the current wave uses); name the concrete tools + how state/close are performed once they land.] - Work continuously: while you hold open issues, drive them; if you have @@ -391,8 +391,8 @@ The distillation was accurate for its session; three primitives have since merged past its snapshot (all evidence above): named topics (#109/#129/#134/#139 — and `parent_message_id` reply-threading is REMOVED, so the distillation §1 fallback "thread by replying under a message, `parent_message_id`" is no longer -possible, topics are the only threading), the mid-turn steer payload (SEA-1310 -§8 / SEA-1569 T7 — wired, not parked), and `parent_agent_id`/`ReparentAgent` +possible, topics are the only threading), the mid-turn steer payload (RIG-1310 +§8 / RIG-1569 T7 — wired, not parked), and `parent_agent_id`/`ReparentAgent` in proto. On the native comms and spawn/despawn TOOLS the distillation was and remains RIGHT: "no agent tool wired" holds at `cf048ca` — the four are defined, unregistered exports until T10 registers them (MP-4 table). The @@ -497,10 +497,10 @@ from that default — do not restate it. If the brief names no push target, report back rather than guess. ``` -#### The full standalone block-0 — FUTURE SEA-1717 artifact (kept, not the Dogfood target) +#### The full standalone block-0 — FUTURE RIG-1717 artifact (kept, not the Dogfood target) The full, standalone block-0 below is NOT shipped at Dogfood. It is kept here as -the FUTURE artifact for the containerized, non-subagent implementer (SEA-1717's +the FUTURE artifact for the containerized, non-subagent implementer (RIG-1717's brain/hands split): when that lands, a Compass mechanism REPLACES the subagent default block-0 for that implementer — a mechanism that does NOT exist at `cf048ca` (today every `task` subagent gets the additive splice above, with no @@ -710,7 +710,7 @@ Before declaring blocked: OMP block-0 (`executor.ts:2808-2810`), so copying the full block into the def would DUPLICATE the co-rendered default on every implementer turn. At Dogfood the implementer INHERITS the default for free and the def carries only the - Compass delta. The full copy-and-adapt is retained for the future SEA-1717 + Compass delta. The full copy-and-adapt is retained for the future RIG-1717 REPLACE path (a standalone container implementer with no default block-0), where it becomes an owned file diverging where Compass differs (per MP-2); inheriting from upstream verbatim on THAT path would couple our contract to prompt churn at @@ -718,9 +718,9 @@ Before declaring blocked: bumps (see Open Questions). - **Single-file record vs roles-parent cluster.** Distillation §11 recommends leading with a `compass-agent-roles/` parent record and this as its first - instance — but the roles mechanism is SEA-1724 (Beta) scope. Recommended: + instance — but the roles mechanism is RIG-1724 (Beta) scope. Recommended: this standalone `compass-manager-prompt/` record for the Dogfood cut, - forward-referencing SEA-1724; the roles record, when written, becomes the + forward-referencing RIG-1724; the roles record, when written, becomes the parent by citation (freeze discipline: supersede by citation, never rewrite). - **Deliver the role block via `COMPASS_PERSONA`.** Rejected: persona is an append overlay after the default prompt (`cli.ts:649-658`), so it inherits @@ -729,7 +729,7 @@ Before declaring blocked: - **Containerize implementers now (one container per implementer).** Rejected for Dogfood: spinning up a container per subagent gets heavy fast (Matt, 2026-08-04), and per-implementer containers become cheap only after the - SEA-1717 brain/hands split (Beta) separates the lightweight portable brain + RIG-1717 brain/hands split (Beta) separates the lightweight portable brain from on-demand heavy compute. Dogfood implementers stay in-process subagents the Manager briefs (MP-5/DL-134). @@ -741,7 +741,7 @@ Every task below inherits these: mechanism is verified at `cf048ca` against the pinned fork. - **GC-2 — Manager block-0 ≈ one screen (~500 words).** The Dogfood implementer block-0 is a THIN ROLE delta (divergences only, atop the co-rendered default); - the full copy-adapt of OMP's block is the future SEA-1717 artifact. + the full copy-adapt of OMP's block is the future RIG-1717 artifact. - **GC-3 — Name only what exists.** A prompt/skill line may name a tool only if it exists at the commit the line ships against; every not-yet-shipped affordance is an explicit `[TODO ]` line (MP-4). No line may @@ -759,7 +759,7 @@ Every task below inherits these: `red-green-testing`): keep the invariant, re-ground the mechanics in Compass tools. - **GC-8 — No new delivery plumbing.** Content rides the frozen config-delivery - spine (DL-078/080/081); per-role bundle keying stays the named SEA-1724 seam. + spine (DL-078/080/081); per-role bundle keying stays the named RIG-1724 seam. ## Plan @@ -772,9 +772,9 @@ order. Each task is one review cycle; all are prose-authoring tests). Skill/rule/prompt files land in the compass repo under the config-bundle authoring tree the operator publishes via `compass config put` (DL-078's recommended workflow); exact paths per task. One cross-task -dependency: the block-0 work-loop's issue-ownership lines flip on **SEA-1734** +dependency: the block-0 work-loop's issue-ownership lines flip on **RIG-1734** (the issue/PR tools, landing pre-Dogfood as an operator-provisioned surface) — -tracked as a `[TODO SEA-1734]` in the frozen text (MP-4 flip discipline), the +tracked as a `[TODO RIG-1734]` in the frozen text (MP-4 flip discipline), the same way T10's native-tool registration gates the comms/lifecycle lines. **T1 — Manager block-0 SYSTEM.md (v0).** Author the manager role's replace @@ -803,12 +803,12 @@ proved. The def body is then SPLICED INTO the full default OMP block-0 block-0 (delivered via `customSystemPrompt`, T10), it needs no `cli.ts` wiring: the `task` tool + the mounted `agents/` tree already consume it at `cf048ca`. The full standalone block-0 in that same section is NOT this deliverable — it is the -FUTURE SEA-1717 artifact (the containerized, non-subagent implementer's REPLACE +FUTURE RIG-1717 artifact (the containerized, non-subagent implementer's REPLACE path, which does not exist at `cf048ca`); it is authored and kept, not shipped at Dogfood. Frontmatter for the Dogfood cut: set `name`/`description` only — omit `tools:` and `model:` so the def inherits the SDK's default tool set and the session model, and set `spawns: ''` (the implementer is hands, not brains: -re-delegation is the deferred SEA-1717 concern). `thinkingLevel` is left to the +re-delegation is the deferred RIG-1717 concern). `thinkingLevel` is left to the SDK default. Interfaces: consumes §Implementer block-0 → thin ROLE delta; produces `config/agents/implementer.md`. @@ -822,7 +822,7 @@ produces `config/rules/{never-block,own-your-issue,red-green-testing,never-merge **T4 — comms-playbook skill.** Channels/topics model, routing (DMs to cut readers, DM-the-owner-to-post), subscriptions, ping-vs-regular delivery semantics, @mention-steer behavior, ACL patterns. Names only live tools (GC-3): -topic-scoped posting is live; restricted-post ACLs are `[TODO SEA-1722]`. +topic-scoped posting is live; restricted-post ACLs are `[TODO RIG-1722]`. Interfaces: consumes §2 rows 3/4/6/8/9/12/18 + MP-4 table; produces `config/skills/comms-playbook/SKILL.md`. @@ -846,8 +846,8 @@ Interfaces: consumes §7 of the distillation + T5's shapes; produces **T7 — supervisor-channel + manager-coordination-channel skills.** Supervisor: `#announcements`/`#incidents` discipline, restricted-post posture (`[TODO -SEA-1722]`), first-contact + top-down posture relays, pinned-board usage -(`[TODO SEA-1723]`). Manager: owning a coordination channel for reports, +RIG-1722]`), first-contact + top-down posture relays, pinned-board usage +(`[TODO RIG-1723]`). Manager: owning a coordination channel for reports, distinct from the home channel — same gated primitives. Interfaces: consumes §8 of the distillation + MP-4 table; produces `config/skills/supervisor-channel/SKILL.md` and @@ -879,7 +879,7 @@ discipline.** The one code task, owning the only `cli.ts` delta at the exec-spec surface that carries `COMPASS_PERSONA`, whose VALUE is a server-authoritative persisted field, `go/internal/store/accounts.go:202`). Unset → today's behavior (no replace). Interim, operator-side only, - pre-SEA-1724 (OQ-2, resolved). + pre-RIG-1724 (OQ-2, resolved). 2. **Native-tool registration** (the registration leg both "NOT YET WIRED" headers name, `comms.ts:204-206` / `lifecycle.ts:137-140`): construct `CommsBroker` + `LifecycleBroker` over the `RunnerTransport` the @@ -902,7 +902,7 @@ Interfaces: consumes `packages/compass-agent/src/cli.ts:608-659` (createAgentSession call), `sdk.ts:378` (`customSystemPrompt`), `comms.ts:208` / `lifecycle.ts:142` (the tool factories), the bundle member from T1; produces the cli.ts delta + tests; reopens no delivery decision -(GC-8) but notes DL-078's per-role seam for SEA-1724. +(GC-8) but notes DL-078's per-role seam for RIG-1724. **Deferred (named, not Dogfood-blocking):** `compass-architecture` and `living-specs` reference skills (§2 rows 19/23) — read-on-demand references a @@ -912,7 +912,7 @@ spawn does not need to be self-directing; filed as follow-ups after the freeze ## Tasks - [ ] T1 — Manager block-0 SYSTEM.md (v0 + gated target lines). Interfaces: §Manager block-0 + MP-4 → `config/prompts/manager/SYSTEM.md`. -- [ ] T2 — Implementer block-0 thin ROLE delta subagent def (materialize the frozen §Implementer block-0 → thin ROLE delta; the full block-0 is the future SEA-1717 artifact, not shipped). **Active Dogfood deliverable** (MP-5; the `task` tool + mounted `agents/` consume it at `cf048ca`; the def body splices INTO the default block-0, `executor.ts:2808-2810`). Interfaces: §Implementer block-0 (thin delta) → `config/agents/implementer.md`. +- [ ] T2 — Implementer block-0 thin ROLE delta subagent def (materialize the frozen §Implementer block-0 → thin ROLE delta; the full block-0 is the future RIG-1717 artifact, not shipped). **Active Dogfood deliverable** (MP-5; the `task` tool + mounted `agents/` consume it at `cf048ca`; the def body splices INTO the default block-0, `executor.ts:2808-2810`). Interfaces: §Implementer block-0 (thin delta) → `config/agents/implementer.md`. - [ ] T3 — Always-apply rules (3 adapted + 3 new one-liners). Interfaces: Matt's rulebook + §2 → `config/rules/*.md`. - [ ] T4 — comms-playbook skill. Interfaces: §2/§8 + MP-4 → `config/skills/comms-playbook/SKILL.md`. - [ ] T5 — management-trees skill (shapes + name-by-function + delegation mechanics). Interfaces: §9/§12 + GC-5 + MP-5 → `config/skills/management-trees/SKILL.md`. @@ -932,11 +932,11 @@ is designed against the recommendation in each case. 1. **Record home: standalone `compass-manager-prompt/` vs leading with a `compass-agent-roles/` parent (distillation §11).** Load-bearing (decides where this freeze lives). **Recommendation: standalone for the Dogfood cut** - — the roles mechanism is SEA-1724/Beta scope and designing its record now + — the roles mechanism is RIG-1724/Beta scope and designing its record now would violate this record's own non-goal; the future roles record becomes the parent by citation. -2. **Interim role-selection mechanism (pre-SEA-1724) — RESOLVED by the MP-5 +2. **Interim role-selection mechanism (pre-RIG-1724) — RESOLVED by the MP-5 reframe (Matt, 2026-08-04), no longer a fork.** Only OPERATOR-PROVISIONED STANDING MANAGERS get a container + a role block via `customSystemPrompt`; implementer subagents get their prompt from the briefing Manager, not from @@ -948,9 +948,9 @@ is designed against the recommendation in each case. replace). NOT carried on `SpawnPeerRequest` (which has no role slot — `agent_gateway.proto:122-127`), NOT an `AgentAccount` field (`comms.proto:149-162` carries only owner, home channel, and parent), - requiring NO proto/account change. This holds the SEA-1724 boundary + requiring NO proto/account change. This holds the RIG-1724 boundary because Dogfood needs only the operator-set Manager path; per-agent role - as an account/proto datum stays SEA-1724 (Beta). + as an account/proto datum stays RIG-1724 (Beta). 3. **v0 names the newly-merged primitives as live — CONDITIONAL.** Topics and the mid-turn steer are genuinely merged with tests, and the distillation's @@ -976,8 +976,8 @@ is designed against the recommendation in each case. epic and needs no prompt change.** 6. **Default channel set beyond #announcements/#incidents** (distillation §9 - open question, tracked SEA-1722). Non-load-bearing here (T7 gates its ACL - prose on SEA-1722 anyway). **Recommendation: defer to SEA-1722.** + open question, tracked RIG-1722). Non-load-bearing here (T7 gates its ACL + prose on RIG-1722 anyway). **Recommendation: defer to RIG-1722.** 7. **Implementer-prompt drift policy at fork bumps.** Two surfaces drift as OMP evolves: (a) the Dogfood thin delta assumes what the default OMP block-0 diff --git a/docs/designs/product/compass-mention-offline-redelivery.md b/docs/designs/product/compass-mention-offline-redelivery.md index 84e6171b1..9361f90c1 100644 --- a/docs/designs/product/compass-mention-offline-redelivery.md +++ b/docs/designs/product/compass-mention-offline-redelivery.md @@ -6,7 +6,7 @@ All seven Open Questions ruled by Matt (2026-08-21) — folded into the body; se Tracker: RIG-1641. -Amends: `compass-notification-delivery/design.md` (SEA-1569) — D5 mention→steer +Amends: `compass-notification-delivery/design.md` (RIG-1569) — D5 mention→steer routing (design.md:507-562) and OQ-3's offline clause (design.md:951-960). Ledger: this record's PR appends a new `DL-` row to @@ -40,7 +40,7 @@ The three-path proof of the gap, at source: for agent := range mentioned { sessionID, live := c.resolver.SessionForAccount(agent) if !live { - continue // no live turn to interrupt; redelivery only if subscribed-or-home (SEA-1641) + continue // no live turn to interrupt; redelivery only if subscribed-or-home (RIG-1641) } c.dispatchSteerTo(ctx, sessionID, msg) } @@ -89,7 +89,7 @@ and silently FALSE for the unsubscribed non-home one — the shipped the tracking issue (`dispatch.go:123-127`): "An UNSUBSCRIBED non-home member has no sweep redelivery (UndeliveredMessages is subscription-gated […]), so a mention reaches it only while it is live: offline + unsubscribed = -nothing this cycle, by design (SEA-1641 tracks whether that gap should become +nothing this cycle, by design (RIG-1641 tracks whether that gap should become recoverable)." Intent: a mention is never silently dropped once the settle edge processes @@ -612,7 +612,7 @@ pre-check (cost control, §Decisions OQ-2). **T4 — routeMentions/fanOut integration + docstring truth.** Wire T2's record and T3's wake into the `!live` arms of `routeMentions` (`dispatch.go:136-142`) and `fanOut` (`dispatch.go:108-111`); rewrite the `dispatch.go:123-127` -docstring (the "by design, SEA-1641 tracks" text) to describe the recoverable +docstring (the "by design, RIG-1641 tracks" text) to describe the recoverable path; end-to-end pgtest: post a mention at an offline unsubscribed member ⇒ owed row + wake fired; simulated start (`OnSessionStarted`) ⇒ the mention arrives as exactly one STEER; ack ⇒ row cleared, second start sweeps nothing; diff --git a/docs/designs/product/compass-message-surface-rendering/design.md b/docs/designs/product/compass-message-surface-rendering/design.md index 622f0f844..68f399bde 100644 --- a/docs/designs/product/compass-message-surface-rendering/design.md +++ b/docs/designs/product/compass-message-surface-rendering/design.md @@ -1,9 +1,9 @@ -# Compass message surface — virtualized thread list + streaming markdown (SEA-1332) +# Compass message surface — virtualized thread list + streaming markdown (RIG-1332) Status: Active Docs-only record; implementation is a separate follow-on lane that rebases onto -franklin's SEA-1337 ChannelView restructure (seam stated in §Approach). +franklin's RIG-1337 ChannelView restructure (seam stated in §Approach). ## Problem / Intent @@ -64,7 +64,7 @@ grouping derivation, `MentionText`/`AskBlock` behavior is preserved, and the **Decision: `createVirtualizer` from `@tanstack/solid-virtual` in chat mode (`anchorTo: 'end'` + `followOnAppend`), variable-size over the THREAD list, -with the scroll container being the post-SEA-1337 `.conv-stream`.** +with the scroll container being the post-RIG-1337 `.conv-stream`.** *What is virtualized.* The list unit is a **thread**, not a message: the stream today is `` → `ThreadView` (`ChannelView.tsx:343-351`), @@ -117,7 +117,7 @@ provides it natively and we adopt it rather than hand-rolling: `!isAtEnd()` is deliberately OUT of scope (non-goal creep; OQ-3 notes it as the natural follow-on). -*Where it sits — the SEA-1337 seam (pending #841 merge).* SEA-1337 +*Where it sits — the RIG-1337 seam (pending #841 merge).* RIG-1337 restructures the `ChannelView` wrapper into a flex-row; the scroller is designed against franklin's POST-restructure shape (his PR #841, live but unmerged — line numbers below are its head and shift on rebase): @@ -307,13 +307,13 @@ override that renders link labels verbatim, so mentions never chip in link text. The **native side** (the Rust `tauri-plugin-opener` registration + the opener capability/permission in the Tauri shell's `capabilities`) lands with the -compass Tauri shell lane (SEA-1022; no `src-tauri` crate exists on main yet, +compass Tauri shell lane (RIG-1022; no `src-tauri` crate exists on main yet, verified) — this lane's T1/T5 own the JS dep + interception and the impl notes the native capability as a cross-lane dependency, so the no-navigation behavior is not falsely claimed deployable before the shell wires the permission. T4 pins that a message link does not navigate the app (the interception handler fires); the end-to-end external open is a shell-lane -integration check. Until SEA-1022 wires the native opener capability, this +integration check. Until RIG-1022 wires the native opener capability, this lane's merge delivers only the interception + no-navigation guarantee: an activated link neither navigates the app nor opens externally (`openUrl` rejects with no registered capability). T6 acceptance and the PR body must @@ -507,7 +507,7 @@ Every task below inherits these; task briefs do not restate them. `/channel-(first|primary)/i` or `/design\s+compass-0\.6\b/i` (`design-citations.test.ts:38-48`). - **Rebase-onto-franklin:** implementation branches from franklin's landed - SEA-1337 ChannelView restructure (PR #841) and takes the + RIG-1337 ChannelView restructure (PR #841) and takes the `.conv-body-row`/`.conv-main` wrapper as found; no task edits the wrapper. - **Tests: `moon run compass-ui:ci`** = typecheck + build + test (`moon.yml:32-35`); test = `bun test --conditions browser @@ -515,7 +515,7 @@ Every task below inherits these; task briefs do not restate them. load-bearing (Bun's default `node` condition pulls solid-js's SSR build, `moon.yml:25-28`). Red→green per `rule://red-green-testing`: tests first, watch them fail, then implement. -- **No planning metadata in source** — SEA-1332 appears in commit subjects / +- **No planning metadata in source** — RIG-1332 appears in commit subjects / PR body only, never in code comments. ### T1 — Dependencies @@ -640,7 +640,7 @@ scope here rather than discovered mid-impl. **Link/image safety** per fork `@tauri-apps/plugin-opener` (never in-app navigation) and renders link labels from raw text value, so mentions never chip inside a link (no text-node ancestry check — the text hook has no ancestor pointer); images -disallowed-or-transformed. Native opener capability is the SEA-1022 shell +disallowed-or-transformed. Native opener capability is the RIG-1022 shell lane's (cross-lane dependency, not owned here); until it lands, an activated link neither navigates nor opens (`openUrl` rejects) — this lane ships the interception guarantee only. @@ -672,19 +672,19 @@ follow-at-bottom, no-yank-when-scrolled-up, prepend-no-jump, and that **Link-open completion gate (cross-lane).** External link-opening is not "done" on this lane's merge. This lane delivers only the interception + -no-navigation guarantee — `openUrl` rejects until the SEA-1022 shell lane +no-navigation guarantee — `openUrl` rejects until the RIG-1022 shell lane registers `tauri_plugin_opener::init()` and grants the opener capability, so every rendered link is inert (intercepted, neither navigating nor opening) on an otherwise-green CI. The link-open feature is marked complete only when -an SEA-1022-owned end-to-end integration check (real webview: activate a +an RIG-1022-owned end-to-end integration check (real webview: activate a message link → external open, no in-app navigation) passes. That check is a -required gate on the SEA-1022 shell lane and a named prerequisite dependency +required gate on the RIG-1022 shell lane and a named prerequisite dependency of this record's link contract, tracked as a blocking cross-lane edge — not a box this lane's green CI can tick. The PR body states this explicitly so link-open is never reported done on the strength of this PR alone. Interfaces: consumes the `ci` task graph (`moon.yml:32-35`). Produces: the -merge-ready implementation PR (SEA-1332 in subject/body only). +merge-ready implementation PR (RIG-1332 in subject/body only). ## Tasks @@ -740,7 +740,7 @@ load-bearing ones) were ratified by Matt on 2026-07-21, both as recommended** in code. - **OQ-2 (non-load-bearing; deferred-decision, not blocking impl order) — who owns the stale ACP comment rewrite.** The `Block` doc comment - (`ChannelView.tsx:150-152`) is stale ACP vocabulary; franklin's SEA-1337 + (`ChannelView.tsx:150-152`) is stale ACP vocabulary; franklin's RIG-1337 lane may run its own comment sweep. Recommendation: this lane rewrites it — T5 rewrites the surrounding code anyway, and a one-comment dependency on another lane's sweep is coordination overhead for nothing. If franklin's @@ -752,7 +752,7 @@ load-bearing ones) were ratified by Matt on 2026-07-21, both as recommended** 30-150 is defensible. Recommendation: ship 80, tune by hand once the virtualized surface is usable. Also parked here: a "jump to latest" pill driven by `!isAtEnd()` is the natural follow-on affordance but is scope - creep for SEA-1332 — recommend a follow-up ticket, not this lane. + creep for RIG-1332 — recommend a follow-up ticket, not this lane. - **OQ-4 (non-load-bearing; cosmetic, defaulted) — Shiki theme pair.** Recommendation: `github-dark-default` + `github-light-default` as the initial pair (neutral, maintained, matches the UI's palette direction); diff --git a/docs/designs/product/compass-native-app/design.md b/docs/designs/product/compass-native-app/design.md index dee3a2caa..98e177b8c 100644 --- a/docs/designs/product/compass-native-app/design.md +++ b/docs/designs/product/compass-native-app/design.md @@ -2,7 +2,7 @@ Status: Draft Supersedes: DL-044 (compass-tauri-shell) -Linear: SEA-1662 +Linear: RIG-1662 > **Superseded in part by the client-only pivot > ([`../compass-native-client-only/design.md`](../compass-native-client-only/design.md), @@ -36,7 +36,7 @@ Linear: SEA-1662 ## Problem / Intent Compass today is a headless Go stack (`compass-server` + `compass-runner`) plus a -browser-dev-only SolidJS UI; there is no installable native app. SEA-1662 requires +browser-dev-only SolidJS UI; there is no installable native app. RIG-1662 requires ONE native binary with TWO modes: **embedded** (the app launches and supervises the whole single-user stack locally — server, runner, and their prerequisites) and **native-client** (the same app connects to an already-established remote server @@ -291,7 +291,7 @@ stays blocked until both merge. ### Two binaries (a client app + a separate "server pack") Ship the native client alone and leave the embedded stack to a separate -installer/systemd unit. Rejected: it forfeits the SEA-1662 charter ("a single +installer/systemd unit. Rejected: it forfeits the RIG-1662 charter ("a single user runs the entire Compass stack as one native application with nothing else to stand up") — the single-user path would still require standing up a second artifact, and the two artifacts' version skew becomes a support surface. The @@ -345,7 +345,7 @@ lifecycle simplifies to nothing. Raised with the compass-server owner as a seam. ### How the framework choice was isolated (now decided: Wails v3) -SEA-1662 reserved the framework fork to Matt, so the record was held +RIG-1662 reserved the framework fork to Matt, so the record was held framework-agnostic — the choice lands in just two files (the UI-side IPC shim, the shell project scaffold). Matt ruled it **Wails v3** (DL-110; the Tauri-vs-Wails tension and reasoning trail are in §Decisions/OQ1). The isolation kept that @@ -628,7 +628,7 @@ the contract the executing lanes read. events rather than adapted from the existing file. - **Both share the webview risk.** WebKitGTK on Linux is the weak point for either (both use the system webview), so the Linux rendering story does not - differentiate them. A deferred native-path rendering endgame (SEA-1006) + differentiate them. A deferred native-path rendering endgame (RIG-1006) would replace the webview under either choice and slightly favors not over-investing in framework-specific surface. diff --git a/docs/designs/product/compass-native-client-mode/design.md b/docs/designs/product/compass-native-client-mode/design.md index 2e38a033c..874b67be0 100644 --- a/docs/designs/product/compass-native-client-mode/design.md +++ b/docs/designs/product/compass-native-client-mode/design.md @@ -1,4 +1,4 @@ -# Compass-native T5 — native-client mode end to end (SEA-1686) +# Compass-native T5 — native-client mode end to end (RIG-1686) Status: Draft diff --git a/docs/designs/product/compass-native-client-only/design.md b/docs/designs/product/compass-native-client-only/design.md index 8a19aa514..30a8801c5 100644 --- a/docs/designs/product/compass-native-client-only/design.md +++ b/docs/designs/product/compass-native-client-only/design.md @@ -122,7 +122,7 @@ teardown mechanism (`stack.pgids`, fresh-`down` signaling) stays with | Surface | Disposition | Grounding | | --- | --- | --- | -| `go/cmd/compass-app/embedded.go` — `embeddedPipeline`, `runEmbedded`, `stackUpArgs`/`stackDownArgs`, `runStackUp`/`runStackDown`, `captureStderr`, `whoAmIOverUDS`, `resolveStackBin`, `prependExecDirToPath`, `resolveImage`, `embeddedDatabaseDSN`, `realPreflight`, `classifyPreflight` | **RETIRE** (delete; `runClient` and the shared resolvers move to a client-named file) | `embedded.go:3-16` (file header: "The embedded-mode launch pipeline (SEA-1685 T4.1)"); `runClient` lives here today (`embedded.go:115-147`) and is KEPT | +| `go/cmd/compass-app/embedded.go` — `embeddedPipeline`, `runEmbedded`, `stackUpArgs`/`stackDownArgs`, `runStackUp`/`runStackDown`, `captureStderr`, `whoAmIOverUDS`, `resolveStackBin`, `prependExecDirToPath`, `resolveImage`, `embeddedDatabaseDSN`, `realPreflight`, `classifyPreflight` | **RETIRE** (delete; `runClient` and the shared resolvers move to a client-named file) | `embedded.go:3-16` (file header: "The embedded-mode launch pipeline (RIG-1685 T4.1)"); `runClient` lives here today (`embedded.go:115-147`) and is KEPT | | `go/cmd/compass-app/main.go` `launch` embedded arm + `bringUpTimeout` + `--socket`/`--image`/`--compass-stack` flag plumbing + `resolveSocket` | **RETIRE** (the switch collapses to the client arm; `default:` rejection stays) | `main.go:240-265`; `main.go:45-49` (`bringUpTimeout` doc: "bounds the whole embedded bring-up") | | `go/cmd/compass-app/preflight_adapters.go`, `go/cmd/compass-app/lifecycle.go` (+ `lifecycle_test.go`), embedded tests (`embedded_test.go`, `embedded_path_test.go`, `cross-process` podman tests) | **RETIRE (whole files)** — `lifecycle.go` is wholly the embedded `quitController` ("Quit and stop stack" → `compass-stack down`; `//go:build unix && gtk3`, `lifecycle.go:1-16`), not a file with a keep-half | `lifecycle.go:3-16` (file header: embedded QUIT lifecycle on the DL-108 contract); `lifecycle.go:43-49` (`quitController` holds the `stackDown` seam) | | `go/internal/preflight` (whole package: `preflight.go`, `uid.go`, `doc.go`, tests) | **RETIRE** — orphaned by T-1: its only module-wide importers are `cmd/compass-app/{embedded.go:38, embedded_test.go:36}` + `preflight_adapters.go`, all deleted here | `grep internal/preflight` across `go/` → 3 hits, all in the deleted embedded surface (`embedded.go:38`, `embedded_test.go:36`, `preflight_adapters.go:4`) | diff --git a/docs/designs/product/compass-notification-delivery/design.md b/docs/designs/product/compass-notification-delivery/design.md index 2eb198102..7ca7f917a 100644 --- a/docs/designs/product/compass-notification-delivery/design.md +++ b/docs/designs/product/compass-notification-delivery/design.md @@ -9,7 +9,7 @@ Status: Active > `../compass-0.6/design.md` (RT-2 home channel, RT-3 turn-end delivery, the > delivery-timing amendment) and the merged Server-ownership-layer record > (`../compass-server-ownership-layer/design.md`, #995) are consumed and cited, -> never re-decided. Tracker: SEA-1569. Lane: compass-comms (driver); +> never re-decided. Tracker: RIG-1569. Lane: compass-comms (driver); > co-owned pieces are named per task. ## Problem / Intent @@ -22,7 +22,7 @@ feeds only the Client-facing `SubscribeComms` stream (`subscribe.go:31-44`). The agent-bound seam exists but is inert: the `AgentControl` oneof already carries `deliver = 3` (`compass/proto/compass/v1/agent.proto:122`), yet `DeliverControl` is an empty shell (`agent.proto:153-154`: "Empty shells — -payload fields parked (SEA-1310)") and the Runner's control lane refuses to send +payload fields parked (RIG-1310)") and the Runner's control lane refuses to send one (`gateway/control.go:65-70`, `errEmptyControlVariant`). Nothing bridges a `MessagePosted` to a running session — Matt: "if you send a message to an agent's home channel and it doesn't get delivered the whole app is unusable" @@ -71,13 +71,13 @@ notifications (#995) ride. and counts them unmapped while the shells are empty (`compass/packages/compass-agent/src/transport/control-source.ts:20-24, 353-377`). -- **SEA-1310 §8 proto state**: `AgentControl.deliver = 3` exists +- **RIG-1310 §8 proto state**: `AgentControl.deliver = 3` exists (`compass/proto/compass/v1/agent.proto:122`) but `DeliverControl {}` is an empty shell (`agent.proto:153-154`), and the Runner refuses to send an empty shell (`gateway/control.go:65-70`). `AgentFrame` has no `delivery_ack` variant today (`agent.proto:40-68`; grep `DeliveryAck` matches only the design-record citation in comments, `agent.proto:56`, `:159`). The proto delta below is - co-owned: it lands as compass-spec's consolidated SEA-1310 follow-up, in + co-owned: it lands as compass-spec's consolidated RIG-1310 follow-up, in coordination with compass/compass-agent — never unilaterally from this lane. - **#995 Server ownership layer** (merged 2026-07-30, `../compass-server-ownership-layer/design.md`): Decision 5 freezes the forge @@ -373,12 +373,12 @@ workstream. ### D3 — `DeliverControl` payload: the first-party `compass.v1.Message`; the ack is the message id -**The SEA-1310 parking reason does not apply here.** The shells were parked +**The RIG-1310 parking reason does not apply here.** The shells were parked because "their fields carry an inbound SDK `AgentMessage` (a four-way union with an opaque provider payload)… neither of which any existing compass.v1 message represents" (`agent.proto:103-112`). A channel post is not that: it is a first-party `compass.v1.Message` (`comms.proto:234-251`), fully representable -today — and SEA-1310 §1's opaque-SDK parking applies to steer+config, not +today — and RIG-1310 §1's opaque-SDK parking applies to steer+config, not deliver, so deliver un-parks independently. The payload contract is resolved with the compass-agent co-owner (OQ-2, resolved): @@ -414,7 +414,7 @@ regenerate imported public types into the internal trees (`comms.proto:258-264`), threading needs `parent_message_id`, and any projection becomes a second message schema to keep in sync. The agent formats what it needs from the full shape. compass-agent has confirmed exactly this -(full `Message`, agent formats from structured fields, citing SEA-1310), so +(full `Message`, agent formats from structured fields, citing RIG-1310), so OQ-2 is a documented resolution, not an open fork. **Mention-borne steer gets the same treatment.** The frozen model routes an @@ -422,7 +422,7 @@ OQ-2 is a documented resolution, not an open fork. (`../compass-0.6/design.md:425-430`) — also a first-party `Message`. So the channel-borne `SteerControl` carries the same single `Message` field (no seq; the id is in the Message). The generic SDK-`AgentMessage` steer (a -Runner-originated steer outside any channel) stays parked under SEA-1310; +Runner-originated steer outside any channel) stays parked under RIG-1310; nothing here re-opens it. **Ack timing.** RT-3 says the ack is emitted "on delivery" @@ -595,12 +595,12 @@ proto work — yet grep finds no production sender of `AgentControl_AskAnswer` (channel delivery / mentions / presence / forge), so this record does not build it, but the generic `DispatchControl` rail makes it a small follow-up: a `RespondToAsk` hook calling the same `ControlDispatcher` (T3) — filed as -**SEA-1577** (comms/agent lane owns; Refs SEA-1569), per OQ-8's ratification +**RIG-1577** (comms/agent lane owns; Refs RIG-1569), per OQ-8's ratification (Matt, 2026-07-29). ## Global Constraints -- **SEA-1267 gen fence.** Internal symbols (`AgentFrame`, `AgentControl`, +- **RIG-1267 gen fence.** Internal symbols (`AgentFrame`, `AgentControl`, `DeliverControl`, `SteerControl`, `DeliveryAck`, …) MUST NOT leak into the public gen trees `packages/compass-client/src/gen` or `go/gen`; the fence greps for them (`compass/proto/moon.yml:121-151`). `DeliveryAck` and any @@ -616,7 +616,7 @@ a `RespondToAsk` hook calling the same `ControlDispatcher` (T3) — filed as Decision 5 are consumed as written; a task that would deviate stops and escalates rather than reinterpreting. - **Proto co-ownership.** Every `agent.proto`/`runner.proto` change here lands - as part of compass-spec's consolidated SEA-1310 follow-up, coordinated with + as part of compass-spec's consolidated RIG-1310 follow-up, coordinated with compass-agent — one schema PR, both sides regenerate (`buf generate` all three lanes, `moon.yml:50-71`), drift + gen-fence + breaking gates green. - **Red-green testing.** Every task writes its failing test first @@ -660,8 +660,8 @@ independent editor to be discovered at a red drift-gate. `message DispatchControl { string session_id = 1; AgentControl op = 2; }`; `deliver_control` takes `command = 11` — the number ASSIGNED by compass-repo's canonical oneof allocation (`forge_notification = 7`, - `secrets_version = 8` SEA-1327, `config_version = 9` SEA-1568, - `remove = 10` #1019, `deliver_control = 11` SEA-1569 — the block 7-11 + `secrets_version = 8` RIG-1327, `config_version = 9` RIG-1568, + `remove = 10` #1019, `deliver_control = 11` RIG-1569 — the block 7-11 reserved), ratified by compass-repo on `#svc.compass` (2026-07-29) and confirmed to this lane by DM. This lane CONSUMES the assigned number; the actual `.proto` edit is authored by compass-repo at implementation time @@ -679,7 +679,7 @@ independent editor to be discovered at a red drift-gate. agent_presence_changed = 17` (16 is `resync_required`, `comms.proto:390`); `enum AgentPresence { UNSPECIFIED; IDLE; WORKING; WAITING; OFFLINE }` (four states per OQ-1's ratification — still PUBLIC, NOT gen-fenced, - SEA-1267). + RIG-1267). - Gen fence: add `\bDeliveryAck\b` and `\bDispatchControl\b` to `moon.yml:151`'s pattern. - Test cycle: `buf lint` + `buf breaking` + regen all three lanes + drift + @@ -945,7 +945,7 @@ non-load-bearing and merges on the recommendation. No open fork remains. this record's recommendation: full first-party `Message`, agent formats from structured fields (server fans structured Messages; agent renders, coalesces, acks). Deliver un-parks independently of steer/config — - SEA-1310 §1's opaque-SDK parking applies to steer+config, not deliver. No + RIG-1310 §1's opaque-SDK parking applies to steer+config, not deliver. No Matt ask needed; the record's freeze ratifies. Kept here as a documented resolution, not an open fork. - **OQ-3 (load-bearing) — mention-vs-deliver interaction. RATIFIED (Matt, @@ -1008,13 +1008,13 @@ non-load-bearing and merges on the recommendation. No open fork remains. Forward note, scoped OUT: Matt is separately considering a2a channel mutexes/locks (an "… is typing" equivalent); not designed here. - **OQ-8 (NEW) — ask-answer push ownership. RATIFIED (Matt, 2026-07-29): - separate follow-up, filed and owned — SEA-1577.** The `RespondToAsk` → + separate follow-up, filed and owned — RIG-1577.** The `RespondToAsk` → `AgentControl.ask_answer` wake (see D6's scope note) rides the exact rail this record builds and needs zero proto work, but is outside Item-6's enumerated scope (channel delivery / mentions / presence / forge). It is a separate small follow-up — a `RespondToAsk` hook calling T3's - `ControlDispatcher` — owned by the comms/agent lane, filed as **SEA-1577** - (team SEA, project Compass, P2, Refs SEA-1569). + `ControlDispatcher` — owned by the comms/agent lane, filed as **RIG-1577** + (team SEA, project Compass, P2, Refs RIG-1569). ## Ledger impact diff --git a/docs/designs/product/compass-server-ownership-layer-amendment/design.md b/docs/designs/product/compass-server-ownership-layer-amendment/design.md index 086599ea0..c076c39f1 100644 --- a/docs/designs/product/compass-server-ownership-layer-amendment/design.md +++ b/docs/designs/product/compass-server-ownership-layer-amendment/design.md @@ -444,7 +444,7 @@ agent's control lane → chat ping lands. Proposed DECISIONS.md rows — pure append under **Comms & tools** (the #995 forge rows' home, DECISIONS.md:99-103). On current `main` (after #1035 renumbered the duplicate DL-071 to DL-091) the highest allocated id is DL-091 -(DECISIONS.md:129), DL-082..089 are reserved for #1021 (SEA-1570, in flight), +(DECISIONS.md:129), DL-082..089 are reserved for #1021 (RIG-1570, in flight), and DL-056..066 is an older unexplained gap. The next free id above the reserved band is **DL-092**, which this amendment proposes. (The single-writer owns the final id; only the id cell changes.) The placement-correction row diff --git a/docs/designs/product/compass-server-ownership-layer/design.md b/docs/designs/product/compass-server-ownership-layer/design.md index 7e2bb52dc..dde922d1e 100644 --- a/docs/designs/product/compass-server-ownership-layer/design.md +++ b/docs/designs/product/compass-server-ownership-layer/design.md @@ -13,7 +13,7 @@ below was verified against the working tree this run; paths are repo-relative under `` unless otherwise pathed, so the record survives the decided move of the Compass tree to `RigelBuild/compass`. -Tracker: SEA-1364. +Tracker: RIG-1364. ## Problem / Intent @@ -1504,7 +1504,7 @@ rather than left as an aspiration a green test would appear to satisfy. `ignore_only` entry. Adding one is out of scope: the existing exemptions are pre-launch removals that must be *removed* at launch (`buf.yaml:63-64`), not a list to grow. -- **SEA-1267 gen-fence.** `gen-fence` greps the two PUBLIC gen trees for +- **RIG-1267 gen-fence.** `gen-fence` greps the two PUBLIC gen trees for internal-only symbols (`proto/moon.yml:141`). The grep list already contains the unanchored prefixes `AgentGateway` and `CommsCall`; the new `ForgeCall*`/`RelayForgeCall*`/`ForgeNotification` families are **not** @@ -2785,7 +2785,7 @@ place. Revisit when the guard is observed to be throttling in normal operation > `SpawnPeerRequest`) are **deleted**, not left optional — a spawned/provisioned > agent is given a git credential + workspace and clones for itself after > launch. The frozen ruling below stands as the reasoning; only the "optional" -> realization in (2) is superseded. Durable record: SEA-1527; the ledger row +> realization in (2) is superseded. Durable record: RIG-1527; the ledger row > DL-090 (authored by the design-ledger single-writer) lands via sealed#1019. **Ruling: it never resolves, because it is always explicit. `repo` is REQUIRED diff --git a/docs/designs/product/compass-session-trace-diff.md b/docs/designs/product/compass-session-trace-diff.md index 9220fc613..9567a604f 100644 --- a/docs/designs/product/compass-session-trace-diff.md +++ b/docs/designs/product/compass-session-trace-diff.md @@ -1,8 +1,8 @@ -# Compass session-trace DiffBlock: real line diff (SEA-1350) +# Compass session-trace DiffBlock: real line diff (RIG-1350) Status: Active -Tracking: SEA-1350 (two advisory findings from the PR #847 review-of-record, +Tracking: RIG-1350 (two advisory findings from the PR #847 review-of-record, Matt-ruled deferred to this follow-up). UI-only; walking-skeleton renderer scope. Parent contract: the frozen compass-0.8 threading/renderer record scopes the Compass UI as a no-daemon walking skeleton @@ -62,7 +62,7 @@ export interface FileDiff { } ``` -`FileDiff` mirrors a proto shape on the SEA-1342 go/proto lane; the UI only +`FileDiff` mirrors a proto shape on the RIG-1342 go/proto lane; the UI only consumes it. The diff is computed client-side from the whole-file old/new pair, for display only. @@ -209,7 +209,7 @@ read inside `` exactly as today must pass; biome-clean. - UI-only: no `compass.v1` contract change, no transport change, no `FileDiff` shape change (`session-events.ts:22-27` mirrors a proto on the - SEA-1342 lane), no daemon. + RIG-1342 lane), no daemon. - One new npm dependency: `diff` (jsdiff), the line-level Myers engine (fork a — Matt ruled use a diff library). `diff@9.0.0`: BSD-3-Clause (compatible with the UI's AGPL-3.0-only), zero deps and zero peer deps, diff --git a/docs/designs/product/compass-shell-routing/design.md b/docs/designs/product/compass-shell-routing/design.md index 0d71f0d6c..b35c2031e 100644 --- a/docs/designs/product/compass-shell-routing/design.md +++ b/docs/designs/product/compass-shell-routing/design.md @@ -1,7 +1,7 @@ # Compass shell routing (@solidjs/router adoption) Status: Draft -Tracker: SEA-1693 +Tracker: RIG-1693 Ledger-impact: reserves DL-127 (shell-routing: @solidjs/router adoption + routes-vs-store source-of-truth call, one row); compass appends at ship ## Problem / Intent @@ -11,12 +11,12 @@ The Compass ADE shell dispatches its six surfaces from an in-memory signal — "agent" | "bridge" | "backlog" | "done" | "settings"`, store.ts:75-81) — with zero URL routing anywhere in `apps/ui` (no `window.location` / `location.hash` / `hashchange` / `history.pushState` / `@solidjs/router` usage; grep-confirmed -empty). SEA-1655's frozen deep-link `#/channel//topic/` +empty). RIG-1655's frozen deep-link `#/channel//topic/` (compass-zulip-threading-model §D5, design.md:272-273 "Deep-link route `#/channel//topic/`"; §T5 design.md:704) and general shareable/bookmarkable/back-button navigation require real URL routing. This record introduces it as a shell-wide routing layer: the router base merges -first, then SEA-1655 T5 stacks the topic route on it. +first, then RIG-1655 T5 stacks the topic route on it. ## Approach @@ -45,7 +45,7 @@ selection that today lives only in signals: | --- | --- | --- | | `/` | `` (`view() === "bridge"`, App.tsx:111-113) | Default surface, matching the boot default `createSignal("bridge")` (store.ts:654). | | `/channel/:channelId` | `` (App.tsx:114-116) | `:channelId` replaces bare `selectedChannelId` for this surface. | -| `/channel/:channelId/topic/:topicId` | Topic view — **SEA-1655 T5, not this record** | Reserved here so the frozen deep-link nests under the channel segment; T5 adds the ``. | +| `/channel/:channelId/topic/:topicId` | Topic view — **RIG-1655 T5, not this record** | Reserved here so the frozen deep-link nests under the channel segment; T5 adds the ``. | | `/agent/:agentId` | `` (Switch fallback, App.tsx:110) | The fallback becomes an explicit param route. | | `/backlog` | `` (App.tsx:117-119) | | | `/done` | `` (App.tsx:120-122) | | @@ -54,7 +54,7 @@ selection that today lives only in signals: Under HashRouter these render as `#/`, `#/channel/`, `#/agent/`, etc. — the `#/channel//topic/` string is exactly the frozen -SEA-1655 route. +RIG-1655 route. The shell chrome (topbar, sidebars, `UsageBar`) stays outside the routed region: `App` becomes the root layout route and only the `
` @@ -123,7 +123,7 @@ inbound location to the store. Rationale: there is no second copy of the truth to reconcile. - The mirror alternative (store stays truth, an effect writes `location.hash` and a `hashchange` listener writes back) keeps TWO authorities and needs - loop-breaking guards in both directions; every future route (SEA-1655's + loop-breaking guards in both directions; every future route (RIG-1655's topic, and anything after) pays that tax again. - The churn is bounded but **not zero**. Components keep their read surface: `store.view()` and `store.selectedChannelId()` stay signals, written by the @@ -271,14 +271,14 @@ action-then-assert sites is explicit T3 scope (§Plan), not incidental. ### A5 — Native-seam composition (flagged for compass-native co-review) Routing sits entirely ABOVE the transport/connection boundary (DL-106/107). -Invariant this section preserves (verbatim, from the SEA-1688 owner): +Invariant this section preserves (verbatim, from the RIG-1688 owner): > The transport boundary is the ONLY seam — nothing above it (the router > included) may assume local/embedded. A deep-link/route MUST resolve to the > same `createGrpcWebTransport({fetch})` call regardless of > embedded-vs-native-client mode; the provider-supplied fetch > (WHATWG-compatible) is the single injection point (DL-106). The -> ConnectionProvider interface (SEA-1688) exposes that fetch and carries ZERO +> ConnectionProvider interface (RIG-1688) exposes that fetch and carries ZERO > Wails/shell type, so apps/ui has zero shell dependency. Consequences for this record: a route change never dials anything and never @@ -288,12 +288,12 @@ transport seam `createLiveClients` owns (`live/client.ts:30-35`) — the single place transport is chosen. The mode difference is a `fetch` swap *below* the store: `createGrpcWebTransport({fetch})` with the dev default fetch or the shell's `compass_rpc` custom fetch (`daemon-transport.ts:8-13`), the identical -call. That fetch injection into `createLiveClients` is SEA-1688 T1 work and is +call. That fetch injection into `createLiveClients` is RIG-1688 T1 work and is not yet wired (`client.ts:30-35` today constructs clients without a `fetch` param); routing sits above the seam `createLiveClients` **will** expose, so it is unaffected either way. Deep-links resolve identically in embedded and native-client mode, and the routing layer imports nothing from any shell/Wails -API. The ConnectionProvider fetch/provider TS signature is SEA-1688's own +API. The ConnectionProvider fetch/provider TS signature is RIG-1688's own record — not designed here. Caller identity is **not** a routing concern: the route-sync effect only moves @@ -320,7 +320,7 @@ webview (DL-110); there is no server rendering HTML to hook. Path routing needs a server that answers every deep route with the app shell; in a webview loading a static bundle, a refresh on `/channel/x` 404s or blanks. -HashRouter is precisely why SEA-1655's frozen route is spelled `#/...`. +HashRouter is precisely why RIG-1655's frozen route is spelled `#/...`. ### Keep in-memory dispatch (status quo) — rejected @@ -351,11 +351,11 @@ the first-party router already provides — and forfeits the SolidStart on-ramp supersedes no active row) — appended by the ledger single-writer at ship (freeze = merge), not by this record. - Router base only — the `/channel/:channelId/topic/:topicId` route component - is SEA-1655 T5's, stacked on this base. + is RIG-1655 T5's, stacked on this base. ## Plan -Router base only (SEA-1655 T5 stacks separately). Every task inherits +Router base only (RIG-1655 T5 stacks separately). Every task inherits `## Global Constraints`. **Sequencing — one PR.** T1, T2, and T3 land together as a single PR. T1 alone @@ -466,7 +466,7 @@ touches real `location.hash`. effect writes `location.hash`, a listener applies inbound changes) keeps every reader and test synchronous but pays a bidirectional loop guard re-paid per future route. **Decision: routes-as-truth, async cost accepted** — idiomatic - Solid Router, free back/forward/deep-link, and SEA-1655 T5 stacks on it + Solid Router, free back/forward/deep-link, and RIG-1655 T5 stacks on it cleanly. - **Non-load-bearing (deferred):** SolidStart SSR migration for hosted-Compass. Documented as the forward-compat rationale only; diff --git a/docs/designs/product/compass-sidebar-pins-unreachable-amendment/design.md b/docs/designs/product/compass-sidebar-pins-unreachable-amendment/design.md index 32ef22603..48deda71e 100644 --- a/docs/designs/product/compass-sidebar-pins-unreachable-amendment/design.md +++ b/docs/designs/product/compass-sidebar-pins-unreachable-amendment/design.md @@ -2,9 +2,9 @@ Status: Active -Tracker: SEA-1645. +Tracker: RIG-1645. -Amends: `compass-sidebar-pins` (SEA-1632, DL-096) §T2/§T3. +Amends: `compass-sidebar-pins` (RIG-1632, DL-096) §T2/§T3. Ledger: this record's PR appends DL-098 to `docs/designs/product/DECISIONS.md` in the same diff (see §Ledger delta). @@ -14,7 +14,7 @@ ledger gate's touch-coupling leg is satisfied directly; no `Ledger-impact:` escape hatch is needed in the PR body. > **Amends `compass-sidebar-pins` (frozen).** This record is a sibling -> amendment to `docs/designs/product/compass-sidebar-pins/design.md` (SEA-1632, +> amendment to `docs/designs/product/compass-sidebar-pins/design.md` (RIG-1632, > DL-096). The merged record is frozen; per sealed convention a later change > ADDS a record. This amendment supersedes the frozen record's §T2 > unresolvable-pin filtering and §T3 fluctuation-coercion clauses per Matt's @@ -114,7 +114,7 @@ the new contract. Both superseded clauses live in the frozen `docs/designs/product/compass-sidebar-pins/design.md` (Status: Active, -Tracker SEA-1632, ledger DL-096). Everything else in that record — the +Tracker RIG-1632, ledger DL-096). Everything else in that record — the configurable pin layer, Supervisor/Warden removal, empty default set, per-workspace persistence, boot-on-first-resolvable-pin, the tree affordance — stands unchanged. diff --git a/docs/designs/product/compass-sidebar-pins/design.md b/docs/designs/product/compass-sidebar-pins/design.md index 36a0d45dc..ef9cfc52e 100644 --- a/docs/designs/product/compass-sidebar-pins/design.md +++ b/docs/designs/product/compass-sidebar-pins/design.md @@ -2,7 +2,7 @@ Status: Active -Tracker: SEA-1632. +Tracker: RIG-1632. Ledger: this record's PR appends DL-096 to `docs/designs/product/DECISIONS.md` in the same diff (see §Ledger delta) and @@ -211,12 +211,12 @@ that is its own record. `parent_agent_id`, and are never a hole in the tree — a pinned agent is also in the tree (DL-095, frozen). No server model change ships in this record. -- **Roles are SEA-1623.** The `supervisor`/`warden` *role* vocabulary +- **Roles are RIG-1623.** The `supervisor`/`warden` *role* vocabulary survives this record untouched — e.g. the tree row's role pip (`LeftSidebar.tsx:52-55`: `` … `{a().role === "supervisor" ? "◆" : "🛡"}`) still keys glyphs off the role. That is a role-vocabulary echo, flagged here as downstream cleanup - for SEA-1623, not redesigned: this record removes the pin *hardcoding*, + for RIG-1623, not redesigned: this record removes the pin *hardcoding*, not the role concept. - **Board and tree surfaces** are Record C's and its downstream tasks'; nothing here reorders lanes or filters trees. @@ -261,7 +261,7 @@ common abstraction now is speculative generality with one real consumer. one activity bar, fleet group above the divider, issue group below; `status` and the issue tabs remain fixed tabs. - **Presentation only**: no proto/server change; the agent tree and - `parent_agent_id` are untouched (Record C owns them); roles are SEA-1623. + `parent_agent_id` are untouched (Record C owns them); roles are RIG-1623. - **Sequencing after Record C**: the code tasks (T2-T5) depend on Record C's every-agent tree derivation. Today's `STUB_TREE` excludes exactly the pair being de-special-cased ("The moat agents are not tree leaves: @@ -371,7 +371,7 @@ sidebar's tree offers pin/unpin. row component (`AgentLeaf`, `LeftSidebar.tsx:34-61`) gains a pin toggle (hover affordance calling `pinAgent`/`unpinAgent`, state from `isPinned`). The role pip in the same row (`LeftSidebar.tsx:52-55`) is - explicitly left alone (SEA-1623). + explicitly left alone (RIG-1623). - Ordering: Record C's tree rebuild rewrites this same `AgentLeaf` component — C's tree derivation lands first, and this task adds the pin toggle onto the derived row (see §Global Constraints). diff --git a/docs/designs/product/compass-slack-thread-rendering.md b/docs/designs/product/compass-slack-thread-rendering.md index ac640c699..251d099ab 100644 --- a/docs/designs/product/compass-slack-thread-rendering.md +++ b/docs/designs/product/compass-slack-thread-rendering.md @@ -1,8 +1,8 @@ -# Compass Slack-model thread rendering (SEA-1352) +# Compass Slack-model thread rendering (RIG-1352) Status: Active -Tracking: SEA-1352. Parent (frozen): +Tracking: RIG-1352. Parent (frozen): `docs/designs/product/compass-0.8-threading-and-session-renderer/design.md`. This record **supersedes by citation** that record's dual-render decision (see Problem); the frozen record itself is never rewritten. @@ -48,7 +48,7 @@ Where the duplication lives today (all cites re-verified against `main`): MessageRow and `.thread-replies` so a posted reply appears in both the panel and the main stream". -The dual render was **specified deliberately** in the frozen SEA-1337 record: +The dual render was **specified deliberately** in the frozen RIG-1337 record: `design.md:110-112` ("`ThreadView` … renders root + replies under `.thread-replies`") and `design.md:372-374` ("composer posts a reply that appears in-panel AND indented in the stream"). This record supersedes exactly @@ -123,7 +123,7 @@ transport / daemon. UI-only, fixture-backed walking skeleton. ## Alternatives considered - **Discord sub-channel model** (a thread as a navigable sub-channel with its - own view) — rejected: Matt ruled Slack model for SEA-1352. Also heavier: it + own view) — rejected: Matt ruled Slack model for RIG-1352. Also heavier: it needs routing/navigation state the walking skeleton doesn't have, vs. reusing the already-shipped `ThreadPanel` + `openThread` store seam unchanged. - **Keep the inline dual render** (status quo per frozen `design.md:372-374`) — diff --git a/docs/designs/product/compass-spawn-control/design.md b/docs/designs/product/compass-spawn-control/design.md index d1e4e0473..c172eafc1 100644 --- a/docs/designs/product/compass-spawn-control/design.md +++ b/docs/designs/product/compass-spawn-control/design.md @@ -15,7 +15,7 @@ re-expressed here as DL-164..DL-171. > `store.addWorkstream`, the `WorkstreamSpec` type, and the "＋ New workstream" > toolbar button. Cards come from the tracker and the Manager builds the tree > (issues are forge-ingested per DL-069/DL-161; the Manager builds the rest per -> DL-095/DL-134; positive replacement SEA-1820). The sections below are +> DL-095/DL-134; positive replacement RIG-1820). The sections below are > reconciled to the surviving start/stop surface — `StartAgentDialog`, the > spawn/stop phase machine, and stop control stay. @@ -59,7 +59,7 @@ with** the container-scoped SHALL at `compass.md:368-370`. *(Port note: the prior record carried a fourth reconciliation — relaxing `ProvisionAgentWorkspace`'s repo requirement for self-clone. That already -shipped in compass under SEA-1527: `ProvisionAgentWorkspaceRequest` no longer +shipped in compass under RIG-1527: `ProvisionAgentWorkspaceRequest` no longer carries a repo (`compass.proto:506-509` — "Repo carriage removed … the agent self-clones"), so it drops from T0's scope entirely, along with the prior record's clone-target-validation and agent-credential prerequisites, which @@ -95,7 +95,7 @@ Baseline RPCs from `proto/compass/v1/compass.proto`, verified this run: - `rpc ProvisionAgentWorkspace(...)` (`compass.proto:54`): `agent_account_id` + `client_request_id` → `container_name`. Repo-less - since SEA-1527 — the container is provisioned with a git credential + + since RIG-1527 — the container is provisioned with a git credential + workspace and the agent self-clones (`compass.proto:506-509`). *(An internal server step of `SpawnAgent`, not a client call — see Control flow.)* @@ -148,7 +148,7 @@ idempotent on an already-live container. **Build-order:** this end-to-end idempotency composes three primitives already built. `provisionDedupID` binds a non-empty `client_request_id` to the agent account through a domain-separated hash, so a retry of the same provision dedups (since -SEA-1527 removed repo carriage, the key derives from account + +RIG-1527 removed repo carriage, the key derives from account + `client_request_id` alone — correct: `client_request_id` is the explicit idempotency key, though two concurrent repo-less spawns for one account are distinguished only by that id). The command router joins a retry whose id is @@ -763,7 +763,7 @@ the compass service-owner. Independent of the UI tasks, so no freeze block. Server orchestrates the existing RunnerHub `Provision` then `Start` (`runnerhub/commands.go:40-88`). *(The internal monorepo's T0 additionally relaxed the repo requirement in `runner/spec.go` and guarded `cloneRepo` — all shipped - in compass under SEA-1527; `BuildSpec` at `spec.go:76-88` already builds a + in compass under RIG-1527; `BuildSpec` at `spec.go:76-88` already builds a repo-less spec. Dropped from scope.)* **Acceptance (end-to-end idempotency):** a retry with the same `client_request_id` returns the same `session_id` and provisions no @@ -890,7 +890,7 @@ agent's cards carries a `sessionId`, every other card has no binding. add-a-workstream board mutation (`addWorkstream`) and UI-side agent creation (`CommsService.CreateAgent`) are dropped — cards come from the tracker (issues forge-ingested, DL-069/DL-161) and the Manager builds the tree -(DL-095/DL-134; positive replacement SEA-1820), not a UI mutation. +(DL-095/DL-134; positive replacement RIG-1820), not a UI mutation. ### DL-165 (port amendment, this record) — live-wired posture diff --git a/docs/designs/product/compass-stack-cross-process-teardown/design.md b/docs/designs/product/compass-stack-cross-process-teardown/design.md index ffb3521ec..831b61c60 100644 --- a/docs/designs/product/compass-stack-cross-process-teardown/design.md +++ b/docs/designs/product/compass-stack-cross-process-teardown/design.md @@ -27,8 +27,8 @@ across the process boundary. Live agent *containers* the runner hosts are NOT in that tree — conmon double-forks them out of the runner's process group — and are scoped OUT of this mechanism; see **Open Question 0** (parked for Matt). -Trackers: parent **SEA-1685** (embedded native app T4); the teardown fork is -**SEA-1880**; the container-teardown companion gap is **SEA-1884**. +Trackers: parent **RIG-1685** (embedded native app T4); the teardown fork is +**RIG-1880**; the container-teardown companion gap is **RIG-1884**. ## Problem / Intent @@ -39,7 +39,7 @@ handles, so a fresh `down` is a silent no-op. This: 1. makes the merged T4.2 embedded **"Quit and stop stack"** action a silent no-op that leaves the stack running, -2. blocks the **T4.3 (SEA-1685) e2e gate** from proving teardown or +2. blocks the **T4.3 (RIG-1685) e2e gate** from proving teardown or process-safely cleaning up the stack it starts, and 3. contradicts the frozen design's `down`-SIGTERMs-the-tree claim. @@ -51,7 +51,7 @@ process group, and the runner does not stop its containers on its own shutdown (`internal/runner/host.go:204-217`: `Close` drops only the per-container socket *listeners*; "every container lives until the Runner process ends" and teardown otherwise lives solely on the `Remove` RPC path). Stopping live containers is a -distinct, runner-lane concern — **Open Question 0** and **SEA-1884**. +distinct, runner-lane concern — **Open Question 0** and **RIG-1884**. ### Evidence (all re-verified in the current tree, this session) @@ -420,7 +420,7 @@ under A's portable path, not replacing it. runner — never signal delivery, and never treating a just-SIGKILled but not-yet-reaped (zombie) group as a failure. 6. **Scope**: the mechanism signals the three supervised stack children only. - Live agent containers are out of scope (Open Question 0 / SEA-1884); this + Live agent containers are out of scope (Open Question 0 / RIG-1884); this record does not silently claim to stop them. 7. **No frozen contract changes**: `up` stays fire-and-return; linger stays the default; no proto changes; DL-108 stays Active. @@ -450,7 +450,7 @@ mismatch detected). (`go/internal/stack/stack.go:171`) and the `Process` handle's pid (`go/internal/stack/adapters/process.go:78-79`, pid == pgid), exposed via a new `Pid() int` on the `stack.Process` seam plus a start-time reader. -- **Lands under:** SEA-1880 (parent SEA-1685). +- **Lands under:** RIG-1880 (parent RIG-1685). ### T2 — `down` reads the pgid file, refuses a live `up`, signals, confirms @@ -479,7 +479,7 @@ behavior. (`go/internal/stack/lockfile.go:87`), `Deps.Prober`/`Deps.DBProber` (`stack.go:157`, `stack.go:264`); rewires `runDown` (`go/cmd/compass-stack/main.go:271-298`). -- **Lands under:** SEA-1880 (parent SEA-1685). +- **Lands under:** RIG-1880 (parent RIG-1685). ### T3 — Staleness / crash / recycling handling @@ -498,7 +498,7 @@ half-spawned prefix). `matches(pgid int, startTime uint64) bool` identity predicate; consumes `lockHolderLive`'s pattern (`go/internal/stack/lockfile.go:62-66`) for the live-`up` refusal only; touches only `go/internal/stack/`. -- **Lands under:** SEA-1880 (parent SEA-1685). +- **Lands under:** RIG-1880 (parent RIG-1685). ### T4 — Wire the app quit path; correct the now-false comment @@ -519,7 +519,7 @@ tests (`lifecycle_test.go`) for the overrun-reporting case. — `stackDownArgs`, `go/cmd/compass-app/embedded.go:207`); produces corrected comments + the overrun-report assertion in `go/cmd/compass-app/lifecycle.go`; no signature changes. -- **Lands under:** SEA-1685 T4.2 follow-up, referenced from SEA-1880. +- **Lands under:** RIG-1685 T4.2 follow-up, referenced from RIG-1880. ### T5 — T4.3 e2e down-assertion + scripted headless CI variant @@ -544,15 +544,15 @@ scope and the record says the container assertion is deliberately absent. `go/cmd/compass-stack/integration_podman_test.go` (or a sibling `crossprocess_test.go`) + a CI script entry; test-only, no production signatures. -- **Lands under:** SEA-1685 T4.3, referenced from SEA-1880. +- **Lands under:** RIG-1685 T4.3, referenced from RIG-1880. ## Tasks -- [ ] T1 — pgid record file (with start-time identity token): capture + persist at `up` (SEA-1880) -- [ ] T2 — `DownDetached`: refuse live `up`, read, signal, escalate, confirm per component; rewire `runDown` (SEA-1880) -- [ ] T3 — staleness/crash/recycling handling; partial-failure survivor rewrite (SEA-1880) -- [ ] T4 — app quit path wiring + false-comment correction + overrun reporting (SEA-1685 T4.2 / SEA-1880) -- [ ] T5 — T4.3 e2e down-assertion (three-children scope) + headless CI variant (SEA-1685 T4.3 / SEA-1880) +- [ ] T1 — pgid record file (with start-time identity token): capture + persist at `up` (RIG-1880) +- [ ] T2 — `DownDetached`: refuse live `up`, read, signal, escalate, confirm per component; rewire `runDown` (RIG-1880) +- [ ] T3 — staleness/crash/recycling handling; partial-failure survivor rewrite (RIG-1880) +- [ ] T4 — app quit path wiring + false-comment correction + overrun reporting (RIG-1685 T4.2 / RIG-1880) +- [ ] T5 — T4.3 e2e down-assertion (three-children scope) + headless CI variant (RIG-1685 T4.3 / RIG-1880) ## Open Questions @@ -571,7 +571,7 @@ scope and the record says the container assertion is deliberately absent. is scoped to the three supervised children (this record's default), and leaving containers running on quit is acceptable / handled elsewhere. - **(b) Yes, via a runner drain-on-SIGTERM contract** — the runner stops its - containers before exiting (a runner-lane change; SEA-1884). + containers before exiting (a runner-lane change; RIG-1884). - **(c) Yes, via engine-level teardown in `DownDetached`** — `podman stop` by a compass-owned *label* (process-safe: the label, never a pattern, selects the set). Adds a container-engine dependency to `down`. @@ -582,12 +582,12 @@ scope and the record says the container assertion is deliberately absent. **Stated assumption this record designs against (overnight, pending Matt): (a)** — "the tree" = the three supervised stack children; live agent containers are OUT of Option A's scope and tracked as a distinct runner-lane - gap (**SEA-1884**). This is the conservative default: it keeps the teardown + gap (**RIG-1884**). This is the conservative default: it keeps the teardown fork self-contained in this lane (no cross-lane proto/runner change gating it), matches the literal frozen text (written about the stack, before containers were a teardown consideration), and treats the runner-not-stopping-its-own- containers gap as the separate bug it is. If Matt rules (b)/(c)/(d), the - companion mechanism lands under SEA-1884 (and, for (c), T2/T5 gain the + companion mechanism lands under RIG-1884 (and, for (c), T2/T5 gain the label-scoped `podman stop` + `podman ps` assertion); the assumption is a park point, not a silent decision. 1. **[non-load-bearing] Absent pgid file + answering socket.** A live stack diff --git a/docs/designs/product/compass-system-sender-first-turn/design.md b/docs/designs/product/compass-system-sender-first-turn/design.md index 36f9efa4a..baddf88ab 100644 --- a/docs/designs/product/compass-system-sender-first-turn/design.md +++ b/docs/designs/product/compass-system-sender-first-turn/design.md @@ -1,4 +1,4 @@ -# Compass `@compass` system sender + root-supervisor first turn (SEA-1820 case-1) +# Compass `@compass` system sender + root-supervisor first turn (RIG-1820 case-1) Status: Draft @@ -28,7 +28,7 @@ parent already froze. sender (not just the root-manager Setup thread), requiring reserved-handle validation at account creation; case-1 root-manager boot (a Compass-authored initial Setup thread in the manager's home channel) uses it and is scoped - OUT to follow-up SEA-1820, which owes only the sender representation + + OUT to follow-up RIG-1820, which owes only the sender representation + Setup flow." This record inherits that verbatim. 3. **No prompt field anywhere.** The `initial_prompt` removal is frozen by the parent record's DL-186-equivalent row (`compass-first-turn-delivery/` @@ -325,7 +325,7 @@ This reuses the whole human/agent write path: D9 authz, idempotency, asset (`go/server/setup_thread.md`), versioned with the server binary. The root Manager's block-0 is already applied via its role (`serve_seed.go:19-21`: role `manager` "selects config/prompts/manager/ -SYSTEM.md as the container's block-0 prompt (SEA-1732)"), so the Setup thread +SYSTEM.md as the container's block-0 prompt (RIG-1732)"), so the Setup thread is the first-TURN driver, not a system prompt: it opens the Setup flow Matt described verbatim (`compass-first-turn-delivery/design.md:30-38` — ask the user what repos/projects, set up the tree/devenv shells). Content changes @@ -359,7 +359,7 @@ unadvanced and the message waits for the NEXT session-start edge (the T-BL barrier lift, Global Constraint 7) — that is the gating precondition, not this caveat. -**Acceptance (SEA-1820 case-1).** The seeded supervisor starts idle; the +**Acceptance (RIG-1820 case-1).** The seeded supervisor starts idle; the `@compass` Setup thread appears in its home channel; its first turn starts from that deliver; no prompt field is threaded anywhere. diff --git a/docs/designs/product/compass-tauri-shell.md b/docs/designs/product/compass-tauri-shell.md index 2ad8a4c21..4145e352e 100644 --- a/docs/designs/product/compass-tauri-shell.md +++ b/docs/designs/product/compass-tauri-shell.md @@ -2,7 +2,7 @@ Status: Superseded by compass-native-app/design.md -Design for the Compass desktop shell (SEA-1022): the thin native app that hosts +Design for the Compass desktop shell (RIG-1022): the thin native app that hosts the UI webview and connects it to the Compass daemon. Companion to the [architecture lineage](compass-architecture-lineage/design.md) record and the transport spec [`../../specs/product/compass.md`](../../specs/product/compass.md). diff --git a/docs/designs/product/compass-ui-fixture-boot/design.md b/docs/designs/product/compass-ui-fixture-boot/design.md index a79665120..ff270b55b 100644 --- a/docs/designs/product/compass-ui-fixture-boot/design.md +++ b/docs/designs/product/compass-ui-fixture-boot/design.md @@ -117,7 +117,7 @@ mounts the same render tree** — no fixture network client, no fake transport, no WhoAmI. The visual-smoke harness header (`visual-smoke.spec.ts:3-9`) still declares this shape — it "Navigates the HashRouter surfaces of the stub-data app … for Matt's before/after review", with no daemon; the live wiring -(SEA-1729) is what invalidated it in practice. +(RIG-1729) is what invalidated it in practice. ### A1 — Mode selection + the hard wall (the load-bearing choice) @@ -518,7 +518,7 @@ All forks below were surfaced to Matt and ruled before freeze (2026-08-16). **Ledger-impact: none.** This is a dev-infra/testing boot-path addition: it supersedes no frozen product decision (the board model DL-069/DL-071, the -live-wiring records SEA-1729, and the test-strategy record's Go e2e tier are +live-wiring records RIG-1729, and the test-strategy record's Go e2e tier are all untouched — the fixture mode is complementary UI-layer determinism, and the live boot path is behavior-identical when the mode is off). No `DECISIONS.md` delta owed; the driver handles ledger/PR mechanics either way. diff --git a/docs/designs/product/compass-ui-query-layer/design.md b/docs/designs/product/compass-ui-query-layer/design.md index 0d4a196fa..a2361f4e7 100644 --- a/docs/designs/product/compass-ui-query-layer/design.md +++ b/docs/designs/product/compass-ui-query-layer/design.md @@ -1,7 +1,7 @@ # Compass UI query layer (@tanstack/solid-query + connect-query-core adoption) Status: Draft -Tracker: SEA-1696 +Tracker: RIG-1696 Ledger-impact: reserves one row (Compass UI query layer adoption); compass appends at ship ## Problem / Intent @@ -72,7 +72,7 @@ Today the UI loads that surface two ad-hoc ways, both cache-less: `const [comms, setComms] = createSignal(...)` (store.ts:754-756) via `adoptComms` (store.ts:785-790). -**The concrete blocker (SEA-1655): paginated history cannot ride the +**The concrete blocker (RIG-1655): paginated history cannot ride the wholesale stream.** The snapshot reader eagerly pages *every* visible channel's messages to exhaustion — `fetchSnapshot` "loads every visible channel's messages eagerly" and explicitly notes "Lazy per-channel load would @@ -379,7 +379,7 @@ factories. `createResource` is per-owner: no cross-component cache, no dedup of identical in-flight reads, no staleness/retry/invalidation model, and no -infinite-query primitive — weakest exactly where the SEA-1655 blocker bites +infinite-query primitive — weakest exactly where the RIG-1655 blocker bites (paginated history). Building those on top is writing TanStack Query badly. ### Wait for a first-party connect-solid-query — rejected @@ -505,7 +505,7 @@ Interfaces: Acceptance: unit test — a fake stream push for channel C invalidates C's `listMessages`/`listTopics` keys and no other channel's; suites green. -### T5 — Paginated history queries (SEA-1655 unblock) +### T5 — Paginated history queries (RIG-1655 unblock) Expose store-level query-backed reads for topic history: an infinite `listMessages` query (`pageParamKey: "beforeMessageId"`, @@ -520,7 +520,7 @@ Interfaces: - consumes: `createConnectInfiniteQuery`/`createConnectQuery` (T2); `CommsService.method.listMessages` / `.listTopics` descriptors (comms_pb.ts:2085-2111); T4's invalidation fan-out. -- produces: store accessors (shape finalized with the SEA-1655 topic-view +- produces: store accessors (shape finalized with the RIG-1655 topic-view implementer) e.g. `topicHistory(channelId, topicId)` exposing `data/fetchNextPage/hasNextPage/isPending`; `postMessage`/`updateTopic` paths gain key invalidation. @@ -584,7 +584,7 @@ package already carries the fetch-parameterized factories `createGrpcWebTransport({ baseUrl, fetch, ... })`, packages/compass-client/src/index.ts:133-137). Nothing in the query layer names a shell API or assumes local; the ConnectionProvider signature is -SEA-1688's record, not designed here — this record consumes the clients and +RIG-1688's record, not designed here — this record consumes the clients and transport as `createLiveClients` builds them. ## Open Questions @@ -608,7 +608,7 @@ The one genuine fork. Options: can shrink to "channels + accounts only". Cost: re-homing the resync protocol and local-ask preservation onto a generic cache rewrites the most consistency-critical driver in the app, with test migration to - match — high risk, and it blocks the SEA-1655 unblock behind a rewrite. + match — high risk, and it blocks the RIG-1655 unblock behind a rewrite. 3. **Hybrid with per-entity `setQueryData` for hot paths**: option 1 plus surgical newest-page patches. Booked in §A4 as a permitted optimization, not a separate fork. @@ -625,7 +625,7 @@ The alternative — components using `useMutation` directly — leaks server state above the accessor seam and forks the write path. Recommendation: store methods stay the only write surface; `useMutation` is used inside the store only where its pending/error state is needed by a surface. Flagged -only because the SEA-1655 composer implementer may prefer hook-local pending +only because the RIG-1655 composer implementer may prefer hook-local pending state; the seam rule (§A3) should win. ## Ledger note diff --git a/docs/designs/product/compass-ux-foundation/design.md b/docs/designs/product/compass-ux-foundation/design.md index b50c464b2..ae20224ce 100644 --- a/docs/designs/product/compass-ux-foundation/design.md +++ b/docs/designs/product/compass-ux-foundation/design.md @@ -1,7 +1,7 @@ # Compass UX foundation — target design system + interaction model Status: Draft -Linear: SEA-1663 +Linear: RIG-1663 Supersedes: the pre-freeze draft of this record (sealed PR #1075; its DL-114..122 block never shipped) @@ -59,7 +59,7 @@ reopen any of them inside a task. dense supervision surface, not a marketing page, so "fluid" means robust min/max and sensible reflow of the shell regions, not a mobile redesign. The Go shell, OS windows, and mode plumbing are compass-native's lane - (SEA-1684); this record designs what renders inside a webview/tab and the + (RIG-1684); this record designs what renders inside a webview/tab and the render contract, including how the UI **decomposes into independently mountable window-scoped views** (D6 multi-window). 3. **Styling tech**: pure CSS custom properties + a small first-party SolidJS @@ -95,7 +95,7 @@ reopen any of them inside a task. this record's scope. 7. **The target IA is frozen** (DL-095/096, DL-113, DL-098/099, DL-067/070/097, DL-129, DL-039). This record designs how it looks and how it - is navigated; it does not redesign the IA. SEA-1622 (channels under the + is navigated; it does not redesign the IA. RIG-1622 (channels under the agent tree) is unfrozen — the design must accommodate that direction without depending on its mechanism. 8. **Naming/markup conventions** (record-adopted from the codebase, not @@ -494,14 +494,14 @@ mountable window-scoped view** — it mounts against the DL-127 hash route for that surface, carries its own focus zones (D4) and command scope (D5), and needs no sibling region to function (a Bridge window renders without the sidebars). A single-window session composes these views into the shell grid below; a -multi-window session mounts one view per window. Deferred (**SEA-1808**, Beta +multi-window session mounts one view per window. Deferred (**RIG-1808**, Beta milestone), not built here: tabs *within* a window (Linear-style) and in-window split views — the view decomposition is designed to admit both later without rework (a tab strip or a splitter hosts the same window-scoped views), but neither ships in the dogfood scope. **Cross-lane seam:** compass-native's frozen record (`compass-native-app/design.md`, DL-110) is single-window today (one window loading the built UI); DL-160 expands its scope, so compass-native's -shell record needs a multi-window amendment (SEA-1684's lane) before this +shell record needs a multi-window amendment (RIG-1684's lane) before this decomposition can be hosted in real OS windows — flagged here so the dependency is explicit, not implicit. @@ -522,7 +522,7 @@ is explicit, not implicit. "Re-parent agent…" command for re-parenting. Below the tree, the channel rail: channel rows + their 3 most-recent topics as indented deep-nav sub-rows (DL-098). The two trees render with the SAME tree-row contract so - SEA-1622's later unification is a data change, not a visual one. The + RIG-1622's later unification is a data change, not a visual one. The state-dot column is the sanctioned one-pulse-per-region exception (D9): a scannable field of working pulses is brand-legal by the pulse budget rule. Starting point: the canonical Rigel company-site Manager-tree reference render (production-quality, Managers as @@ -726,10 +726,10 @@ ships working throughout. Sequencing (detail in `## Adoption path`): tokens + base land first behind `[data-theme="night"]`, components re-clothe surface-by-surface, keyboard/palette lands as pure addition, old vocabulary is deleted as each surface flips. **This record's merge is independent of the -in-flight impl lanes** (SEA-1645 unreachable-pin, SEA-1633 board remodel): +in-flight impl lanes** (RIG-1645 unreachable-pin, RIG-1633 board remodel): they continue on the current vocabulary. Adoption step 4's board/sidebar flips sequence AFTER those lanes merge. Coordination call: if T1-T3 land -before SEA-1633 reaches its styling, SEA-1633 should build directly against +before RIG-1633 reaches its styling, RIG-1633 should build directly against `.cx-*` and skip the build-on-legacy-then-re-skin double-work — a compass-ui coordination note, not a blocker. @@ -801,13 +801,13 @@ to it incrementally so `apps/ui` ships working at every step. the same diff (no shims): left sidebar/tree → Bridge board → comms (channel/topic) → right sidebar → workspace/trace → Backlog/Done/Settings. Ordering tracks the frozen-IA implementation lanes: the board flip lands - after SEA-1633's remodel merges; the right-sidebar flip lands after SEA-1645 + after RIG-1633's remodel merges; the right-sidebar flip lands after RIG-1645 (unreachable-pin, DL-113; the left sidebar/tree flip has no such dependency). 5. **Legacy vocabulary retired** — `--bg*`, `--st-*`, `--accent*` and orphan selectors deleted; the stylelint guard flips from warn to error; done means `app.css`'s `:root` block (`app.css:7-58`) is gone. -In-flight lanes SEA-1645 (unreachable-pin) and SEA-1633 (board remodel) +In-flight lanes RIG-1645 (unreachable-pin) and RIG-1633 (board remodel) continue on the current vocabulary and re-skin at their surface's flip step — they neither block nor are blocked by this record. @@ -996,7 +996,7 @@ Remaining deferrals, carried from the pre-freeze draft (none load-bearing): 4. **[NLB → Beta milestone] In-window tabs (Linear-style) and split views.** The multi-window decomposition (D6.1) is designed to admit both — a tab strip or a splitter hosts the same window-scoped views with no rework — but - neither ships in dogfood scope. Filed as **SEA-1808** (Beta milestone; Matt, + neither ships in dogfood scope. Filed as **RIG-1808** (Beta milestone; Matt, 2026-08-05). Recommendation: defer to Beta; the decomposition is the only part that must be right now, and it is. @@ -1018,7 +1018,7 @@ IDs do not shift positionally. | DL-154 | Delivery layout: in-tree `apps/ui/src/design/` (tokens.css/base.css/components/) + `keyboard/` contracts; stylelint guard bans raw hex, `--rigel-*`, and literal durations outside tokens.css, with one narrow allowlist — the mark component's CSS may name `--rigel-purple` directly (purple is never aliased into `--cx-*`); no token package, no W3C token source (D7) | | DL-155 | Brand seam: primitives mirrored with provenance from the frozen spec; the mark per the brand surface table is the one purple per surface with the 16px floor honored; Compass-owned `--cx-ed-*` editor-theme mapping from the Night Owl syntax ramp; mutual co-review (D8) | | DL-156 | Motion: the product UI consumes the frozen brand motion system in pure CSS/SVG (no client animation runtime) — brand duration/easing/pulse/streaming tokens, the green working pulse with the one-pulse-per-region budget, chase-light spinner/bar loaders, the boot-sequence, reduced-motion as substitution not removal; literal durations are review failures (D9) | -| DL-157 | Adoption path: design-first, five-step incremental migration (tokens → shell → keyboard spine → surface flips → legacy retirement); in-flight lanes SEA-1645/SEA-1633 re-skin post-merge (D10) | +| DL-157 | Adoption path: design-first, five-step incremental migration (tokens → shell → keyboard spine → surface flips → legacy retirement); in-flight lanes RIG-1645/RIG-1633 re-skin post-merge (D10) | | DL-158 | The agent workspace simplifies to the agent's home channel + its session trace (two fixed panes, no arbitrary split tree); no terminal pane and no file-viewer pane in dogfood (isolated containers; an operator dev-server-view affordance is deferred to backlog, PR review lives on the user's forge); the terminal `PaneKind` arm + `newTerminalPane` retire at the workspace flip (D6/D10) | | DL-159 | One UI codebase renders in two hosts — the Wails v3 desktop app (primary) and the browser (the managed/hosted product at `compass.rigel.build`) — over the same transport-agnostic UI above the `connection.ts` provider seam; the layout is fluid within its window/viewport (a dense supervision surface that reflows, not a fixed-pixel canvas and not a mobile redesign) (D6/§Global Constraints 2) | -| DL-160 | The desktop app is first-class multi-window: every top-level surface (Bridge, a channel, an agent workspace, Backlog/Done, Settings) is an independently mountable window-scoped view (own DL-127 route, own focus zones + command scope, no sibling region required); compass-native spawns/manages OS windows, this record owns the decomposition; in-window tabs (Linear-style) and split views are deferred to the Beta milestone (SEA-1808), admitted by the same decomposition without rework (D6.1) | +| DL-160 | The desktop app is first-class multi-window: every top-level surface (Bridge, a channel, an agent workspace, Backlog/Done, Settings) is an independently mountable window-scoped view (own DL-127 route, own focus zones + command scope, no sibling region required); compass-native spawns/manages OS windows, this record owns the decomposition; in-window tabs (Linear-style) and split views are deferred to the Beta milestone (RIG-1808), admitted by the same decomposition without rework (D6.1) | diff --git a/docs/designs/product/compass-zulip-threading-model/design.md b/docs/designs/product/compass-zulip-threading-model/design.md index 19f9e1453..27fb33d4d 100644 --- a/docs/designs/product/compass-zulip-threading-model/design.md +++ b/docs/designs/product/compass-zulip-threading-model/design.md @@ -16,7 +16,7 @@ Status: Active > `compass-0.8-threading-and-session-renderer` (retired, RIG-2453), > [compass-threading-ui](../compass-threading-ui/design.md), > [compass-slack-thread-rendering](../compass-slack-thread-rendering.md), -> ledger rows **DL-040** and **DL-041**, and **SEA-1364 T3's conversation +> ledger rows **DL-040** and **DL-041**, and **RIG-1364 T3's conversation > write-through** (the streamed-turn → comms auto-post path — D7/T7); > **clarifies** DL-037, DL-029, DL-028, DL-072. The ledger delta ships in this > same PR: DL-040 → Superseded, DL-041 → Superseded, plus new rows for the @@ -277,7 +277,7 @@ whole Slack surface — `ThreadView`, `ThreadStream`, `ThreadPanel`, the deep-nav sub-rows routing straight to a topic view, so the human reaches an active conversation in one click without first opening the channel's full index. -- SEA-1332 (compass-message-surface-rendering, designed-not-built; DL-041 "The +- RIG-1332 (compass-message-surface-rendering, designed-not-built; DL-041 "The message surface is a virtualized thread list") re-points: the virtualized list unit becomes the **topic's message list** (the topic view), and that record's implementation follows this contract rather than its original @@ -291,7 +291,7 @@ carried by a message, a message lives in a topic, so an ask is **visible in its topic and answerable channel-wide, first-responder-wins**. Topic scoping changes where the ask renders, not who may answer it. -### D7 — One comms-write path: the streaming write-through is removed (supersedes SEA-1364 T3) +### D7 — One comms-write path: the streaming write-through is removed (supersedes RIG-1364 T3) Ruled with F7's dissolution (see Decisions): an agent's streamed turn does **not** write to comms at all. Today the EventMapper dual-surfaces streamed @@ -324,7 +324,7 @@ commits KEYED"): **The conversation write-through half of that is removed (T7)** — the two conversation variants and every keyed commit behind them. The shared durable conversation-frame lane itself — `AgentGateway.PostConversationFrame` → -`RunnerService.CommitConversationFrame` — **survives**: SEA-1570's durable +`RunnerService.CommitConversationFrame` — **survives**: RIG-1570's durable transcript tee rides this exact lane by design (`transcript_entry`, field 7, `agent.proto:73-79`), and its runner-forward half is merged and live — `post_conversation_frame.go:76` calls `CommitConversationFrame`, gated by @@ -457,7 +457,7 @@ use for organization. This is the status quo with a costume. source row only after moving every message to the target in the same tx, so messages are never orphaned or cascaded away (`ON DELETE RESTRICT` everywhere, per `0001_init.sql` convention). -- **The comms tool is the only agent comms-write path.** With the SEA-1364 T3 +- **The comms tool is the only agent comms-write path.** With the RIG-1364 T3 write-through removed (D7/T7), a comms Message row is created only by `comms_post_message` (agents) or the human client's PostMessage — both carry a mandatory topic. No server-side path materializes a Message from a @@ -472,13 +472,13 @@ live adversary. T1 unblocks everything topic-shaped; T2 unblocks T3; T4/T5 ride the regenerated stubs; T6 is last (ledger + record flips travel with this design PR itself, not a task). -**Merge-order constraint (in-flight PRs):** compass PR **#88** (SEA-1569 T6, +**Merge-order constraint (in-flight PRs):** compass PR **#88** (RIG-1569 T6, reconnect/start redelivery sweep — open at this writing) touches `go/internal/delivery`, `go/internal/runnerhub`, and `go/server/sinks.go` — the surfaces this record's T7 deletes from and T3's deliver-op payload change rides through, and consumers of the regenerated stubs. It must **land or be parked before T7's removals and T1's regen-everything breaking chain start**, -or they strand it on removed code. (#90 — SEA-1570's own T7 — already merged +or they strand it on removed code. (#90 — RIG-1570's own T7 — already merged as `f1d3aa595` — is NOT merely out of the way: it added `transcript_entry` (field 7) as a co-tenant on the PostConversationFrame → CommitConversationFrame lane, which is exactly why T1/T7 narrow the removal @@ -497,7 +497,7 @@ D7's proto delta: **remove** (not reserve) `AgentFrame.conversation_posted` `AgentGateway.PostConversationFrame` (`agent_gateway.proto:67`) + `RunnerService.CommitConversationFrame` (`runner.proto:134`) RPCs, their request/response messages, and `transcript_entry` (field 7) are **kept** — -they are the shared durable conversation-frame lane SEA-1570's transcript +they are the shared durable conversation-frame lane RIG-1570's transcript tee rides (D7); T7 removes only the conversation write-through, never the transcript forward path. After the removal the lane is transcript_entry-only, kept under its current name (a rename is separate scope). Regenerate all gen @@ -679,7 +679,7 @@ Per D5/F11. Replace `threadsOf`/`ThreadView`/`ThreadStream`/`ThreadPanel`/ becomes a topic index with a "new topic" affordance and no composer**; a new **topic view (`openTopic`) renders one topic's messages with the composer, and no nested threading**; the **left sidebar's channel rows list the channel's ~3 -most recent topics** as deep-nav sub-rows. SEA-1332 virtualization re-points at +most recent topics** as deep-nav sub-rows. RIG-1332 virtualization re-points at the topic message list when it builds. The removal/sweep set also includes `RightSidebar.fleetpane.test.tsx` — its @@ -728,11 +728,11 @@ Agent-facing tool descriptions and any operator docs referencing "threads" / ### T7 — Remove the streaming write-through: streamed turns stop writing comms — **compass-agent + compass-runner + compass-server** (proto removals ride T1) -Per D7 (supersedes SEA-1364 T3). Lands FIRST — independent of the topic +Per D7 (supersedes RIG-1364 T3). Lands FIRST — independent of the topic model, and required before T2's `NOT NULL` schema so no topicless writer remains. The shared durable conversation-frame lane (`PostConversationFrame` → `CommitConversationFrame`) **survives** for -SEA-1570's `transcript_entry`; only the `conversation_posted`/ +RIG-1570's `transcript_entry`; only the `conversation_posted`/ `conversation_updated` co-tenants and their comms write-through are removed. The lane split: @@ -744,7 +744,7 @@ removed. The lane split: `conversationPosted`/`conversationUpdated` `OutboundFrame` variants (`frame.ts:50-51`) but keeps `transcriptEntry`; `transport/frame-sink.ts` keeps the durable unary path and `transport/index.ts` keeps - `postConversationFrame` — SEA-1570's `transcriptEntry` frames ride them. + `postConversationFrame` — RIG-1570's `transcriptEntry` frames ride them. - **compass-runner**: the gateway keeps `PostConversationFrame` (`go/internal/runner/gateway/post_conversation_frame.go`), the `ConversationCommitter` seam (`gateway.go:111-117`), and the @@ -757,9 +757,9 @@ removed. The lane split: `ConversationPosted`/`ConversationUpdated` dispatch cases; with both cases gone the kept endpoint becomes the inert transcript-lane endpoint (every frame falls to `commitFrame`'s existing `default` → - `CodeInvalidArgument` until SEA-1570's server-side transcript persist + `CodeInvalidArgument` until RIG-1570's server-side transcript persist lands its case), which is exactly why the RPC/handler/hub surface is - retained rather than deleted — deleting it would strand SEA-1570's + retained rather than deleted — deleting it would strand RIG-1570's durable transcript lane, the regression this narrowing prevents. comms drops `CommitAgentPostKeyed` / `CommitAgentUpdateKeyed` (`agent_caller.go:299-314`); server drops the `commsConversationSink` @@ -790,7 +790,7 @@ removed. The lane split: ## Tasks -- [ ] T7 — Streaming write-through removal: streamed turns stop writing comms; session trace + SEA-1570 transcript lane unchanged (compass-agent + compass-runner + compass-server; proto removals ride T1) — lands first +- [ ] T7 — Streaming write-through removal: streamed turns stop writing comms; session trace + RIG-1570 transcript lane unchanged (compass-agent + compass-runner + compass-server; proto removals ride T1) — lands first - [ ] T1 — Proto delta: `Topic`, topic-addressed posting, `ListTopics`/`UpdateTopic`, `TopicUpserted`; remove (not reserve) `parent_message_id` + the channel container (compass-repo) - [ ] T2 — Store: `topics` table + `messages.topic_id` in the collapsed-baseline schema (no channel_id, no data conversion), topic CRUD, topic-under-channel validation (compass-server store) - [ ] T3 — Comms service: topic routing + `TopicUpserted` fan-out, deliver-op topic metadata, cursor channel via topic join (compass-server comms) @@ -857,7 +857,7 @@ that plan carried is preserved independently by F3. The pre-ratification fork asked which topic a streamed turn's comms row should get (inherit the triggering deliver's? a server-resolved default?). Matt dissolved the question by ruling **Option A: agent streamed turns do not -write to comms at all** — the SEA-1364 T3 conversation write-through is +write to comms at all** — the RIG-1364 T3 conversation write-through is removed (D7, T7). A comms Message appears only on an explicit `comms_post_message(topic)` call, which already carries a mandatory topic, so no topicless comms-write path exists and no conversation-frame `topic_id` diff --git a/docs/designs/repo/compass-drop-proto.md b/docs/designs/repo/compass-drop-proto.md index 003289b31..456c2195d 100644 --- a/docs/designs/repo/compass-drop-proto.md +++ b/docs/designs/repo/compass-drop-proto.md @@ -2,7 +2,7 @@ Status: Draft -Tracker: SEA-1983. Template: the internal monorepo's proto-drop — +Tracker: RIG-1983. Template: the internal monorepo's proto-drop — "refactor(ci): drop proto; pin bun/node/moon via nix, go via go-overlay". Compass diverges from that template wherever the CI substrate does: the internal monorepo runs the internal Woodpecker CI/CD against a nix-built CI @@ -47,7 +47,7 @@ monorepo's shape, relocated to compass's existing toolchain-gate directory: `devenv.nix:127`, so darwin is a supported dev platform. - `go.nix` — version only (`{ version = "1.26.6"; }`); the derivation comes from the go-overlay input (next section), which carries its own per-platform - hashes. Designed against the post-#298 tree: SEA-1982 bumps the pin to + hashes. Designed against the post-#298 tree: RIG-1982 bumps the pin to 1.26.6 (`.prototools:13`: `go = "1.26.6"`), and go-overlay ships a `manifests/go/1.26.6.nix` (verified against `purpleclay/go-overlay@main:manifests/go/`). @@ -83,7 +83,7 @@ parse; option (a) — keep `setup-*` but read versions out of the new nix pin files — would keep four install mechanisms and the two-substrate drift risk the parity gate exists to police, purely to preserve GH's toolchain caches. Option (b) makes CI run the identical derivations the dev shell runs — -the single-owner point of SEA-1983 — and shrinks ci.yml. The nix step's own +the single-owner point of RIG-1983 — and shrinks ci.yml. The nix step's own comment already frames nix as the mechanism that reproduces dev-shell pins where setup-* can't (`ci.yml:230-236`); post-proto that applies to every toolchain. @@ -319,7 +319,7 @@ merge"). ### Keep setup-* actions reading versions from the nix pin files (fork 1a) Smallest ci.yml diff and keeps GH-hosted toolchain caches, but preserves the -two-substrate split (four non-nix installers + one nix step) that SEA-1983 +two-substrate split (four non-nix installers + one nix step) that RIG-1983 exists to end, keeps a sed/eval parse of a pin file in YAML (the injection-hardening the current step needs, `ci.yml:149-153,200-204`, is a cost of exactly this pattern), and leaves the parity gate policing a @@ -341,7 +341,7 @@ detection retain value independent of CI's install path. ## Global Constraints -1. **Gated on SEA-1982 / PR #298.** Implementation starts only after the Go +1. **Gated on RIG-1982 / PR #298.** Implementation starts only after the Go 1.26.5→1.26.6 govulncheck bump merges — this change edits `.prototools` (deleting it) and `devenv.nix`, both touched by #298, and must not race it. All pins here assume the post-#298 tree (Go pin = `1.26.6`, @@ -474,7 +474,7 @@ root:markdownlint` green. covers only github-actions/bun-lockfile/gomod (`.github/dependabot.yml:12,28,40`) and has no nix ecosystem, so bun/node/moon/go pin bumps become manual PRs. This is no regression — - `.prototools` bumps are manual today (SEA-1982 is one) — and the design is + `.prototools` bumps are manual today (RIG-1982 is one) — and the design is correct without automation. Recommendation: accept manual bumps now; revisit if/when compass adopts a renovate config, reusing the internal monorepo's regex managers re-targeted at `tools/toolchain/versions/*.nix`. diff --git a/docs/designs/repo/compass-eng-docs/design.md b/docs/designs/repo/compass-eng-docs/design.md index dc3cb51e3..78071b957 100644 --- a/docs/designs/repo/compass-eng-docs/design.md +++ b/docs/designs/repo/compass-eng-docs/design.md @@ -256,12 +256,12 @@ Repeatable rules applied by the migration task and binding on future records: 2. **Private tracker links (SEA-####, linear.app).** *Keep the ID, strip the link.* ~50 distinct SEA IDs are load-bearing provenance (records cite each other through them); a dead `linear.app/rigelbuild/...` URL is worse - than no URL. Rewrite BOTH link forms to plain `SEA-1234`: the inline - `[SEA-1234](https://linear.app/…)` AND the reference-definition - `[SEA-1234]: https://linear.app/…` (`^\[.+\]:\s*https://linear\.app/`) — + than no URL. Rewrite BOTH link forms to plain `RIG-1234`: the inline + `[RIG-1234](https://linear.app/…)` AND the reference-definition + `[RIG-1234]: https://linear.app/…` (`^\[.+\]:\s*https://linear\.app/`) — the corpus's one live URL is the latter form (`compass-0.4/design.md:207`), which an inline-only regex would miss. Bare - `SEA-1234` mentions are untouched. Public readers see an opaque internal + `RIG-1234` mentions are untouched. Public readers see an opaque internal ticket ID — honest and harmless. 3. **`oss/compass/**` path rewrite.** *Strip the prefix.* 19 records cite `oss/compass/` paths from sealed's vendored era; the public repo's @@ -417,7 +417,7 @@ Interfaces: - Consumes: Q4 ruling (below) — project `compass-eng-docs`, custom domain `eng.compass.rigel.build`, provisioned via sealed's Pulumi IaC lane. - Produces: the `compass-eng-docs` Pages project via sealed's Pulumi IaC (sealed - precedent: the docsite got "its OWN Pages:Edit-scoped token once SEA-1119 + precedent: the docsite got "its OWN Pages:Edit-scoped token once RIG-1119 provisions the project", `sealed/ci/pipeline.ts:334-336`); repo secrets `CLOUDFLARE_API_TOKEN` (Pages:Edit-scoped, least-privilege per `pipeline.ts:321-324`) + `CLOUDFLARE_ACCOUNT_ID` on `RigelBuild/compass`; @@ -496,7 +496,7 @@ earlier. T5 and T7 execute against these rulings; T6 is dropped (Q5). provisions?** No compass Pages project exists (sealed's pipeline knows only `sealed-docs` + the marketing site, `sealed/ci/pipeline.ts:333-343`). **RULED (Matt):** provision a new `compass-eng-docs` project + a - Pages:Edit-scoped token via sealed's existing Pulumi IaC lane (the SEA-1119 + Pages:Edit-scoped token via sealed's existing Pulumi IaC lane (the RIG-1119 precedent, `pipeline.ts:334-336`), production branch `main`; custom domain `eng.compass.rigel.build` (Matt ruled). The `docs.compass` naming and `docs.compass.rigel.build` domain are deliberately RESERVED for the diff --git a/docs/designs/repo/compass-renovate-migration.md b/docs/designs/repo/compass-renovate-migration.md index 1cc1fbbcd..0c2cf76b9 100644 --- a/docs/designs/repo/compass-renovate-migration.md +++ b/docs/designs/repo/compass-renovate-migration.md @@ -52,10 +52,10 @@ with `osvVulnerabilityAlerts: true` replacing the coverage. - **Every postUpgradeTasks command in bot-config `allowedCommands`, `^…$`-anchored** — a repo config can't self-authorize a command; `config.test.ts` pins the two lists together (as the internal monorepo's does). -- **TypeScript `<7` cap (SEA-1867)** — compass's catalog pins +- **TypeScript `<7` cap (RIG-1867)** — compass's catalog pins `"typescript": "^6.0.3"` (`package.json:21`), so the Project Corsa cap applies: TS 7.0 ships no stable programmatic API (ported from the internal monorepo). -- **Timezone/schedule alignment (SEA-1220)** — `timezone: "America/New_York"` in +- **Timezone/schedule alignment (RIG-1220)** — `timezone: "America/New_York"` in the repo config, and the GHA cron (UTC) must land inside the `schedule:daily` before-4am-ET window WITH margin: GHA scheduled runs are best-effort and routinely start 5-30+ minutes late, so the cron must not sit near the window @@ -148,9 +148,9 @@ here. Triggers: `on: schedule: - cron: "0 6 * * *"` (06:00 UTC = 02:00 EDT / 01:00 EST — inside the before-4am-ET `schedule:daily` window with 2-3h margin per -the SEA-1220 constraint; GHA cron is best-effort and routinely 5-30+ minutes +the RIG-1220 constraint; GHA cron is best-effort and routinely 5-30+ minutes late, so a tighter cron like `0 7` — 60 min of EDT margin — risks a delayed -start past 04:00 ET reproducing the SEA-1220 silent-zero-PR symptom) + +start past 04:00 ET reproducing the RIG-1220 silent-zero-PR symptom) + `workflow_dispatch` for manual runs (the GHA analogue of the internal monorepo's Woodpecker `{event: manual}` trigger; it also revives the schedule if GHA auto-disables it after 60 days of repo inactivity — see T6). @@ -315,7 +315,7 @@ Port from the internal monorepo, adapted: divergence from the internal monorepo's prior art gets a config comment), aligned with the `0 6 * * *` UTC cron inside the before-4am-ET window; `minimumReleaseAge: null` (a moving-branch digest never clears a - release-age window — the SEA-1220 silent-pending shape), branch-mode + release-age window — the RIG-1220 silent-pending shape), branch-mode postUpgradeTasks running the ported relock script with `fileFilters: ["devenv.lock", "package.json", "bun.lock"]`. - Catalog lockfile coupling: `matchDepTypes: ["workspaces.catalog"]`, @@ -620,7 +620,7 @@ repo's standard runner label per `ci.yml`), steps: RENOVATE_TOKEN: ${{ steps..outputs.token }}` → `bunx renovate@44.33.1` (exact pin per Approach; the self-pin customManager bumps it). -Triggers: `schedule: [{cron: "0 6 * * *"}]` (margin per the SEA-1220 +Triggers: `schedule: [{cron: "0 6 * * *"}]` (margin per the RIG-1220 constraint) + `workflow_dispatch`. Two GHA scheduled-workflow caveats, in a workflow comment: (a) cron is best-effort — starts are routinely 5-30+ minutes late, which the 06:00 UTC margin absorbs; (b) GHA auto-disables a scheduled diff --git a/docs/specs/product/compass.md b/docs/specs/product/compass.md index 31e0cb9b8..742fd4e55 100644 --- a/docs/specs/product/compass.md +++ b/docs/specs/product/compass.md @@ -405,7 +405,7 @@ A reattach within the window resumes the session; window expiry falls to reattach within the bounded window resumes it rather than ending it as `ERRORED`. -> **Implementation status (SEA-1243 T4):** T4 ships the `DISCONNECTED` state on +> **Implementation status (RIG-1243 T4):** T4 ships the `DISCONNECTED` state on > the contract and the disconnect *signal* — a lost Runner link fails the > session's in-flight commands. The server-side **reattach-window enforcement** > — the per-session registry that publishes `DISCONNECTED` on link loss, the @@ -448,7 +448,7 @@ client hangs up, the session ends, or the subscriber falls too far behind its buffer. The pane carries no snapshot replay; a subscriber sees only frames from the point it joined. -> **Implementation status (SEA-1342):** this increment ships the authorized live +> **Implementation status (RIG-1342):** this increment ships the authorized live > tail only. A dropped-for-lag subscriber ends like any other clean stream end; > the reattach/resync machinery that would let a client recover the frames it > missed (the deferred daemon-lifecycle work) is not yet built, so lag recovery @@ -684,7 +684,7 @@ resolution** (`@agents`/`@users`/`@everyone` expanding to a member set) — no p contract exists yet. The `snapshot_seq` **consistent point-in-time snapshot** across a paginated -re-snapshot is **partially built**: the server half has landed (SEA-1333) — the +re-snapshot is **partially built**: the server half has landed (RIG-1333) — the `SubscribeComms` `since_seq=0` response carries a leading `snapshot_seq` boundary frame and the message read RPCs enforce it as `seq <= snapshot_seq`. The normative Requirement (the boundary-frame contract + narrowing this reserved @@ -711,7 +711,7 @@ rather than tearing it down and re-spawning. The workspaces sidebar derives its tree from `parent_agent_id` rather than a user-defined folder organization, and an agent reads its own parent off its account through `ListAccounts`. Composing channels or roles onto the tree is -named for later (SEA-1622, SEA-1623) and is not yet built. +named for later (RIG-1622, RIG-1623) and is not yet built. ### Requirement: An agent account carries a parent, forming the agent tree diff --git a/forks/README.md b/forks/README.md index fba0739bf..e7683a751 100644 --- a/forks/README.md +++ b/forks/README.md @@ -1,6 +1,6 @@ # forks/ -> **Vendored into this repo (SEA-1512).** Two of these trees — `devenv/` and +> **Vendored into this repo (RIG-1512).** Two of these trees — `devenv/` and > `nix2container/` — were copied byte-identically out of the sealed monorepo's > `oss/forks/` at `origin/main`, per Matt's ruling that Compass carries them as > its own trees rather than consuming them from a public spoke. They live at diff --git a/go/.golangci.yml b/go/.golangci.yml index ce8491cdc..91e4fe20b 100644 --- a/go/.golangci.yml +++ b/go/.golangci.yml @@ -114,7 +114,7 @@ linters: # nolintlint governs the inline `//nolint` directives themselves — the # per-site suppression form this module uses for architectural false - # positives (SEA-1287). Every directive must name its linter and carry a + # positives (RIG-1287). Every directive must name its linter and carry a # reason, and a directive that no longer suppresses anything is flagged — # so a stale inline suppression can't rot silently, the same anti-rot # ratchet `warn-unused: true` gives the central exclusion rules. @@ -140,7 +140,7 @@ linters: # module grows and a rule stops matching. warn-unused: true - # Policy (SEA-1287): the central rules below are PATH-CLASSES only — whole + # Policy (RIG-1287): the central rules below are PATH-CLASSES only — whole # categories of file (here, test files) that earn a looser standard. Per-site # architectural false positives live inline at their site as # `//nolint: // ` (nolintlint settings above enforce the diff --git a/go/cmd/compass-server/main.go b/go/cmd/compass-server/main.go index 086a7ac31..159fffd19 100644 --- a/go/cmd/compass-server/main.go +++ b/go/cmd/compass-server/main.go @@ -174,7 +174,7 @@ func buildServeConfig(args []string) (server.ServeConfig, bool, error) { UseTLS: *f.s3UseTLS || envTrue(os.Getenv("COMPASS_S3_USE_TLS")), } - // Forge poll driver (SEA-1810): flag-then-env, all-optional (see forge.resolve). + // Forge poll driver (RIG-1810): flag-then-env, all-optional (see forge.resolve). forgeConfig, err := forge.resolve() if err != nil { return server.ServeConfig{}, false, err @@ -334,7 +334,7 @@ func resolveNetworkDoor(listen, tlsCert, tlsKey string) (string, *server.TLSConf } } -// forgeFlags holds the five SEA-1810 forge CLI flag pointers, registered as a +// forgeFlags holds the five RIG-1810 forge CLI flag pointers, registered as a // group so run() stays short (they mirror the S3 flag set's precedence). type forgeFlags struct { repos *string @@ -351,7 +351,7 @@ func registerForgeFlags(fs *flag.FlagSet) forgeFlags { return forgeFlags{ repos: fs.String("forge-repos", "", "Comma-separated owner/name repos to SEED into forge_repo_subscriptions "+ - "(SEA-1810 board poll). Defaults to $COMPASS_FORGE_REPOS. A declarative "+ + "(RIG-1810 board poll). Defaults to $COMPASS_FORGE_REPOS. A declarative "+ "seed reconciled at boot (bootstrap-only insert), NOT the live target "+ "set — the table is authoritative after the first insert. A non-empty "+ "seed enables the poll driver."), diff --git a/go/cmd/compass-stack/integration_podman_test.go b/go/cmd/compass-stack/integration_podman_test.go index 088a13d4f..204a0333e 100644 --- a/go/cmd/compass-stack/integration_podman_test.go +++ b/go/cmd/compass-stack/integration_podman_test.go @@ -3,7 +3,7 @@ package main // End-to-end Linux integration proof for the T2 embedded stack supervisor -// (SEA-1662 / SEA-1683, design.md:437-442). Every other T2 test stubs the +// (RIG-1662 / RIG-1683, design.md:437-442). Every other T2 test stubs the // external effects; THIS one drives the real composition root — resolveConfig + // buildDeps wiring the six real adapters — against REAL initdb/postgres/podman/ // compass-server/compass-runner, proving the whole embedded stack stands up. diff --git a/go/cmd/compass/main.go b/go/cmd/compass/main.go index 881f6b28c..1c39965f0 100644 --- a/go/cmd/compass/main.go +++ b/go/cmd/compass/main.go @@ -3,7 +3,7 @@ // Command compass is the operator-facing Compass CLI: a Cobra subcommand tree // that dials the Compass Server's authenticated door and drives fleet-wide // operator actions. Today it hosts the agent-config noun (push/show/delete of -// the fleet config bundle, SEA-1671); secrets is a planned future sibling noun, +// the fleet config bundle, RIG-1671); secrets is a planned future sibling noun, // so the root is kept extensible rather than agent-config-specific. // // Unlike the other cmd/ binaries this one deliberately uses Cobra (the diff --git a/go/e2e/agent_ops.go b/go/e2e/agent_ops.go index 59e3423a1..e0d37fae2 100644 --- a/go/e2e/agent_ops.go +++ b/go/e2e/agent_ops.go @@ -34,7 +34,7 @@ func (f *Fixture) CreateAgent(ctx context.Context, handle, displayName string) ( // Provision provisions the agent's per-account workspace container over // CompassService and returns the assigned container name. clientRequestID is the -// idempotency key. Repo carriage was removed (SEA-1527), so no repo/ref fields +// idempotency key. Repo carriage was removed (RIG-1527), so no repo/ref fields // exist to set. func (f *Fixture) Provision(ctx context.Context, accountID, clientRequestID string) (containerName string, err error) { rctx, cancel := context.WithTimeout(ctx, rpcTimeout) diff --git a/go/e2e/cannedmodel.go b/go/e2e/cannedmodel.go index a1f5bcb11..b35070040 100644 --- a/go/e2e/cannedmodel.go +++ b/go/e2e/cannedmodel.go @@ -1,4 +1,4 @@ -// The harness-side CANNED model backend (SEA-1787 H3): a tiny host-side HTTP +// The harness-side CANNED model backend (RIG-1787 H3): a tiny host-side HTTP // server that speaks the openai-completions streaming SSE contract the agent's // SDK provider dials, so a leg-2 turn settles on a deterministic scripted reply // with ZERO live-model egress. It is the model backend the custom diff --git a/go/e2e/cannedmodel_test.go b/go/e2e/cannedmodel_test.go index 6bc86d458..a3209f059 100644 --- a/go/e2e/cannedmodel_test.go +++ b/go/e2e/cannedmodel_test.go @@ -1,4 +1,4 @@ -// Hermetic (non-podman) unit test for the canned model SSE stub (SEA-1787 H3). +// Hermetic (non-podman) unit test for the canned model SSE stub (RIG-1787 H3). // It is DELIBERATELY UNTAGGED so it runs in the standard `moon run // compass-go:test` lane with no container — the deterministic red->green proof // that the stub emits SSE the openai-completions parser accepts, independent of diff --git a/go/e2e/clients.go b/go/e2e/clients.go index 1070b25d9..df2232287 100644 --- a/go/e2e/clients.go +++ b/go/e2e/clients.go @@ -2,7 +2,7 @@ // Package e2e is the dogfood end-to-end harness substrate: it stands up the real // embedded Compass stack over stack.Up (the same composition the compass-stack -// CLI drives) and hands the harness's later legs (SEA-1785 H2-H6) a Fixture with +// CLI drives) and hands the harness's later legs (RIG-1785 H2-H6) a Fixture with // authenticated Connect clients and the store DSN. It is podman-build-tagged — // it drives real child processes and the real agent image, so it is out of the // hermetic unit lane and runs only under `-tags podman`. diff --git a/go/e2e/fixture.go b/go/e2e/fixture.go index c391c1942..e9e1a740a 100644 --- a/go/e2e/fixture.go +++ b/go/e2e/fixture.go @@ -64,7 +64,7 @@ type Fixture struct { // fixtureConfig holds the optional knobs a caller flips through fixtureOption // before NewFixture stands the stack up. The zero value is the plain H1/H2 -// fixture (no canned model); WithCannedModel turns on the SEA-1787 H3 backend. +// fixture (no canned model); WithCannedModel turns on the RIG-1787 H3 backend. type fixtureConfig struct { canned bool cannedScript []CannedTurn @@ -75,7 +75,7 @@ type fixtureConfig struct { // only). cannedMarkers []cannedMarker // site, when non-nil, makes NewFixture reuse a persistent root/stateDir/ports - // (WithSite) instead of minting fresh ephemeral ones — the SEA-1790 H6 + // (WithSite) instead of minting fresh ephemeral ones — the RIG-1790 H6 // cross-restart substrate. nil is the default ephemeral fixture. site *fixtureSite } @@ -86,7 +86,7 @@ type fixtureConfig struct { type fixtureOption func(*fixtureConfig) // WithCannedModel makes NewFixture stand up the deterministic canned model -// backend (SEA-1787 H3) with a single pure-text turn: it starts the stub SSE +// backend (RIG-1787 H3) with a single pure-text turn: it starts the stub SSE // server on the host's routable interface, writes a models.yml custom // openai-completions provider pointing at it (through the pasta host-gateway) // into a host dir bind-mounted at the agent's ~/.omp/agent, and pins the @@ -102,7 +102,7 @@ func WithCannedModel(reply string) fixtureOption { } // WithCannedScript makes NewFixture stand up the canned model backend serving an -// ordered multi-turn script (SEA-1788 H4): the agent settles request N on +// ordered multi-turn script (RIG-1788 H4): the agent settles request N on // script[N], so a multi-round scenario (e.g. a tool-call turn then a closing // text turn) advances one scripted turn per model round-trip. It shares the same // underlying backend as WithCannedModel — the single-turn convenience is just a @@ -129,7 +129,7 @@ func WithCannedMarkerReply(marker, reply string) fixtureOption { } // WithSite makes NewFixture reuse a persistent site (root/stateDir/ports) rather -// than minting fresh ephemeral ones — the SEA-1790 H6 cross-restart substrate. +// than minting fresh ephemeral ones — the RIG-1790 H6 cross-restart substrate. // Two NewFixture calls over the SAME site drive two stack lifecycles that share // the postgres data dir (under stateDir), so the second Up re-attaches the // persisted cluster and the same handle resolves to the same account. The site's @@ -185,7 +185,7 @@ func (f *Fixture) RuntimeDir() string { return f.runtimeDir } // present. // // opts default to none — NewFixture(ctx, t) is the plain H1/H2 fixture. Pass -// WithCannedModel to stand up the SEA-1787 H3 deterministic model backend so a +// WithCannedModel to stand up the RIG-1787 H3 deterministic model backend so a // real agent turn can settle with no live-model egress. func NewFixture(ctx context.Context, t *testing.T, opts ...fixtureOption) *Fixture { t.Helper() @@ -265,7 +265,7 @@ func NewFixture(ctx context.Context, t *testing.T, opts ...fixtureOption) *Fixtu ExternalOTLPEndpoint: "127.0.0.1:4317", } - // Canned-model mode (SEA-1787 H3): stand up the deterministic stub, write a + // Canned-model mode (RIG-1787 H3): stand up the deterministic stub, write a // models.yml pointing the agent's custom openai-completions provider at it, // and pin the three A4 knobs so the agent resolves that provider and its // default-deny egress permits exactly the stub. Overrides the illustrative @@ -502,7 +502,7 @@ func shortRoot(t *testing.T, suffix string) string { // ports — that outlives a single NewFixture call so two Ups (WithSite) can share // it: the postgres data dir lives under stateDir, so the second Up re-attaches // the cluster the first initialized. Produced by newPersistentSite, consumed via -// WithSite. The SEA-1790 H6 cross-restart leg is its only user. +// WithSite. The RIG-1790 H6 cross-restart leg is its only user. type fixtureSite struct { root string stateDir string diff --git a/go/e2e/legthreefour_test.go b/go/e2e/legthreefour_test.go index f54f50854..e53283c2c 100644 --- a/go/e2e/legthreefour_test.go +++ b/go/e2e/legthreefour_test.go @@ -222,7 +222,7 @@ func TestLegThreeFourSpawnAndMessaging(t *testing.T) { // Open one subscription before the post so it sees the live fan of the // deliver-side MessagePosted event. sinceSeq 0 snapshots then tails. (The - // recipient-side steer/deliver split is the deferred TODO(SEA-1788) below, + // recipient-side steer/deliver split is the deferred TODO(RIG-1788) below, // not observed here.) sub, err := f.SubscribeComms(ctx, 0) if err != nil { @@ -257,7 +257,7 @@ func TestLegThreeFourSpawnAndMessaging(t *testing.T) { } // ── Leg-4 recipient-side steer/deliver SPLIT (RIG-2488, replaces the former - // TODO(SEA-1788)) ────────────────────────────────────────────────────────── + // TODO(RIG-1788)) ────────────────────────────────────────────────────────── // // The mentioned peer's live session must receive a STEER for a mention while // an unmentioned-but-subscribed member receives a plain DELIVER of the same diff --git a/go/e2e/legtwo_test.go b/go/e2e/legtwo_test.go index 8a5784361..e7e716e51 100644 --- a/go/e2e/legtwo_test.go +++ b/go/e2e/legtwo_test.go @@ -66,7 +66,7 @@ func TestLegTwoPrimitives(t *testing.T) { // turn -> AwaitTurnSettled -> assert the session's transcript is non-empty. On // H2 it was PRESENT-BUT-SKIPPED: the leg-2 turn cannot complete without a // deterministic model backend, so on the bare stack the settle would hang and -// the transcript stay empty. H3 (SEA-1787) lands that backend — the canned stub +// the transcript stay empty. H3 (RIG-1787) lands that backend — the canned stub // the fixture stands up via WithCannedModel — so this same scenario now runs // GREEN with zero live-model egress. // diff --git a/go/e2e/teardown.go b/go/e2e/teardown.go index 396bad3a5..148d1de4f 100644 --- a/go/e2e/teardown.go +++ b/go/e2e/teardown.go @@ -10,7 +10,7 @@ import ( // podmanRemoveForce force-removes a container by its EXACT name, tolerating a // missing container (a fresh slate is the goal, not a guaranteed prior -// existence). This is the SEA-1790 A6 preflight: before a re-run Provisions the +// existence). This is the RIG-1790 A6 preflight: before a re-run Provisions the // same deterministic name, the leaked container from a prior lifetime is swept // so `podman create --name` does not collide. // diff --git a/go/gen/compass/v1/comms.pb.go b/go/gen/compass/v1/comms.pb.go index 935f364a9..e800833c4 100644 --- a/go/gen/compass/v1/comms.pb.go +++ b/go/gen/compass/v1/comms.pb.go @@ -238,7 +238,7 @@ func (ChannelKind) EnumDescriptor() ([]byte, []int) { return file_compass_v1_comms_proto_rawDescGZIP(), []int{3} } -// The presence states a live agent projects (SEA-1569, OQ-1). MVP is four +// The presence states a live agent projects (RIG-1569, OQ-1). MVP is four // states derived from the session lifecycle; PUBLIC, NOT gen-fenced. type AgentPresence int32 @@ -1459,7 +1459,7 @@ type AskQuestion struct { // for allow_multiple, alongside) picking options. CustomText string `protobuf:"bytes,8,opt,name=custom_text,json=customText,proto3" json:"custom_text,omitempty"` // True when the answer was recorded by timeout auto-selection rather than a - // participant (SEA-1310 owns whether/when the Compass answer path can time + // participant (RIG-1310 owns whether/when the Compass answer path can time // out; the field is the audit carrier either way). TimedOut bool `protobuf:"varint,9,opt,name=timed_out,json=timedOut,proto3" json:"timed_out,omitempty"` unknownFields protoimpl.UnknownFields @@ -1858,7 +1858,7 @@ type SubscribeCommsResponse_ResyncRequired struct { } type SubscribeCommsResponse_AgentPresenceChanged struct { - // A live agent's presence changed (SEA-1569). Derived from the session + // A live agent's presence changed (RIG-1569). Derived from the session // lifecycle (not a heartbeat); PUBLIC — UI board state consumes it. AgentPresenceChanged *AgentPresenceChanged `protobuf:"bytes,17,opt,name=agent_presence_changed,json=agentPresenceChanged,proto3,oneof"` } @@ -2261,7 +2261,7 @@ func (*CommsResyncRequired) Descriptor() ([]byte, []int) { return file_compass_v1_comms_proto_rawDescGZIP(), []int{23} } -// A live agent's presence changed (SEA-1569). Presence is derived from the +// A live agent's presence changed (RIG-1569). Presence is derived from the // session lifecycle (D4) — a projection of the session state and the Runner // link, not a heartbeat. PUBLIC (UI board state, comms presence, the // delivery-settle gate consume it); NOT gen-fenced. diff --git a/go/gen/compass/v1/compass.pb.go b/go/gen/compass/v1/compass.pb.go index a03cbfa8e..898d26681 100644 --- a/go/gen/compass/v1/compass.pb.go +++ b/go/gen/compass/v1/compass.pb.go @@ -190,7 +190,7 @@ func (ServerState) EnumDescriptor() ([]byte, []int) { // applies as written). OQ6, design docs/designs/platform/go-toolchain-default.md // :1378-1396. // -// Scope: T4 (SEA-1243) ships the DISCONNECTED *signal* only. The server-side +// Scope: T4 (RIG-1243) ships the DISCONNECTED *signal* only. The server-side // reattach-window enforcement — the per-session registry, the bounded timer, // the expiry→ERRORED transition, and GetAgentStatus reconciliation on reattach // — is T9 (go-toolchain-default.md:979). Until T9 lands, a dropped Runner link @@ -371,7 +371,7 @@ func (AgentPlanEntryStatus) EnumDescriptor() ([]byte, []int) { // steer/deliver control discriminant (agent.proto), re-declared here on the // public surface because SessionEvent — the public SubscribeAgentSession payload // — cannot reference the fenced internal enum without breaching the gen-fence -// (SEA-1267); see the steer/deliver-seam design record, OQ2. +// (RIG-1267); see the steer/deliver-seam design record, OQ2. type SessionInjectionKind int32 const ( @@ -2667,7 +2667,7 @@ type ProvisionAgentWorkspaceRequest struct { // from CommsService). Names whose credentials + home channel the container // is provisioned for. AgentAccountId string `protobuf:"bytes,1,opt,name=agent_account_id,json=agentAccountId,proto3" json:"agent_account_id,omitempty"` - // Repo carriage removed (SEA-1527, Matt 2026-07-29): spawn/provision no longer + // Repo carriage removed (RIG-1527, Matt 2026-07-29): spawn/provision no longer // clone a repo for the agent. The container is provisioned with a git // credential + workspace and the agent self-clones whatever it needs after // launch. @@ -2913,7 +2913,7 @@ type StartAgentSessionRequest struct { // logical session: the Server (subscriber-authz gated) reconstructs the // stored transcript into a session-JSONL body the Runner materializes into // the new container at provision. Empty = fresh. No storage locator ever - // rides any request — storage is Server-internal (SEA-1570). + // rides any request — storage is Server-internal (RIG-1570). ResumeSessionId string `protobuf:"bytes,3,opt,name=resume_session_id,json=resumeSessionId,proto3" json:"resume_session_id,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -4543,7 +4543,7 @@ func (x *ChangedStats) GetDeletions() uint32 { type TrackerRef struct { state protoimpl.MessageState `protogen:"open.v1"` Kind string `protobuf:"bytes,1,opt,name=kind,proto3" json:"kind,omitempty"` // "linear" | "jira" | "github" — the tracker family - Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"` // the tracker's native issue id, e.g. "SEA-1042" + Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"` // the tracker's native issue id, e.g. "RIG-1042" Status string `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"` // the tracker's native status name in the user's org Url string `protobuf:"bytes,4,opt,name=url,proto3" json:"url,omitempty"` unknownFields protoimpl.UnknownFields diff --git a/go/internal/auth/admin_gate_test.go b/go/internal/auth/admin_gate_test.go index ca15b39c3..f83e03d97 100644 --- a/go/internal/auth/admin_gate_test.go +++ b/go/internal/auth/admin_gate_test.go @@ -1,6 +1,6 @@ package auth -// AdminGate + classifyProcedure + check contract tests (SEA-1195 T3a, the S3 +// AdminGate + classifyProcedure + check contract tests (RIG-1195 T3a, the S3 // "admin-guard" gate item), transcribed from the authoritative Rust suite in // crates/compass-daemon/src/auth.rs (#[cfg(test)] mod tests, the admin-gate // section: admin_gate_rejects_a_non_admin_on_a_gated_rpc, diff --git a/go/internal/auth/interceptor_pgtest_test.go b/go/internal/auth/interceptor_pgtest_test.go index d651e9ee9..b3f613731 100644 --- a/go/internal/auth/interceptor_pgtest_test.go +++ b/go/internal/auth/interceptor_pgtest_test.go @@ -2,7 +2,7 @@ package auth -// Store-backed BearerInterceptor contract tests (SEA-1195 T3, the S3 gate), +// Store-backed BearerInterceptor contract tests (RIG-1195 T3, the S3 gate), // transcribed from the authoritative Rust suite in // crates/compass-daemon/src/auth.rs (#[cfg(test)] mod tests, the bearer_auth // cases). BearerInterceptor now resolves a presented token against the Postgres diff --git a/go/internal/auth/interceptor_test.go b/go/internal/auth/interceptor_test.go index b2592a9c5..63b2bcd0a 100644 --- a/go/internal/auth/interceptor_test.go +++ b/go/internal/auth/interceptor_test.go @@ -1,7 +1,7 @@ package auth // Shared unary-door test scaffolding + the pure header-parse boundary table -// (SEA-1195 T3, the S3 gate), transcribed from the authoritative Rust suite in +// (RIG-1195 T3, the S3 gate), transcribed from the authoritative Rust suite in // crates/compass-daemon/src/auth.rs (#[cfg(test)] mod tests, the bearer_auth // cases). The Rust interceptor mutates a tonic Request and attaches an // AuthedAccount extension; the Go door is a connect UnaryInterceptorFunc that diff --git a/go/internal/auth/stream_test.go b/go/internal/auth/stream_test.go index b8fb63211..a206a3b99 100644 --- a/go/internal/auth/stream_test.go +++ b/go/internal/auth/stream_test.go @@ -2,7 +2,7 @@ package auth -// Streaming bearer-door contract tests (SEA-1195 T3, the S3 gate), transcribed +// Streaming bearer-door contract tests (RIG-1195 T3, the S3 gate), transcribed // from the authoritative Rust suite in crates/compass-daemon/src/auth.rs // (#[cfg(test)] mod tests, the bearer_auth cases). Those cover the unary door; // the Go door splits authentication across a UnaryInterceptorFunc and a streaming diff --git a/go/internal/auth/token_test.go b/go/internal/auth/token_test.go index cc95a49ea..056434e70 100644 --- a/go/internal/auth/token_test.go +++ b/go/internal/auth/token_test.go @@ -2,7 +2,7 @@ package auth -// Token issue/resolve contract tests (SEA-1195 T3, the S3 gate), transcribed +// Token issue/resolve contract tests (RIG-1195 T3, the S3 gate), transcribed // from the authoritative Rust suite in crates/compass-daemon/src/auth.rs // (#[cfg(test)] mod tests). Intent is carried onto Go idioms; the Rust is the // spec, not a template. diff --git a/go/internal/comms/agent_caller.go b/go/internal/comms/agent_caller.go index 4529f854a..729af22e7 100644 --- a/go/internal/comms/agent_caller.go +++ b/go/internal/comms/agent_caller.go @@ -10,7 +10,7 @@ // agent made deliberately, as a tool. // - CommitAgentPost / CommitAgentUpdate turn a relayed conversation FRAME (the // agent's own turn, streamed out as it speaks) into a durable comms row -// (SEA-1364 T3). They survive only as test helpers now: their production +// (RIG-1364 T3). They survive only as test helpers now: their production // caller (the ConversationSink write-through) was removed with the sink, so // no non-test path reaches them. // diff --git a/go/internal/comms/agent_conversation_pgtest_test.go b/go/internal/comms/agent_conversation_pgtest_test.go index 6816f45b9..a36bd9a44 100644 --- a/go/internal/comms/agent_conversation_pgtest_test.go +++ b/go/internal/comms/agent_conversation_pgtest_test.go @@ -2,7 +2,7 @@ package comms -// The conversation write-through (SEA-1364 T3): CommitAgentPost / CommitAgentUpdate +// The conversation write-through (RIG-1364 T3): CommitAgentPost / CommitAgentUpdate // turn a relayed agent conversation frame into a durable comms row under the // account the RunnerHub resolved the session to. Every test drives the real // Postgres store + real bus (the newHandler / newStreamHarness harnesses the rest diff --git a/go/internal/comms/channel_policy_pgtest_test.go b/go/internal/comms/channel_policy_pgtest_test.go index aec3e0f88..a020c6091 100644 --- a/go/internal/comms/channel_policy_pgtest_test.go +++ b/go/internal/comms/channel_policy_pgtest_test.go @@ -2,7 +2,7 @@ package comms -// SetChannelPolicy handler + policy enforcement at the RPC edge (SEA-1722 T4): +// SetChannelPolicy handler + policy enforcement at the RPC edge (RIG-1722 T4): // the handler sets the policy and echoes the updated channel; an OWNER_ONLY // non-owner post maps to CodeNotFound (the no-oracle in-band rejection); an // unsubscribe on a mandatory channel maps to CodeInvalidArgument. Driven diff --git a/go/internal/comms/comms.go b/go/internal/comms/comms.go index c3e72ecd8..9d8d0a37e 100644 --- a/go/internal/comms/comms.go +++ b/go/internal/comms/comms.go @@ -48,7 +48,7 @@ type Comms struct { // a caller on the context; adminID is the fallback when none is set. adminID store.AccountID // presence is the in-memory presence enum source GetRoster joins the durable - // tree + activity against (SEA-1721 T2). Nil until SetPresenceSource wires it + // tree + activity against (RIG-1721 T2). Nil until SetPresenceSource wires it // (comms<->hub is a construction cycle, broken by a post-construction setter // exactly like hub.SetSettleSink). Set once at server assembly BEFORE any RPC // is served, so it needs no lock. Nil-safe: a Comms with no presence source @@ -133,7 +133,7 @@ func (c *Comms) CreateAgent( } // Install the coordination emit buffer so the store's in-tx coordination hook // (fired inside CreateAgent when this agent has a parent) records its channel - // change here; drained + emitted post-commit below (SEA-1722 T5). + // change here; drained + emitted post-commit below (RIG-1722 T5). ctx, coordChanges := withCoordChanges(ctx) acc, err := c.store.CreateAgent(ctx, owner, store.NewAgent{ Handle: req.Msg.GetHandle(), @@ -269,7 +269,7 @@ func (c *Comms) ReparentAgent( ) (*connect.Response[compassv1.ReparentAgentResponse], error) { // Install the coordination emit buffer so the store's in-tx coordination hook // (fired inside ReparentAgent for both the new and old managers) records its - // channel changes here; drained + emitted post-commit below (SEA-1722 T5). + // channel changes here; drained + emitted post-commit below (RIG-1722 T5). ctx, coordChanges := withCoordChanges(ctx) acc, err := c.store.ReparentAgent( ctx, @@ -446,7 +446,7 @@ func (c *Comms) UpdateTopic( return connect.NewResponse(&compassv1.UpdateTopicResponse{Topic: topicToWire(topic)}), nil } -// ---- manager-comms-substrate RPCs (SEA-1740 T1) ---- +// ---- manager-comms-substrate RPCs (RIG-1740 T1) ---- // // GetRoster, SetChannelPolicy, and UpdatePinnedBoard are the T1 proto surface of // the manager-comms substrate. T1 lands the contract (proto + regen) proto-first; diff --git a/go/internal/comms/comms_test.go b/go/internal/comms/comms_test.go index 22c3d5209..e17eb998f 100644 --- a/go/internal/comms/comms_test.go +++ b/go/internal/comms/comms_test.go @@ -280,7 +280,7 @@ func TestRespondToAskHappyPathEmitsMessageUpdated(t *testing.T) { } } -// SEA-1707 T6/D6: an ask is carried by a message, a message lives in a topic, so +// RIG-1707 T6/D6: an ask is carried by a message, a message lives in a topic, so // an ask is visible in its topic yet answerable channel-wide (first-responder- // wins). Topic scoping changes WHERE the ask renders, not WHO may answer it. // This locks channel-scoped (not topic-scoped) answerability: the answerer has @@ -627,7 +627,7 @@ func TestPostMessageRoutesTopicOverWire(t *testing.T) { } } -// TestPostMessageStripsCallerAskID pins Fork 1 (SEA-1243): ask_id is server- +// TestPostMessageStripsCallerAskID pins Fork 1 (RIG-1243): ask_id is server- // owned. askFromWire drops any caller-supplied Ask.ask_id, so an ask posted over // the wire always gets a fresh 32-hex id minted by the store, a caller-forged id // never survives, two posts carrying the SAME forged id get DISTINCT minted ids diff --git a/go/internal/comms/coordination.go b/go/internal/comms/coordination.go index 2773ee8f3..39ae440be 100644 --- a/go/internal/comms/coordination.go +++ b/go/internal/comms/coordination.go @@ -10,7 +10,7 @@ import ( "github.com/RigelBuild/compass/go/internal/store" ) -// The manager-comms coordination-channel reconcile (SEA-1722 T5, design.md: +// The manager-comms coordination-channel reconcile (RIG-1722 T5, design.md: // 530-592). A manager's coordination channel is auto-provisioned from the agent // tree's parent edges: the store's two parent-edge writers (CreateAgent, // ReparentAgent) invoke a store-registered hook on their own tx right after @@ -80,7 +80,7 @@ const coordinationChannelSuffix = "-coordination" // RegisterCoordinationHook registers this handler's in-tx coordination reconcile // as st's CoordinationHook, wired once at server assembly before serving -// (SEA-1722 T5). It is the comms->store direction of the coordination wiring: the +// (RIG-1722 T5). It is the comms->store direction of the coordination wiring: the // store invokes the closure on its own tx from the two parent-edge writers, so // the reconcile runs comms-owned logic without the store importing comms. The // hook does NOT install a coordChanges buffer itself — the parent-edge RPC diff --git a/go/internal/comms/coordination_pgtest_test.go b/go/internal/comms/coordination_pgtest_test.go index 239229711..46d4d4ec4 100644 --- a/go/internal/comms/coordination_pgtest_test.go +++ b/go/internal/comms/coordination_pgtest_test.go @@ -2,7 +2,7 @@ package comms -// Coordination-channel handler contracts (SEA-1722 T5, design.md:530-592): the +// Coordination-channel handler contracts (RIG-1722 T5, design.md:530-592): the // CreateAgent-with-parent and ReparentAgent RPC paths fire the store's in-tx // coordination hook (registered here via RegisterCoordinationHook) and emit the // coordination ChannelChanged post-commit, and the manual entrypoints diff --git a/go/internal/comms/mapping.go b/go/internal/comms/mapping.go index b4b6f7d20..724175e77 100644 --- a/go/internal/comms/mapping.go +++ b/go/internal/comms/mapping.go @@ -139,7 +139,7 @@ func workspaceToWire(w store.AgentWorkspace) *compassv1.AgentWorkspace { } // MessageToWire maps a store.Message onto the compass.v1 wire Message. Exported -// so the delivery consumer (internal/delivery, SEA-1569 T3) dispatches a +// so the delivery consumer (internal/delivery, RIG-1569 T3) dispatches a // re-read settled message through the ONE store->wire mapper rather than a // second convention (the settle gate and the no-live-author path both re-read // the message's current blocks from the store before dispatch). diff --git a/go/internal/comms/pinned_board_pgtest_test.go b/go/internal/comms/pinned_board_pgtest_test.go index 21516c16b..f3bac13a6 100644 --- a/go/internal/comms/pinned_board_pgtest_test.go +++ b/go/internal/comms/pinned_board_pgtest_test.go @@ -2,7 +2,7 @@ package comms -// UpdatePinnedBoard handler contracts at the RPC edge (SEA-1723 T6, +// UpdatePinnedBoard handler contracts at the RPC edge (RIG-1723 T6, // design.md:626-637): the handler authorizes a board mutation against the // channel's post_policy (any member on OPEN, only the owner on OWNER_ONLY, a // non-owner collapsing to the SAME CodeNotFound a non-member gets — no oracle), diff --git a/go/internal/comms/roster_pgtest_test.go b/go/internal/comms/roster_pgtest_test.go index f79398dfe..9c5be01d0 100644 --- a/go/internal/comms/roster_pgtest_test.go +++ b/go/internal/comms/roster_pgtest_test.go @@ -2,7 +2,7 @@ package comms -// GetRoster roster-read contracts (SEA-1721 T2), driven against a real Postgres +// GetRoster roster-read contracts (RIG-1721 T2), driven against a real Postgres // store + real bus (no mocks — newHandler), each defending one clause of the // three-source join (design.md T2:426-452): the durable tree, the live presence // enum (an in-memory fake presence source), and the durable activity string diff --git a/go/internal/comms/subscribe.go b/go/internal/comms/subscribe.go index b1ae2fa49..7851a6821 100644 --- a/go/internal/comms/subscribe.go +++ b/go/internal/comms/subscribe.go @@ -68,7 +68,7 @@ func (c *Comms) SubscribeComms( // token that survives restarts and covers the empty-ring bootstrap // (design.md:809-816). A visibility-scoped boundary is a different token with // a different meaning; the count-metadata exposure is accepted as within the - // threat model (SEA-1333 OQ4, Matt's ruling). + // threat model (RIG-1333 OQ4, Matt's ruling). if req.Msg.GetSinceSeq() == 0 { head, err := c.store.MessagesHeadSeq(ctx) if err != nil { @@ -261,7 +261,7 @@ type eventVisibility interface { // IsAgentWorkspaceVisible gates AgentWorkspaceChanged (OpenAgentWorkspace: // home-channel membership). IsAgentWorkspaceVisible(ctx context.Context, actor store.AccountID, agentAccountID store.AccountID) (bool, error) - // SharesVisibleChannel gates AgentPresenceChanged (SEA-1569 T8): the actor + // SharesVisibleChannel gates AgentPresenceChanged (RIG-1569 T8): the actor // receives an agent's presence only when it shares at least one channel with // that agent — the shared-channel rule matching the fan-out's per-actor // scoping (design.md:487-491). diff --git a/go/internal/comms/subscribe_test.go b/go/internal/comms/subscribe_test.go index 20289a7d1..6c2d7cf2b 100644 --- a/go/internal/comms/subscribe_test.go +++ b/go/internal/comms/subscribe_test.go @@ -313,7 +313,7 @@ func TestSubscribeCommsPostDeliversMessagePosted(t *testing.T) { } } -// TestSubscribeCommsAgentPresenceSharedChannelScoping is the SEA-1569 T8 +// TestSubscribeCommsAgentPresenceSharedChannelScoping is the RIG-1569 T8 // visibility arm: an AgentPresenceChanged is delivered to an actor sharing a // visible channel with the agent and filtered from an actor sharing none — the // shared-channel rule the subscribe edge enforces (design.md:487-491). The diff --git a/go/internal/delivery/consumer.go b/go/internal/delivery/consumer.go index 0d930bc8b..2d1683e32 100644 --- a/go/internal/delivery/consumer.go +++ b/go/internal/delivery/consumer.go @@ -1,6 +1,6 @@ //go:build unix -// Package delivery is the Server-side notification fan-out consumer (SEA-1569 +// Package delivery is the Server-side notification fan-out consumer (RIG-1569 // T3, design record D1). It tails the in-process comms event bus and, for each // posted message, resolves the subscribed agent sessions and dispatches a // `deliver` control down the existing Sessions relay to each live recipient — @@ -186,7 +186,7 @@ type Consumer struct { // (coalescing wakeups): the hook appends and signals without blocking Deliver. settleQueue []settleEvent // startQueue buffers session-start edges the hook enqueues, drained by the - // loop under its ctx into the reconnect sweep (SEA-1569 T6). Same shape as + // loop under its ctx into the reconnect sweep (RIG-1569 T6). Same shape as // settleQueue: a slice (never lost) plus the shared notify wakeup, so the // hook appends and signals without blocking the hub's Start goroutine. startQueue []startEvent diff --git a/go/internal/delivery/consumer_test.go b/go/internal/delivery/consumer_test.go index 81a1337d4..bdfde83b0 100644 --- a/go/internal/delivery/consumer_test.go +++ b/go/internal/delivery/consumer_test.go @@ -2,7 +2,7 @@ package delivery -// The fan-out consumer's acceptance cases (SEA-1569 T3, design.md:744-761), +// The fan-out consumer's acceptance cases (RIG-1569 T3, design.md:744-761), // RED-first. Each drives the consumer through the real events bus + hand-written // fakes and gates on the recorder's observed dispatches — never a sleep, never a // retry (rule://no-retries). context.Background() is the test root @@ -397,7 +397,7 @@ func TestRefusedDispatchIsNonFatalNoAdvance(t *testing.T) { } } -// FIX 1 (SEA-1569 T3 review): a bus-lag overrun must RE-SUBSCRIBE and keep +// FIX 1 (RIG-1569 T3 review): a bus-lag overrun must RE-SUBSCRIBE and keep // delivering, not terminate the singleton consumer goroutine. design.md:227-231 // rules a resync "a latency blip, never a loss" and says the consumer "treats a // resync exactly as SubscribeComms clients do" — a client re-subscribes and @@ -462,7 +462,7 @@ func TestBusLagResubscribesAndKeepsDelivering(t *testing.T) { } } -// FIX A (SEA-1569 T3 round-2 review): a bus-lag resync must SUBSCRIBE before it +// FIX A (RIG-1569 T3 round-2 review): a bus-lag resync must SUBSCRIBE before it // sweeps, or a message committed+published in the window between the sweep's // owed-read and the fresh Subscribe's lock-acquire is delivered to no one until // the recipient reconnects. The post path commits the store row before @@ -598,7 +598,7 @@ func (d *blockCapturingDispatcher) waitFor(t *testing.T, messageID string) block } } -// FIX 3 (SEA-1569 T3 review): the no-live-author path must deliver from the +// FIX 3 (RIG-1569 T3 review): the no-live-author path must deliver from the // STORED block set, not the posted (possibly partial) wire message. The branch // comment and design.md:177-178,:306 both specify "from its stored block set"; // the pre-fix code fanned out the raw bus `msg`. This seeds the store with a diff --git a/go/internal/delivery/mention_test.go b/go/internal/delivery/mention_test.go index ae53450eb..8688e759f 100644 --- a/go/internal/delivery/mention_test.go +++ b/go/internal/delivery/mention_test.go @@ -2,7 +2,7 @@ package delivery -// The mention→steer routing acceptance cases (SEA-1569 T7, design record D5, +// The mention→steer routing acceptance cases (RIG-1569 T7, design record D5, // design.md:507-562, 848-855), RED-first. Each drives the consumer through the // real events bus + hand-written fakes and gates on the recorder's observed // dispatches (op-kind: steer vs deliver) — never a sleep, never a retry diff --git a/go/internal/delivery/pin_sweep_test.go b/go/internal/delivery/pin_sweep_test.go index 3e90ffb85..d58d2f07f 100644 --- a/go/internal/delivery/pin_sweep_test.go +++ b/go/internal/delivery/pin_sweep_test.go @@ -2,7 +2,7 @@ package delivery -// SEA-1723 T7 — the session-start pin sweep, RED-first. A session-start edge +// RIG-1723 T7 — the session-start pin sweep, RED-first. A session-start edge // (OnSessionStarted) drains through the loop's drainStarts, which runs the // EXISTING cursor sweep (sweepSession) and then the new sibling pin step // (sweepPins): for every channel the agent sweeps (SweepChannels, the D1 diff --git a/go/internal/delivery/reap_test.go b/go/internal/delivery/reap_test.go index f7756d395..f4ad47f43 100644 --- a/go/internal/delivery/reap_test.go +++ b/go/internal/delivery/reap_test.go @@ -2,7 +2,7 @@ package delivery -// SEA-1569 T3 — OnSessionsReaped (the hub's SessionReapSink) drops the +// RIG-1569 T3 — OnSessionsReaped (the hub's SessionReapSink) drops the // held-deliver registry entries for sessions whose hub bindings were cleared at // a Runner (re-)enroll, so a no-frame author death's entry does not leak until // process restart (design.md:172-175). White-box (package delivery) so the test diff --git a/go/internal/delivery/settle.go b/go/internal/delivery/settle.go index e6f703386..5a6df5f18 100644 --- a/go/internal/delivery/settle.go +++ b/go/internal/delivery/settle.go @@ -34,7 +34,7 @@ func (c *Consumer) OnSessionSettled(sessionID string, state compassv1.AgentSessi } } -// OnSessionStarted is the hub's SessionStartSink hook (SEA-1569 T6), called from +// OnSessionStarted is the hub's SessionStartSink hook (RIG-1569 T6), called from // promoteSession right after the hub binds account->session at StartAgentSession // (and, in the single-Runner MVP, on the re-promotion each session takes after a // Runner re-enroll clears the bindings). Like OnSessionSettled it must NOT block diff --git a/go/internal/delivery/sweep_test.go b/go/internal/delivery/sweep_test.go index 5593da33e..e98d803bb 100644 --- a/go/internal/delivery/sweep_test.go +++ b/go/internal/delivery/sweep_test.go @@ -2,7 +2,7 @@ package delivery -// SEA-1569 T6 — the reconnect/start redelivery sweep, RED-first. A session-start +// RIG-1569 T6 — the reconnect/start redelivery sweep, RED-first. A session-start // edge (OnSessionStarted, the hub's SessionStartSink hook fired at // promoteSession) enqueues into the consumer's ctx-rooted loop, which sweeps the // freshly-live session's owed messages (UndeliveredMessages) and re-dispatches diff --git a/go/internal/forge/golden_capture_test.go b/go/internal/forge/golden_capture_test.go index ff5e244c2..2522c2255 100644 --- a/go/internal/forge/golden_capture_test.go +++ b/go/internal/forge/golden_capture_test.go @@ -473,7 +473,7 @@ func TestUpdateCanonicalizeStable(t *testing.T) { "number": 555, "title": "live compass-xyz", "description": "stamped body", - "url": "https://linear.app/x/issue/SEA-555", + "url": "https://linear.app/x/issue/RIG-555", "state": { "name": "Todo", "type": "unstarted" }, "labels": { "nodes": [] }, "creator": { "displayName": "live-bot" }, diff --git a/go/internal/forge/linear_test.go b/go/internal/forge/linear_test.go index 6f9090f0f..0c8ce812c 100644 --- a/go/internal/forge/linear_test.go +++ b/go/internal/forge/linear_test.go @@ -100,7 +100,7 @@ func TestLinearCreateIssueRequestGolden(t *testing.T) { probeResp(true), // actor probe: capable {status: 200, body: `{"data":{"issueCreate":{"issue":{ "number":42,"title":"a bug","description":"stamped body", - "url":"https://linear.app/x/issue/SEA-42","state":{"name":"Todo","type":"unstarted"}, + "url":"https://linear.app/x/issue/RIG-42","state":{"name":"Todo","type":"unstarted"}, "labels":{"nodes":[]},"creator":null,"updatedAt":"2026-08-01T12:30:00Z"}}}}`}, }} l := newTestLinear(rt, &fakeTokenSource{token: "sekret"}, slog.New(&capturingHandler{})) @@ -137,7 +137,7 @@ func TestLinearCreateIssueRequestGolden(t *testing.T) { t.Errorf("displayIconUrl = %v, want %q", input["displayIconUrl"], attributionIconURL) } if got.Number != 42 || got.Title != "a bug" || got.Body != "stamped body" || - got.State != "open" || got.URL != "https://linear.app/x/issue/SEA-42" { + got.State != "open" || got.URL != "https://linear.app/x/issue/RIG-42" { t.Errorf("decoded Issue = %+v", got) } } @@ -149,7 +149,7 @@ func TestLinearCommentOnIssueRequestGolden(t *testing.T) { {status: 200, body: `{"data":{"issues":{"nodes":[{"id":"issue-uuid-9"}]}}}`}, // resolve issue id probeResp(true), // actor probe {status: 200, body: `{"data":{"commentCreate":{"comment":{ - "id":"comment-uuid","url":"https://linear.app/x/issue/SEA-7#comment-1", + "id":"comment-uuid","url":"https://linear.app/x/issue/RIG-7#comment-1", "body":"a reply","user":null}}}}`}, }} l := newTestLinear(rt, &fakeTokenSource{token: "t"}, slog.New(&capturingHandler{})) @@ -174,7 +174,7 @@ func TestLinearCommentOnIssueRequestGolden(t *testing.T) { if input["createAsUser"] != attributionUser { t.Errorf("createAsUser = %v, want %q", input["createAsUser"], attributionUser) } - if got.Body != "a reply" || got.URL != "https://linear.app/x/issue/SEA-7#comment-1" { + if got.Body != "a reply" || got.URL != "https://linear.app/x/issue/RIG-7#comment-1" { t.Errorf("decoded Comment = %+v", got) } } @@ -218,7 +218,7 @@ func TestLinearGetIssueMapping(t *testing.T) { rt := &scriptedRoundTripper{responses: []scriptedResponse{ {status: 200, body: `{"data":{"issues":{"nodes":[{ "number":7,"title":"a bug","description":"raw body", - "url":"https://linear.app/x/issue/SEA-7","state":{"name":"Done","type":"completed"}, + "url":"https://linear.app/x/issue/RIG-7","state":{"name":"Done","type":"completed"}, "labels":{"nodes":[{"name":"bug"},{"name":"p1"}]}, "creator":{"displayName":"alice"},"updatedAt":"2026-08-01T12:30:00Z"}]}}}`}, }} diff --git a/go/internal/forge/notify_reader_test.go b/go/internal/forge/notify_reader_test.go index b40c86d8d..1641e9252 100644 --- a/go/internal/forge/notify_reader_test.go +++ b/go/internal/forge/notify_reader_test.go @@ -279,7 +279,7 @@ func TestListNewArtifactsPage1_304(t *testing.T) { // TestLinearReaderNoETags: a Linear issue read returns a 200-equivalent with an // EMPTY ETag (GraphQL has no ETags — the documented backstop limitation). func TestLinearReaderNoETags(t *testing.T) { - body := `{"data":{"issues":{"nodes":[{"number":7,"title":"t","description":"d","url":"https://linear.app/x/SEA-7","state":{"name":"Todo","type":"unstarted"},"labels":{"nodes":[]},"creator":null,"updatedAt":""}]}}}` + body := `{"data":{"issues":{"nodes":[{"number":7,"title":"t","description":"d","url":"https://linear.app/x/RIG-7","state":{"name":"Todo","type":"unstarted"},"labels":{"nodes":[]},"creator":null,"updatedAt":""}]}}}` rt := &scriptedRoundTripper{responses: []scriptedResponse{{status: 200, body: body}}} l := newTestLinear(rt, &fakeTokenSource{token: "t"}, nil) diff --git a/go/internal/forge/testdata/linear/comment_on_issue.json b/go/internal/forge/testdata/linear/comment_on_issue.json index 0f8fbb346..612e891c6 100644 --- a/go/internal/forge/testdata/linear/comment_on_issue.json +++ b/go/internal/forge/testdata/linear/comment_on_issue.json @@ -40,7 +40,7 @@ "commentCreate": { "comment": { "id": "comment-uuid", - "url": "https://linear.app/x/issue/SEA-7#comment-1", + "url": "https://linear.app/x/issue/RIG-7#comment-1", "body": "a reply", "user": null } @@ -49,7 +49,7 @@ }, "want": { "ID": 0, - "URL": "https://linear.app/x/issue/SEA-7#comment-1", + "URL": "https://linear.app/x/issue/RIG-7#comment-1", "Body": "a reply", "ForgeAccount": "" } diff --git a/go/internal/forge/testdata/linear/create_issue.json b/go/internal/forge/testdata/linear/create_issue.json index b8b8a728b..16b0e8e9f 100644 --- a/go/internal/forge/testdata/linear/create_issue.json +++ b/go/internal/forge/testdata/linear/create_issue.json @@ -45,7 +45,7 @@ "number": 42, "title": "a bug", "description": "stamped body", - "url": "https://linear.app/x/issue/SEA-42", + "url": "https://linear.app/x/issue/RIG-42", "state": { "name": "Todo", "type": "unstarted" }, "labels": { "nodes": [] }, "creator": null, @@ -59,7 +59,7 @@ "Title": "a bug", "Body": "stamped body", "State": "open", - "URL": "https://linear.app/x/issue/SEA-42", + "URL": "https://linear.app/x/issue/RIG-42", "ForgeAccount": "", "Labels": [], "UpdatedAt": "2026-08-01T12:30:00Z" diff --git a/go/internal/forge/testdata/linear/get_issue.json b/go/internal/forge/testdata/linear/get_issue.json index 7cf4798a9..1c42c4317 100644 --- a/go/internal/forge/testdata/linear/get_issue.json +++ b/go/internal/forge/testdata/linear/get_issue.json @@ -26,7 +26,7 @@ "number": 7, "title": "a bug", "description": "raw body", - "url": "https://linear.app/x/issue/SEA-7", + "url": "https://linear.app/x/issue/RIG-7", "state": { "name": "Todo", "type": "unstarted" }, "labels": { "nodes": [] }, "creator": null, @@ -41,7 +41,7 @@ "Title": "a bug", "Body": "raw body", "State": "open", - "URL": "https://linear.app/x/issue/SEA-7", + "URL": "https://linear.app/x/issue/RIG-7", "ForgeAccount": "", "Labels": [], "UpdatedAt": "2026-08-01T12:30:00Z" diff --git a/go/internal/forge/testdata/linear/list_issues.json b/go/internal/forge/testdata/linear/list_issues.json index dd5d1185b..b08afca45 100644 --- a/go/internal/forge/testdata/linear/list_issues.json +++ b/go/internal/forge/testdata/linear/list_issues.json @@ -28,7 +28,7 @@ "number": 7, "title": "a bug", "description": "raw body", - "url": "https://linear.app/x/issue/SEA-7", + "url": "https://linear.app/x/issue/RIG-7", "state": { "name": "Todo", "type": "unstarted" }, "labels": { "nodes": [] }, "creator": null, @@ -45,7 +45,7 @@ "Title": "a bug", "Body": "raw body", "State": "open", - "URL": "https://linear.app/x/issue/SEA-7", + "URL": "https://linear.app/x/issue/RIG-7", "ForgeAccount": "", "Labels": [], "UpdatedAt": "2026-08-01T12:30:00Z" diff --git a/go/internal/gen/compass/v1/agent.pb.go b/go/internal/gen/compass/v1/agent.pb.go index 615367ac5..c561fd1e0 100644 --- a/go/internal/gen/compass/v1/agent.pb.go +++ b/go/internal/gen/compass/v1/agent.pb.go @@ -204,7 +204,7 @@ type AgentFrame_ControlAck struct { type AgentFrame_DeliveryAck struct { // delivery_ack — the agent's per-message delivery receipt for a // - // DeliverControl relayed down the session (SEA-1569). The success + // DeliverControl relayed down the session (RIG-1569). The success // receipt for a delivery rides this frame, not the Runner result // stream (RT-3); the Server advances the delivery cursor on it. DeliveryAck *DeliveryAck `protobuf:"bytes,6,opt,name=delivery_ack,json=deliveryAck,proto3,oneof"` @@ -215,7 +215,7 @@ type AgentFrame_TranscriptEntry struct { // // the DURABLE conversation-frame lane (PostConversationFrame → // CommitConversationFrame), not the loss-tolerable Publish spine - // (SEA-1570). The Server persists it; the agent's local copy is + // (RIG-1570). The Server persists it; the agent's local copy is // container-ephemeral. Reconstructed into a session-JSONL body on // resume (T4/T5). TranscriptEntry *TranscriptEntry `protobuf:"bytes,7,opt,name=transcript_entry,json=transcriptEntry,proto3,oneof"` @@ -245,7 +245,7 @@ func (*AgentFrame_ForgeNotificationAck) isAgentFrame_Frame() {} // The `transcript_entry` variant's payload: one committed SDK session entry, // teed upstream by the agent's session-storage backend as a durable frame -// (SEA-1570). `append` → a delta entry (checkpoint = false); `writeFull` (an +// (RIG-1570). `append` → a delta entry (checkpoint = false); `writeFull` (an // SDK compaction/title rewrite) → a checkpoint entry (checkpoint = true, the // full body as one payload). INTERNAL-only, like the rest of this file. type TranscriptEntry struct { @@ -405,10 +405,10 @@ func (x *SessionFrame) GetTypedEvent() *v1.SessionEvent { // `AgentMessage` (a four-way union with an opaque provider payload) and a tool // set (whose SDK representation includes a non-serializable `execute` handle), // neither of which any existing compass.v1 message represents. That payload- -// shape decision is parked (SEA-1310); the shells keep the oneof complete on +// shape decision is parked (RIG-1310); the shells keep the oneof complete on // the wire and are populated by a stacked PR once the shapes settle // (DeliverControl and the channel-borne SteerControl were so populated by -// SEA-1569, each carrying a comms Message). Defining the empty shells now is +// RIG-1569, each carrying a comms Message). Defining the empty shells now is // additive and buf-breaking-safe (field additions to a proto3 message). type AgentControl struct { state protoimpl.MessageState `protogen:"open.v1"` @@ -672,12 +672,12 @@ func (*ReplayComplete) Descriptor() ([]byte, []int) { } // SteerControl carries a comms Message: a channel `@`-mention routed into the -// agent's live session as a steer (SEA-1569), sourced from a channel +// agent's live session as a steer (RIG-1569), sourced from a channel // PostMessage, wrapped in an AgentControl and relayed via the runner control // seam (DispatchControl) — the same path DeliverControl rides, carrying the // same single first-party Message (DL-073; no seq, the id is in the Message). // The generic SDK-AgentMessage steer (Runner-originated, outside any channel) -// stays parked under SEA-1310. +// stays parked under RIG-1310. type SteerControl struct { state protoimpl.MessageState `protogen:"open.v1"` // The mention message to steer into the session. @@ -737,7 +737,7 @@ func (x *SteerControl) GetFromHandle() string { return "" } -// Empty shells — payload fields parked (SEA-1310). Present so the AgentControl +// Empty shells — payload fields parked (RIG-1310). Present so the AgentControl // oneof is complete on the wire; populated by a stacked PR. // // TranscriptReplay carries an inbound SDK AgentMessage; @@ -815,9 +815,9 @@ func (*ConfigControl) Descriptor() ([]byte, []int) { } // DeliverControl carries a comms Message to deliver into the agent's live -// session (SEA-1569): the Server wraps it in an AgentControl and relays it via +// session (RIG-1569): the Server wraps it in an AgentControl and relays it via // the runner control seam (DispatchControl); the Runner writes it down the -// per-container socket. Populated from the SEA-1310 parked shell. +// per-container socket. Populated from the RIG-1310 parked shell. type DeliverControl struct { state protoimpl.MessageState `protogen:"open.v1"` // The message to deliver into the session. @@ -891,7 +891,7 @@ func (x *DeliverControl) GetFromHandle() string { return "" } -// DeliveryAck — the agent's per-message delivery receipt (SEA-1569), an +// DeliveryAck — the agent's per-message delivery receipt (RIG-1569), an // AgentFrame oneof variant riding the Publish spine. Correlates to the // delivered message by id; on receipt the Server advances the delivery cursor // (the success receipt for a delivery, per RT-3 — not a Runner result). diff --git a/go/internal/gen/compass/v1/agent_gateway.pb.go b/go/internal/gen/compass/v1/agent_gateway.pb.go index 5db47a28d..2b03b1c11 100644 --- a/go/internal/gen/compass/v1/agent_gateway.pb.go +++ b/go/internal/gen/compass/v1/agent_gateway.pb.go @@ -1,5 +1,5 @@ // The compass.v1 agent->Runner call transport (design -// docs/designs/product/compass-agent-runner-transport/design.md, SEA-1351 T1). +// docs/designs/product/compass-agent-runner-transport/design.md, RIG-1351 T1). // // INTERNAL-ONLY surface. Unlike compass.proto / comms.proto — the public, // generated-client door between a UI and the Server — AgentGateway is the @@ -2801,7 +2801,7 @@ type PostConversationFrameRequest struct { Frame *AgentFrame `protobuf:"bytes,1,opt,name=frame,proto3" json:"frame,omitempty"` // Agent-minted, stable across retries of the same logical frame; the Runner // commits at-most-once per key so a lost-response retry is not duplicated. An - // ENVELOPE field (dedup), not a payload field — SEA-1310's parked payload + // ENVELOPE field (dedup), not a payload field — RIG-1310's parked payload // decision is untouched. IdempotencyKey string `protobuf:"bytes,2,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"` unknownFields protoimpl.UnknownFields diff --git a/go/internal/gen/compass/v1/compassv1internalconnect/agent_gateway.connect.go b/go/internal/gen/compass/v1/compassv1internalconnect/agent_gateway.connect.go index 32b0c3cda..012a0c894 100644 --- a/go/internal/gen/compass/v1/compassv1internalconnect/agent_gateway.connect.go +++ b/go/internal/gen/compass/v1/compassv1internalconnect/agent_gateway.connect.go @@ -1,5 +1,5 @@ // The compass.v1 agent->Runner call transport (design -// docs/designs/product/compass-agent-runner-transport/design.md, SEA-1351 T1). +// docs/designs/product/compass-agent-runner-transport/design.md, RIG-1351 T1). // // INTERNAL-ONLY surface. Unlike compass.proto / comms.proto — the public, // generated-client door between a UI and the Server — AgentGateway is the diff --git a/go/internal/gen/compass/v1/compassv1internalconnect/guest_control.connect.go b/go/internal/gen/compass/v1/compassv1internalconnect/guest_control.connect.go index dcaf02f19..32a0f35b4 100644 --- a/go/internal/gen/compass/v1/compassv1internalconnect/guest_control.connect.go +++ b/go/internal/gen/compass/v1/compassv1internalconnect/guest_control.connect.go @@ -13,7 +13,7 @@ // It is generated ONLY into the internal Go lane (guestd's handler + the host's // client via buf.gen.internal-go.yaml -> go/internal/gen), never onto the // public @compass/client surface or any TS lane — a host<->guest control plane -// is not a server-door client, so the SEA-1267 gen-fence intent holds. The +// is not a server-door client, so the RIG-1267 gen-fence intent holds. The // public buf.gen.yaml excludes this file; buf.gen.agent-ts.yaml (an allowlist) // simply never lists it. // diff --git a/go/internal/gen/compass/v1/compassv1internalconnect/runner.connect.go b/go/internal/gen/compass/v1/compassv1internalconnect/runner.connect.go index a2e80996f..a7354dc6e 100644 --- a/go/internal/gen/compass/v1/compassv1internalconnect/runner.connect.go +++ b/go/internal/gen/compass/v1/compassv1internalconnect/runner.connect.go @@ -197,7 +197,7 @@ type RunnerServiceClient interface { // Server gains no inbound route), same justification as RelayCommsCall. CommitConversationFrame(context.Context, *connect.Request[v1.CommitConversationFrameRequest]) (*connect.Response[v1.CommitConversationFrameResponse], error) // FetchSecrets (unary, Runner->Server): the Runner fetches the full resolved - // secret set for one session to materialize into the agent container (SEA-1327 + // secret set for one session to materialize into the agent container (RIG-1327 // T4). Inject-all: no name filter, no per-agent grants (the filter is the // named future per-agent-scoping seam). The response is no-log: a logging // interceptor must never dump resolved values. Additive to the frozen dial-out @@ -205,7 +205,7 @@ type RunnerServiceClient interface { FetchSecrets(context.Context, *connect.Request[v1.FetchSecretsRequest]) (*connect.Response[v1.FetchSecretsResponse], error) // FetchAgentConfig (server-streaming, Runner->Server): the Runner fetches the // fleet config bundle to materialize into the agent container at provision - // (SEA-1568 T3/T4). Server-streaming so the bundle is never bounded by the + // (RIG-1568 T3/T4). Server-streaming so the bundle is never bounded by the // connect/gRPC unary recv cap: the first response frame carries the version, // subsequent frames carry the tarball bytes in chunks. The security caps // (decompressed size, file count) live at unpack (T1's door, re-enforced at @@ -466,7 +466,7 @@ type RunnerServiceHandler interface { // Server gains no inbound route), same justification as RelayCommsCall. CommitConversationFrame(context.Context, *connect.Request[v1.CommitConversationFrameRequest]) (*connect.Response[v1.CommitConversationFrameResponse], error) // FetchSecrets (unary, Runner->Server): the Runner fetches the full resolved - // secret set for one session to materialize into the agent container (SEA-1327 + // secret set for one session to materialize into the agent container (RIG-1327 // T4). Inject-all: no name filter, no per-agent grants (the filter is the // named future per-agent-scoping seam). The response is no-log: a logging // interceptor must never dump resolved values. Additive to the frozen dial-out @@ -474,7 +474,7 @@ type RunnerServiceHandler interface { FetchSecrets(context.Context, *connect.Request[v1.FetchSecretsRequest]) (*connect.Response[v1.FetchSecretsResponse], error) // FetchAgentConfig (server-streaming, Runner->Server): the Runner fetches the // fleet config bundle to materialize into the agent container at provision - // (SEA-1568 T3/T4). Server-streaming so the bundle is never bounded by the + // (RIG-1568 T3/T4). Server-streaming so the bundle is never bounded by the // connect/gRPC unary recv cap: the first response frame carries the version, // subsequent frames carry the tarball bytes in chunks. The security caps // (decompressed size, file count) live at unpack (T1's door, re-enforced at diff --git a/go/internal/gen/compass/v1/forge.pb.go b/go/internal/gen/compass/v1/forge.pb.go index ac9d6cb65..89d3d330f 100644 --- a/go/internal/gen/compass/v1/forge.pb.go +++ b/go/internal/gen/compass/v1/forge.pb.go @@ -1,4 +1,4 @@ -// The compass.v1 forge notification + shared carrier leaf (SEA-1731 A1, design +// The compass.v1 forge notification + shared carrier leaf (RIG-1731 A1, design // docs/designs/product/compass-server-ownership-layer-amendment/design.md §A1). // // INTERNAL-ONLY surface. Like agent.proto / agent_gateway.proto / runner.proto, diff --git a/go/internal/gen/compass/v1/guest_control.pb.go b/go/internal/gen/compass/v1/guest_control.pb.go index 2d6bbf54c..f773eb6f8 100644 --- a/go/internal/gen/compass/v1/guest_control.pb.go +++ b/go/internal/gen/compass/v1/guest_control.pb.go @@ -13,7 +13,7 @@ // It is generated ONLY into the internal Go lane (guestd's handler + the host's // client via buf.gen.internal-go.yaml -> go/internal/gen), never onto the // public @compass/client surface or any TS lane — a host<->guest control plane -// is not a server-door client, so the SEA-1267 gen-fence intent holds. The +// is not a server-door client, so the RIG-1267 gen-fence intent holds. The // public buf.gen.yaml excludes this file; buf.gen.agent-ts.yaml (an allowlist) // simply never lists it. // diff --git a/go/internal/gen/compass/v1/runner.pb.go b/go/internal/gen/compass/v1/runner.pb.go index f3ae0ac69..f3569fdd7 100644 --- a/go/internal/gen/compass/v1/runner.pb.go +++ b/go/internal/gen/compass/v1/runner.pb.go @@ -63,7 +63,7 @@ const ( // Connect Internal. RunnerErrorCode_RUNNER_ERROR_CODE_INTERNAL RunnerErrorCode = 3 // A delivery (deliver_control) was refused because the session's retention - // buffer is full (SEA-1569) -> Connect ResourceExhausted. Distinguishes a + // buffer is full (RIG-1569) -> Connect ResourceExhausted. Distinguishes a // retention-full refusal in-band so the Server can leave the delivery cursor // unadvanced and redeliver. RunnerErrorCode_RUNNER_ERROR_CODE_RESOURCE_EXHAUSTED RunnerErrorCode = 4 @@ -422,7 +422,7 @@ type SessionsResponse struct { // *SessionsResponse_Remove Command isSessionsResponse_Command `protobuf_oneof:"command"` // resume_body — the INTERNAL resume-body carrier, a TOP-LEVEL sibling of - // request_id OUTSIDE the command oneof (SEA-1570): the Server attaches it on + // request_id OUTSIDE the command oneof (RIG-1570): the Server attaches it on // an authorized resume start beside the verbatim public `start` request, // which itself carries only the authz-checked resume_session_id (no locator, // = 8 and deliver_control = 11, and 12 is skipped (the design-abandoned @@ -618,7 +618,7 @@ type SessionsResponse_SecretsVersion struct { type SessionsResponse_ConfigVersion struct { // config_version (tag 9): the Server signals the fleet that the config // bundle changed; the Runner re-fetches via FetchAgentConfig, re-materializes - // the new version dir, and Reloads live agents in place (SEA-1568 T3/T6). + // the new version dir, and Reloads live agents in place (RIG-1568 T3/T6). // Fleet-wide, no per-account key. Signal-only — never carries bytes, and, // like secrets_version, is NOT request_id-correlated and has NO // SessionsRequest result variant: it is a notification, not a command, so the @@ -628,7 +628,7 @@ type SessionsResponse_ConfigVersion struct { type SessionsResponse_DeliverControl struct { // deliver_control (tag 11; 8 secrets_version / 9 config_version / 10 remove / - // 11 deliver_control landed): the Server relays a control op — for SEA-1569, a message + // 11 deliver_control landed): the Server relays a control op — for RIG-1569, a message // delivery — down to the Runner, which writes it to the session's // per-container socket. Carries the op as payload (DispatchControl). No // SUCCESS result variant: the delivery receipt rides AgentFrame.delivery_ack @@ -668,7 +668,7 @@ func (*SessionsResponse_DeliverControl) isSessionsResponse_Command() {} func (*SessionsResponse_Remove) isSessionsResponse_Command() {} // ResumeBody — the INTERNAL resume-body carrier attached to SessionsResponse on -// an authorized resume (SEA-1570). Additive, INTERNAL-ONLY: rides the +// an authorized resume (RIG-1570). Additive, INTERNAL-ONLY: rides the // path-filtered internal gen lane, never the public client surface. The Server // attaches it; no client can supply it, and the public `start` request is // relayed verbatim (T6). @@ -719,7 +719,7 @@ func (x *ResumeBody) GetSessionBody() string { } // DispatchControl — the Server->Runner relay envelope for a control op -// (SEA-1569). Carries the full AgentControl op (for a delivery, +// (RIG-1569). Carries the full AgentControl op (for a delivery, // AgentControl{ deliver: DeliverControl{ message } }); the Runner relays op // down the addressed session's per-container socket. Payload-carrying, not // signal-only. @@ -780,7 +780,7 @@ func (x *DispatchControl) GetOp() *AgentControl { // FetchSecrets request: which agent's secret set to resolve. Inject-all — no // name filter. The caller sets exactly one selector: a `container_name` for the // PROVISION-time initial materialize (the container→account binding exists from -// Provision, before any session is minted — SEA-1327 T5 materializes before the +// Provision, before any session is minted — RIG-1327 T5 materializes before the // agent is exec'd), or a `session_id` for the post-Start rotation re-fetch (the // SecretsVersion signal path, T6). The two are mutually exclusive by convention, // not a oneof: session_id kept tag 1 with its original flat cardinality so the @@ -1861,7 +1861,7 @@ func (x *RelayBoardCallResponse) GetResult() *BoardCallResult { // (resolved to an account Server-side, fail-closed — see the RPC comment). // `frame` is constrained by the agent side to a conversation_posted / // conversation_updated / transcript_entry AgentFrame variant (the durable lane -// carries the SEA-1570 transcript entry too; the same C4 constraint Publish +// carries the RIG-1570 transcript entry too; the same C4 constraint Publish // telemetry frames are held to). `idempotency_key` is the agent-minted envelope // key reused verbatim from AgentGateway.PostConversationFrameRequest. type CommitConversationFrameRequest struct { diff --git a/go/internal/presence/activity_test.go b/go/internal/presence/activity_test.go index f014603a2..341b4c736 100644 --- a/go/internal/presence/activity_test.go +++ b/go/internal/presence/activity_test.go @@ -2,7 +2,7 @@ package presence -// PresenceFor + PublishActivity (SEA-1721 T2), driven through the publisher's +// PresenceFor + PublishActivity (RIG-1721 T2), driven through the publisher's // real bus + fakes: the enum snapshot projects the last-published subset, and // PublishActivity emits an AgentPresenceChanged carrying the CURRENT presence // plus the activity string on the AgentPresenceChanged.activity field. diff --git a/go/internal/presence/presence.go b/go/internal/presence/presence.go index 6aab0a023..656ad2c40 100644 --- a/go/internal/presence/presence.go +++ b/go/internal/presence/presence.go @@ -1,6 +1,6 @@ //go:build unix -// Package presence is the Server-side agent-presence projection (SEA-1569 T8, +// Package presence is the Server-side agent-presence projection (RIG-1569 T8, // design record D4). It publishes an AgentPresenceChanged onto the comms fan-out // bus whenever a live agent's presence changes, where presence is a 4-state // projection (WORKING / IDLE / WAITING / OFFLINE) of TWO sources: the agent diff --git a/go/internal/presence/presence_test.go b/go/internal/presence/presence_test.go index 76c88d11a..57352bdef 100644 --- a/go/internal/presence/presence_test.go +++ b/go/internal/presence/presence_test.go @@ -2,7 +2,7 @@ package presence -// The presence projection's acceptance cases (SEA-1569 T8, design record D4, +// The presence projection's acceptance cases (RIG-1569 T8, design record D4, // design.md:880-890), RED-first. Each drives the publisher through the real // events bus + hand-written fakes and gates on the recorder's observed // AgentPresenceChanged publishes — never a sleep, never a retry diff --git a/go/internal/runner/agent_exec.go b/go/internal/runner/agent_exec.go index e0e5bdfa4..beec2ba09 100644 --- a/go/internal/runner/agent_exec.go +++ b/go/internal/runner/agent_exec.go @@ -70,7 +70,7 @@ type AgentEnv struct { // execSpec builds the streaming exec that starts the agent: unprivileged, in // the checkout, carrying exactly the vars the agent reads. Env-delivery secrets // are NOT passed on this exec: the Runner's materializer writes them to the -// 0600 in-container $HOME/.compass/env (SEA-1327 T5), and the agent sources that +// 0600 in-container $HOME/.compass/env (RIG-1327 T5), and the agent sources that // file from its own namespace at startup. They are deliberately not `-e // KEY=VALUE` here (host-process-list visible) nor `--env-file` (podman resolves // that path host-side, where the container-internal file does not exist). diff --git a/go/internal/runner/config_fetch.go b/go/internal/runner/config_fetch.go index 9142ae7ad..9250ade37 100644 --- a/go/internal/runner/config_fetch.go +++ b/go/internal/runner/config_fetch.go @@ -4,7 +4,7 @@ // Server over the RunnerService connection and reassemble the server-streamed // frames into one in-memory bundle. The first frame carries the version; every // subsequent frame carries a tarball byte chunk, so a bundle larger than the -// connect/gRPC unary recv cap still rides the wire (SEA-1568 T3). The bundle +// connect/gRPC unary recv cap still rides the wire (RIG-1568 T3). The bundle // bytes ride in memory only; the security caps (decompressed size, file count) // are enforced downstream at unpack (T4's ConfigMaterializer), never here. package runner diff --git a/go/internal/runner/config_materialize.go b/go/internal/runner/config_materialize.go index cee0bf852..3fec6d71f 100644 --- a/go/internal/runner/config_materialize.go +++ b/go/internal/runner/config_materialize.go @@ -77,7 +77,7 @@ var configTopDirs = map[string]struct{}{ topDirAgents: {}, } -// Top-level regular-file members admitted by exact filename (SEA-1678 T2), and +// Top-level regular-file members admitted by exact filename (RIG-1678 T2), and // the one file admitted under settings/ (yml-only, OQ-1). Any other top-level // file or settings variant stays rejected — the structural twin of the store // door (the credential denylist is store-door-only, never mirrored here). diff --git a/go/internal/runner/config_materialize_test.go b/go/internal/runner/config_materialize_test.go index 9eabe3b33..d3c6ddd7a 100644 --- a/go/internal/runner/config_materialize_test.go +++ b/go/internal/runner/config_materialize_test.go @@ -115,7 +115,7 @@ func validBundle() map[string][]byte { } } -// fullBundle is validBundle plus all five SEA-1678 config categories +// fullBundle is validBundle plus all five RIG-1678 config categories // (settings/config.yml, top-level AGENTS.md + models.yml, a flat rules/ member, // and a flat agents/ member), so a provision/refresh fixture can prove the // update path carries every delivered category end-to-end — not just the @@ -614,7 +614,7 @@ func TestConfigMaterializeProvisionPathDoesNotRelabel(t *testing.T) { // yamlMap is a minimal valid YAML-mapping body for a settings/models member. var yamlMap = []byte("compaction:\n enabled: true\n") -// TestConfigMaterializeLandsNewMembers pins the SEA-1678 T2 unpack of all five +// TestConfigMaterializeLandsNewMembers pins the RIG-1678 T2 unpack of all five // new members: settings/config.yml, top-level AGENTS.md + models.yml, flat // rules/*.md|.mdc, and flat agents/*.md all land under // with // pinned modes (0644 files, 0755 dirs). diff --git a/go/internal/runner/config_refresh_test.go b/go/internal/runner/config_refresh_test.go index 1f9485ab3..613a08658 100644 --- a/go/internal/runner/config_refresh_test.go +++ b/go/internal/runner/config_refresh_test.go @@ -149,7 +149,7 @@ func configBundleAt(t *testing.T, version string) AgentConfigBundle { } // configBundleFrom builds an AgentConfigBundle at version from arbitrary members, -// so a fan-out test can carry the five new SEA-1678 categories (fullBundle) or a +// so a fan-out test can carry the five new RIG-1678 categories (fullBundle) or a // partial/tolerant-empty subset and, on a version bump, a CHANGED member. func configBundleFrom(t *testing.T, version string, entries map[string][]byte) AgentConfigBundle { t.Helper() @@ -403,7 +403,7 @@ func TestRefreshConfigRootPathContainsContainerName(t *testing.T) { } } -// SEA-1678 T6 — the fan-out update path carries all FIVE new config categories. +// RIG-1678 T6 — the fan-out update path carries all FIVE new config categories. // // At provision a fullBundle (settings/config.yml + top-level AGENTS.md + // models.yml + a flat rules/ member + a flat agents/ member, atop the diff --git a/go/internal/runner/dispatch.go b/go/internal/runner/dispatch.go index 53c7c827b..2c321ab3e 100644 --- a/go/internal/runner/dispatch.go +++ b/go/internal/runner/dispatch.go @@ -98,7 +98,7 @@ type dispatcher struct { // pendingCall (runnerhub/router.go). Single-Runner MVP: the set is small and // lives for the stream's life — it is not evicted. Bounded eviction (plus the // per-container transition lock this change already lands) is the remaining - // T9 work (SEA-1328); see docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md. + // T9 work (RIG-1328); see docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md. handled map[string]*inflightResult // configSignal coalesces ConfigVersion signals into a single pending diff --git a/go/internal/runner/e2e_transport_test.go b/go/internal/runner/e2e_transport_test.go index 020046803..e30b3180f 100644 --- a/go/internal/runner/e2e_transport_test.go +++ b/go/internal/runner/e2e_transport_test.go @@ -2,7 +2,7 @@ package runner -// T5 Half-A end-to-end proof (SEA-1351): the Runner-side agent->Runner call +// T5 Half-A end-to-end proof (RIG-1351): the Runner-side agent->Runner call // transport, exercised through the REAL integrated stack rather than the T2 // gateway/socket unit fakes. Every test dials the actual per-container Unix // socket that Provision served, over a real h2c Connect AgentGatewayClient, and @@ -352,7 +352,7 @@ func TestFreshStartSendsReplayCompleteFirst(t *testing.T) { // TestResumeStartSendsReplayCompleteFirst — a resume Start (non-empty // resume_session_id) lifts the agent's replay barrier by sending replay_complete // as the FIRST control op, exactly like a fresh start. A file-based resume -// (SEA-1570) loads its transcript synchronously (COMPASS_RESUME_SESSION_FILE) +// (RIG-1570) loads its transcript synchronously (COMPASS_RESUME_SESSION_FILE) // before the agent subscribes to the control stream, so replay_complete arriving // on that stream is the correct "replay done, live ops may flow" signal; without // it every channel-driven turn on a resumed agent is refused by the closed diff --git a/go/internal/runner/gateway/control_test.go b/go/internal/runner/gateway/control_test.go index 0b46ae77f..e07ddd22e 100644 --- a/go/internal/runner/gateway/control_test.go +++ b/go/internal/runner/gateway/control_test.go @@ -308,7 +308,7 @@ func TestControlSendsDeliver(t *testing.T) { } // TestControlSendsSteer pins the un-parking: a SteerControl op carries a defined -// compass.v1.Message (SEA-1569/DL-073, the same shape DeliverControl rides), so +// compass.v1.Message (RIG-1569/DL-073, the same shape DeliverControl rides), so // it is representable and Send stamps, retains and drains it to the // subscription — it must NOT be rejected as an empty variant. This is the // regression guard for the gap the leg-3/4 real-stack e2e surfaced: steerOp @@ -1499,7 +1499,7 @@ func TestControlAckJumpDropsStrandedSeqs(t *testing.T) { } // TestControlServeRefusesRetiredSessionInResolveWindow covers the -// serve()-vs-Retire() TOCTOU (SEA-1550): serve resolves the session under p.mu +// serve()-vs-Retire() TOCTOU (RIG-1550): serve resolves the session under p.mu // and releases it, then takes s.mu ~13 lines later to bind. A full Retire that // lands in that window deletes the session, marks it dead, and closes its wake. // Without a re-check, serve then binds the DETACHED session: its own s.sub++ @@ -1533,7 +1533,7 @@ func TestControlServeRefusesRetiredSessionInResolveWindow(t *testing.T) { t.Fatalf("serve on a session retired in the resolve window = %v (code %v), want CodeNotFound: a session torn down before the bind must be refused, not bound", err, connect.CodeOf(err)) } case <-time.After(2 * time.Second): - t.Fatal("serve did not return within 2s: it bound a session Retire had already detached and parked on a wake nothing will ever close — the stranded drainer SEA-1550 describes") + t.Fatal("serve did not return within 2s: it bound a session Retire had already detached and parked on a wake nothing will ever close — the stranded drainer RIG-1550 describes") } // No detached session may survive the retirement: binding on the torn-down diff --git a/go/internal/runner/gateway/gateway_test.go b/go/internal/runner/gateway/gateway_test.go index ae76e54a5..45b26dc9e 100644 --- a/go/internal/runner/gateway/gateway_test.go +++ b/go/internal/runner/gateway/gateway_test.go @@ -3,7 +3,7 @@ package gateway // Hermetic suite for the Runner->Server forward handler Gateway.Comms (transport -// design T3, SEA-1351). White-box (package gateway) so it drives the handler and +// design T3, RIG-1351). White-box (package gateway) so it drives the handler and // its two seams directly, sleep-free: the fakes record every fact synchronously, // so every assertion reads a value the in-memory call already produced. // diff --git a/go/internal/runner/gateway/post_conversation_frame.go b/go/internal/runner/gateway/post_conversation_frame.go index 8b486e124..2d1084a21 100644 --- a/go/internal/runner/gateway/post_conversation_frame.go +++ b/go/internal/runner/gateway/post_conversation_frame.go @@ -4,7 +4,7 @@ package gateway // post_conversation_frame.go is the durable-frame ingest: the delivered-or- // erred handler that carries a conversation_posted / conversation_updated frame -// (and the SEA-1570 transcript_entry tee variant) off the lossy Publish spine +// (and the RIG-1570 transcript_entry tee variant) off the lossy Publish spine // (transport-consolidation record OQ-2(c), P1 #1). // It commits the frame request/response via the dedicated // RunnerService.CommitConversationFrame unary — the durable counterpart to the @@ -37,7 +37,7 @@ import ( // leaves that spine entirely and commits request/response, so a Server-side loss // is a Connect error the agent retries, never a silent gapless drop. It rejects // a frame the durable unary does not carry with CodeInvalidArgument (the lane -// carries conversation_posted / conversation_updated and the SEA-1570 +// carries conversation_posted / conversation_updated and the RIG-1570 // transcript_entry tee variant), and fails closed // CodePermissionDenied when no session is bound. Dedups on idempotency_key: a // key already committed in this process returns success without re-committing @@ -92,7 +92,7 @@ func (g *Gateway) PostConversationFrame( } // isConversationFrame reports whether frame is the durable transcript frame the -// CommitConversationFrame unary carries: the SEA-1570 transcript_entry variant. +// CommitConversationFrame unary carries: the RIG-1570 transcript_entry variant. // A conversation frame, a session frame, an ack, or an unset oneof is rejected. // (The conversation_posted / conversation_updated write-through was removed with // the Zulip threading model; only the transcript lane survives.) diff --git a/go/internal/runner/gateway/socket.go b/go/internal/runner/gateway/socket.go index 5a6ae7334..58a0c726b 100644 --- a/go/internal/runner/gateway/socket.go +++ b/go/internal/runner/gateway/socket.go @@ -3,7 +3,7 @@ // Package gateway is the Runner side of the agent->Runner call transport: a // per-container Unix-socket Connect server the in-container first-party agent // dials to reach its Runner (design -// docs/designs/product/compass-agent-runner-transport/design.md, SEA-1351 T2). +// docs/designs/product/compass-agent-runner-transport/design.md, RIG-1351 T2). // // One socket per container, 1:1 with the session the container hosts, so the // socket IS that session's identity: no credential travels the local hop, and diff --git a/go/internal/runner/gateway/socket_podman_test.go b/go/internal/runner/gateway/socket_podman_test.go index 5a902e55b..942508ff9 100644 --- a/go/internal/runner/gateway/socket_podman_test.go +++ b/go/internal/runner/gateway/socket_podman_test.go @@ -3,7 +3,7 @@ package gateway // Integration skeleton for the socket's uid-map + :Z-relabel invariant -// (SEA-1351 T2, design docs/designs/product/compass-agent-runner-transport/ +// (RIG-1351 T2, design docs/designs/product/compass-agent-runner-transport/ // design.md:397-400): the host socket, bind-mounted via SocketListener.Mount and // relabelled :Z by the runtime, must be OWNED by the mapped agent uid in-container // and connect()-able from inside AFTER the relabel. This extends the diff --git a/go/internal/runner/gateway/socket_test.go b/go/internal/runner/gateway/socket_test.go index cb04ec22f..133314173 100644 --- a/go/internal/runner/gateway/socket_test.go +++ b/go/internal/runner/gateway/socket_test.go @@ -3,7 +3,7 @@ package gateway // Hermetic suite for the Runner-side per-container agent socket listener -// (SEA-1351 T2). White-box (package gateway) so it can drive the unexported +// (RIG-1351 T2). White-box (package gateway) so it can drive the unexported // listenAgentSocket / reclaimStaleSocket and the runnerUID seam directly. // // The listener is a security boundary: the socket lives in an owner-only dir at diff --git a/go/internal/runner/gateway/telemetry_ingest_test.go b/go/internal/runner/gateway/telemetry_ingest_test.go index 500d256fe..a23410aaf 100644 --- a/go/internal/runner/gateway/telemetry_ingest_test.go +++ b/go/internal/runner/gateway/telemetry_ingest_test.go @@ -185,7 +185,7 @@ func durableFrame(text string) *compassv1internal.AgentFrame { } // transcriptEntryFrame builds a durable transcript_entry AgentFrame — the -// SEA-1570 tee variant PostConversationFrame carries beside the conversation +// RIG-1570 tee variant PostConversationFrame carries beside the conversation // frames. func transcriptEntryFrame(entryJSON string, checkpoint bool, seq uint64) *compassv1internal.AgentFrame { return &compassv1internal.AgentFrame{ @@ -384,7 +384,7 @@ func TestPublishOrdersThreeTraceFrames(t *testing.T) { // --- Case 2 ------------------------------------------------------------------ -// A transcript_entry frame (the SEA-1570 tee variant) rides the same durable +// A transcript_entry frame (the RIG-1570 tee variant) rides the same durable // unary as the conversation frames: it must reach the committer byte-identical // under the request's session and idempotency key. Guards T7's guard widening. // RED before the isConversationFrame widening: transcript_entry is rejected @@ -839,7 +839,7 @@ func TestPostConversationFrameEmptyKeyNeverDedups(t *testing.T) { } // A non-transcript frame fails closed CodeInvalidArgument BEFORE the commit RPC -// — post-T7 the durable unary carries only the SEA-1570 transcript_entry variant, +// — post-T7 the durable unary carries only the RIG-1570 transcript_entry variant, // so a trace/session frame, an empty AgentFrame with an unset oneof, and a nil // frame must each be rejected without ever reaching the committer. // RED: drop the isConversationFrame guard -> a non-conversation frame reaches the diff --git a/go/internal/runner/host.go b/go/internal/runner/host.go index 73772baf0..c5b514aad 100644 --- a/go/internal/runner/host.go +++ b/go/internal/runner/host.go @@ -74,7 +74,7 @@ type agentHost struct { // only after the agent's Reload succeeds — so a swallowed Reload failure // leaves it unmoved and the next signal retries that container. // Keyed by container, not session: config lifecycle is container-scoped - // (SEA-1659 per-container roots), and it must survive a Reload (which reuses + // (RIG-1659 per-container roots), and it must survive a Reload (which reuses // the session but keeps the container). configVersions map[string]string // containerLocks serializes the state-transitioning lifecycle ops per @@ -86,7 +86,7 @@ type agentHost struct { // could race a concurrent op that already resolved the same *sync.Mutex, so // retaining it is what makes the resolve-then-lock protocol safe. Growth is // bounded by distinct container names ever provisioned — the same retention - // class as handled/configVersions, and T9's bounded-eviction (SEA-1328) + // class as handled/configVersions, and T9's bounded-eviction (RIG-1328) // covers them together. Status deliberately does NOT lock (it answers from // the session set under h.mu), so it never queues behind a slow Provision. // See docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md. @@ -153,7 +153,7 @@ func NewSessionHost(link *ServerLink, rt *runtime.AgentRuntime, registry *runtim // per-container agent socket (before `podman run`, so the bind-mount source is // live), mounts it into the spec, and launches the isolated container through // the AgentRuntime façade, returning its stable container name. The socket is -// the agent->Runner call transport (design SEA-1351 T5): it is served from +// the agent->Runner call transport (design RIG-1351 T5): it is served from // Provision so a call arriving before Start binds a session fails closed rather // than finding no listener. Launch registers the handle so a later Start // resolves it by name. The dispatcher's request-id dedup makes a provision retry @@ -291,7 +291,7 @@ func (h *agentHost) Start(ctx context.Context, req *compassv1.StartAgentSessionR // The per-container transition lock closes it: the second Start blocks here // until the first records its session, then sees it and returns // errAlreadyRunning. Concurrent dispatch (per-command goroutines) made this - // reachable; T9's in-process reattach (SEA-1328) consumes the same lock — do + // reachable; T9's in-process reattach (RIG-1328) consumes the same lock — do // not reintroduce it. See docs/designs/infra/runtime/compass-runner-concurrent-dispatch/design.md. unlock := h.lockContainer(name) defer unlock() @@ -335,7 +335,7 @@ func (h *agentHost) Start(ctx context.Context, req *compassv1.StartAgentSessionR // Materialize the agent's secrets into the container BEFORE exec'ing the // agent, so its first provider/gh/env read never races an empty seed - // (SEA-1327 T5: materialize before the agent runs). The fetch authorizes on + // (RIG-1327 T5: materialize before the agent runs). The fetch authorizes on // the container→account binding the Server recorded at Provision — not the // session, which is only being minted now — so it is FetchSecretsByContainer, // keyed on the container name. The frozen record placed this in the @@ -371,7 +371,7 @@ func (h *agentHost) Start(ctx context.Context, req *compassv1.StartAgentSessionR // On an authorized resume, materialize the server-reconstructed session // file into the container BEFORE exec'ing the agent, so the agent's first - // read finds it (SEA-1570 T8). The absolute in-container path is exported to + // read finds it (RIG-1570 T8). The absolute in-container path is exported to // the agent as COMPASS_RESUME_SESSION_FILE. A fresh (non-resume) start does // nothing here. The discriminator is a non-empty resume_session_id. env := h.agentEnv(handle) @@ -443,7 +443,7 @@ func (h *agentHost) Start(ctx context.Context, req *compassv1.StartAgentSessionR // Lift the agent's replay barrier so the first idle-deliver that starts the // agent's turn is dispatched rather than refused: the barrier defaults closed // and only the arrival of replay_complete lifts it. Sent on EVERY served - // start, fresh AND file-based resume. A file-based resume (SEA-1570) loads + // start, fresh AND file-based resume. A file-based resume (RIG-1570) loads // its transcript synchronously from COMPASS_RESUME_SESSION_FILE // (cli.ts setSessionFile) BEFORE the agent subscribes to the control stream // and runs, so replay_complete arriving on that stream is always processed diff --git a/go/internal/runner/host_test.go b/go/internal/runner/host_test.go index bc749275e..f50d13e8c 100644 --- a/go/internal/runner/host_test.go +++ b/go/internal/runner/host_test.go @@ -293,7 +293,7 @@ func (b *seqSpecBuilder) BuildSpec(*compassv1.ProvisionAgentWorkspaceRequest) (r // Two containers provisioned on ONE host must each get their OWN config root at // /containers//config — never a shared tree. A shared root is -// the SEA-1659 bug: every bind mount is :Z-relabeled into the container's +// the RIG-1659 bug: every bind mount is :Z-relabeled into the container's // private SELinux MCS category, so a second container provisioning against a // shared root re-steals it from the first. This test reddens against the // pre-reshape shared-root code (both mounts resolve to the same @@ -558,7 +558,7 @@ func TestRemoveClosesSocketWhenTeardownFails(t *testing.T) { } } -// SEA-1635: a Teardown that fails partway (engine Stop errors) must leave the +// RIG-1635: a Teardown that fails partway (engine Stop errors) must leave the // container's registry handle RESOLVABLE, so a Remove retry re-runs Teardown // rather than answering a lying success over a leaked container. This pins the // deregister-LAST ordering: AgentRuntime.Teardown deregisters only after Stop diff --git a/go/internal/runner/run_test.go b/go/internal/runner/run_test.go index 649369a18..6578ad605 100644 --- a/go/internal/runner/run_test.go +++ b/go/internal/runner/run_test.go @@ -3,7 +3,7 @@ package runner // Startup validation of the Runner's runtime dir against the AF_UNIX sun_path -// budget (SEA-1443): a misconfigured deployment must refuse to boot with a +// budget (RIG-1443): a misconfigured deployment must refuse to boot with a // legible message instead of failing at the first provision with a bare EINVAL. import ( diff --git a/go/internal/runnerhub/commands.go b/go/internal/runnerhub/commands.go index e37769b31..276d3c3db 100644 --- a/go/internal/runnerhub/commands.go +++ b/go/internal/runnerhub/commands.go @@ -150,7 +150,7 @@ func (h *Hub) Status(ctx context.Context, requestID string, req *compassv1.GetAg } // SessionState resolves a live session's lifecycle state through the Runner -// Status relay (GetAgentStatus) — the reconciliation input the SEA-1569 T8 +// Status relay (GetAgentStatus) — the reconciliation input the RIG-1569 T8 // presence projection rebuilds from at a session promotion (design.md:494-503). // The Runner is authoritative for live session truth, so a restart reconstructs // presence from its answer rather than from any lost in-memory state. ok is diff --git a/go/internal/runnerhub/commands_test.go b/go/internal/runnerhub/commands_test.go index 970be1f7b..e380bdc9b 100644 --- a/go/internal/runnerhub/commands_test.go +++ b/go/internal/runnerhub/commands_test.go @@ -266,7 +266,7 @@ func attachStatusResponder(t *testing.T, hub *Hub, statuses []*compassv1.AgentSe }) } -// L2 (SEA-1569 T8 review): SessionState adopts the SOLE status as this session's +// L2 (RIG-1569 T8 review): SessionState adopts the SOLE status as this session's // state only when that status carries NO session id (the "Runner answered without // echoing the id" case). A sole status echoing an EMPTY id resolves ok=true. func TestSessionStateSoleStatusEmptyIDResolves(t *testing.T) { @@ -284,7 +284,7 @@ func TestSessionStateSoleStatusEmptyIDResolves(t *testing.T) { } } -// L2 (SEA-1569 T8 review): a sole status echoing a NON-EMPTY MISMATCHED id is NOT +// L2 (RIG-1569 T8 review): a sole status echoing a NON-EMPTY MISMATCHED id is NOT // this session's state — a Runner bug echoing a wrong id must not reconstruct a // wrong presence — so it is unresolved (ok=false → UNSPECIFIED). RED against // pre-fix: the pre-fix fallback adopted the sole status unconditionally, so this diff --git a/go/internal/runnerhub/commit_frame_test.go b/go/internal/runnerhub/commit_frame_test.go index 2a7dbe52b..41994c448 100644 --- a/go/internal/runnerhub/commit_frame_test.go +++ b/go/internal/runnerhub/commit_frame_test.go @@ -2,7 +2,7 @@ package runnerhub -// The durable transcript lane (#24 / OQ-3, SEA-1667 T4): Hub.CommitConversationFrame +// The durable transcript lane (#24 / OQ-3, RIG-1667 T4): Hub.CommitConversationFrame // resolves the relayed session to its bound agent account as the fail-closed // liveness gate (exactly as RelayCommsCall does), then writes the relayed // transcript_entry to the transcript store keyed at most once on the agent-minted diff --git a/go/internal/runnerhub/deliveryarm_test.go b/go/internal/runnerhub/deliveryarm_test.go index 3c8ff893d..b6a3235f5 100644 --- a/go/internal/runnerhub/deliveryarm_test.go +++ b/go/internal/runnerhub/deliveryarm_test.go @@ -2,7 +2,7 @@ package runnerhub -// The RunnerHub's SEA-1569 T3 arms: the send-only DispatchControl relay (§5, the +// The RunnerHub's RIG-1569 T3 arms: the send-only DispatchControl relay (§5, the // crux: a successful deliver must NOT block on a result), the delivery_ack cursor // arm (§6), and the settle-edge sink fired at deliverSession (§2). Each test pins // the observable contract a plausible regression would break, with a fake @@ -237,7 +237,7 @@ type promotedRecord struct { sessionID string } -// fakePresenceSink records the hub's presence-edge calls — the SEA-1569 T8 +// fakePresenceSink records the hub's presence-edge calls — the RIG-1569 T8 // lifecycle + reconciliation sink. Concurrency-safe for parity with the real // component, which is fed from the hub's goroutine. type fakePresenceSink struct { @@ -485,7 +485,7 @@ func TestDeliveryAckStoreFaultIsNonFatal(t *testing.T) { } } -// SEA-1569 T3 §6: an ack drop increments the dedicated DroppedAcks counter. A +// RIG-1569 T3 §6: an ack drop increments the dedicated DroppedAcks counter. A // delivery_ack is not a conversation frame; a drop (an unbound acking session or // an unknown message) is logged + counted and never a teardown. This drives two // ack drops — an unbound acking session and an unknown message — and asserts diff --git a/go/internal/runnerhub/dispatch_control.go b/go/internal/runnerhub/dispatch_control.go index 5bcaa1b43..fde88ad99 100644 --- a/go/internal/runnerhub/dispatch_control.go +++ b/go/internal/runnerhub/dispatch_control.go @@ -1,6 +1,6 @@ //go:build unix -// The Server->Runner control-relay dispatch arm (SEA-1569 T3 §5). Unlike the +// The Server->Runner control-relay dispatch arm (RIG-1569 T3 §5). Unlike the // client-facing session command relay (commands.go), a control deliver is // SEND-ONLY: a successful deliver returns NO synchronous result — success rides // a later AgentFrame.delivery_ack (Runner->Server), handled by the hub's ack @@ -17,7 +17,7 @@ import ( compassv1internal "github.com/RigelBuild/compass/go/internal/gen/compass/v1" ) -// DispatchControl relays a fully-formed control op (for SEA-1569, a message +// DispatchControl relays a fully-formed control op (for RIG-1569, a message // deliver) down to sessionID over the owning Runner's Sessions stream, WITHOUT // blocking for a result — the ControlDispatcher the delivery consumer holds // (design.md:737-739). It wraps op in a DeliverControl/DispatchControl envelope, diff --git a/go/internal/runnerhub/enroll_reap_test.go b/go/internal/runnerhub/enroll_reap_test.go index e727c19ea..5eb952dc5 100644 --- a/go/internal/runnerhub/enroll_reap_test.go +++ b/go/internal/runnerhub/enroll_reap_test.go @@ -2,7 +2,7 @@ package runnerhub -// SEA-1569 T3 — enroll (the Runner-reconnect teardown) fires the hub's +// RIG-1569 T3 — enroll (the Runner-reconnect teardown) fires the hub's // SessionReapSink with the session ids whose bindings it just cleared, so the // delivery consumer can reap held-deliver registry entries a no-frame author // death left behind (design.md:172-175). White-box (package runnerhub) so the diff --git a/go/internal/runnerhub/handler.go b/go/internal/runnerhub/handler.go index 34671b9aa..818574823 100644 --- a/go/internal/runnerhub/handler.go +++ b/go/internal/runnerhub/handler.go @@ -25,7 +25,7 @@ import ( ) // AgentConfigStore is the Server-side fleet config-bundle resolve surface that -// FetchAgentConfig delegates to — the SEA-1568 T1 store (`*store.Store` satisfies +// FetchAgentConfig delegates to — the RIG-1568 T1 store (`*store.Store` satisfies // it via CurrentAgentConfig). Narrow by design, the secrets.Resolver pattern: the // handler depends on this one method, not the whole store, and a server built // with no config surface passes nil. diff --git a/go/internal/runnerhub/hub.go b/go/internal/runnerhub/hub.go index 82915778a..5ba0da6c5 100644 --- a/go/internal/runnerhub/hub.go +++ b/go/internal/runnerhub/hub.go @@ -52,7 +52,7 @@ type LifecycleSink interface { // SettleSink is notified of an agent session's lifecycle transition at the SAME // hub arm that extracts it for the LifecycleSink (deliverSession) — the direct, -// non-bus edge the delivery consumer (SEA-1569 T3) subscribes to for the +// non-bus edge the delivery consumer (RIG-1569 T3) subscribes to for the // author's turn-settle (design.md:155-160). The consumer holds agent-authored // messages until their author's session settles (WORKING->READY) or reaches a // terminal state, then fires the held delivers from the message's current @@ -73,7 +73,7 @@ type SettleSink interface { // SessionStartSink is notified when the hub binds a live agent session at its // StartAgentSession promotion (promoteSession) — the direct, non-bus edge the -// delivery consumer (SEA-1569 T6) subscribes to for the reconnect sweep. On a +// delivery consumer (RIG-1569 T6) subscribes to for the reconnect sweep. On a // session start the consumer sweeps that session's owed messages // (UndeliveredMessages) and re-dispatches them ascending-seq through the // recipient's dispatch gate, so a message posted while the agent had no live @@ -101,7 +101,7 @@ type SessionStartSink interface { // SessionReapSink is notified at enroll (the Runner-reconnect teardown) of the // set of session ids whose hub bindings were just cleared, so a consumer holding // soft per-session state keyed by session id can drop it. The delivery consumer -// (SEA-1569 T3) subscribes to reap its held-deliver registry entries for a +// (RIG-1569 T3) subscribes to reap its held-deliver registry entries for a // no-frame author death: such a death emits no terminal frame, so no settle edge // ever fires fireHeld to clear the entry, and it would otherwise persist until // process restart. The design specifies exactly this enroll-bounded reap @@ -120,7 +120,7 @@ type SessionReapSink interface { OnSessionsReaped(sessionIDs []string) } -// PresenceSink is notified of the two hub-side edges the SEA-1569 T8 presence +// PresenceSink is notified of the two hub-side edges the RIG-1569 T8 presence // projection (design record D4) is fed by: a session lifecycle transition at the // deliverSession arm (the SAME arm SettleSink rides, right after the // LifecycleSink publish) and a session promotion at promoteSession (the @@ -146,7 +146,7 @@ type PresenceSink interface { } // DeliveryStore is the durable delivery-cursor surface the hub's ack arms need: -// the comms delivery cursor (SEA-1569 T3 §6) — resolve a delivered message's +// the comms delivery cursor (RIG-1569 T3 §6) — resolve a delivered message's // channel and advance the per-(agent, channel) cursor on the recipient's ack — // and the forge delivery cursor (RIG-2732 W3) — advance one subscription's // per-subscriber delivered_revision on the agent's forge_notification_ack. @@ -172,7 +172,7 @@ type DeliveryStore interface { } // TranscriptStore is the durable transcript surface the hub's commit arm writes -// a relayed transcript_entry frame to (SEA-1667 T4, the durable counterpart to +// a relayed transcript_entry frame to (RIG-1667 T4, the durable counterpart to // the loss-tolerant Deliver path). *store.Store implements it; the hub depends // only on this narrow surface (pattern: DeliveryStore). Wired via // SetTranscriptStore after construction so no NewHub caller signature changes, @@ -239,11 +239,11 @@ type CommsCaller interface { ListAsAccount(ctx context.Context, account store.AccountID, req *compassv1.ListMessagesRequest) (*compassv1.ListMessagesResponse, error) // RosterAsAccount executes an agent-initiated GetRoster under account (the // caller AND, when the request names no vantage, the session-resolved - // vantage) — SEA-1721 T2. + // vantage) — RIG-1721 T2. RosterAsAccount(ctx context.Context, account store.AccountID, req *compassv1.GetRosterRequest) (*compassv1.GetRosterResponse, error) // SetStatusAsAccount write-throughs the durable activity for account, // returning the server-truncated value that landed in the table — the write - // half of the set_status ordered write-then-publish (SEA-1721 T2 / T3). + // half of the set_status ordered write-then-publish (RIG-1721 T2 / T3). SetStatusAsAccount(ctx context.Context, account store.AccountID, activity string) (string, error) UpdatePinnedBoardAsAccount(ctx context.Context, account store.AccountID, req *compassv1.UpdatePinnedBoardRequest) (*compassv1.UpdatePinnedBoardResponse, error) } @@ -257,45 +257,45 @@ type Hub struct { tail SessionTailSink comms CommsCaller log *slog.Logger - // settle is the delivery consumer's settle-edge sink (SEA-1569 T3), notified + // settle is the delivery consumer's settle-edge sink (RIG-1569 T3), notified // at deliverSession right after the LifecycleSink publish. Nil until // SetSettleSink wires it (after both hub and consumer exist), and read under // mu so the setter and the arm never race. Nil-safe: a hub with no settle // sink is today's behavior. settle SettleSink - // sessionStart is the delivery consumer's session-start-edge sink (SEA-1569 + // sessionStart is the delivery consumer's session-start-edge sink (RIG-1569 // T6), notified at promoteSession right after the account->session binding is // recorded. Nil until SetSessionStartSink wires it (after both hub and // consumer exist), and read under mu so the setter and promoteSession never // race. Nil-safe: a hub with no session-start sink is today's behavior. sessionStart SessionStartSink - // reap is the delivery consumer's session-reap sink (SEA-1569 T3), notified + // reap is the delivery consumer's session-reap sink (RIG-1569 T3), notified // at enroll with the session ids whose bindings were just cleared, so the // consumer can drop any held-deliver entries a no-frame author death left // behind. Nil until SetSessionReapSink wires it (after both hub and consumer // exist), and read under mu so the setter and enroll never race. Nil-safe: a // hub with no reap sink is today's behavior. reap SessionReapSink - // presence is the SEA-1569 T8 presence projection's sink, notified at + // presence is the RIG-1569 T8 presence projection's sink, notified at // deliverSession (lifecycle transition) and promoteSession (reconciliation). // Nil until SetPresenceSink wires it (after both hub and the presence // component exist), and read under mu so the setter and the arms never race. // Nil-safe: a hub with no presence sink is today's behavior. presence PresenceSink // presenceSource is the T8 presence projection's READ + publish-hook edge the - // roster leg (SEA-1721 T2) consumes: PresenceFor snapshots the enum map, + // roster leg (RIG-1721 T2) consumes: PresenceFor snapshots the enum map, // PublishActivity fires the set_status live event. Distinct from `presence` // (the write edge the hub FEEDS). Nil until SetPresenceSource wires it (after // both hub and the presence component exist), and read under mu so the setter // and the reads never race. Nil-safe: a hub with none wired reports OFFLINE // and drops the activity publish. presenceSource presenceSource - // delivery is the durable delivery-cursor store the ack arm advances (SEA-1569 + // delivery is the durable delivery-cursor store the ack arm advances (RIG-1569 // T3). Nil until SetDeliveryStore wires it; read under mu. Nil-safe: a hub // with no delivery store drops delivery_ack frames. delivery DeliveryStore // transcripts is the durable transcript store the commit arm writes a relayed - // transcript_entry frame to (SEA-1667 T4). Nil until SetTranscriptStore wires + // transcript_entry frame to (RIG-1667 T4). Nil until SetTranscriptStore wires // it; read under mu. Nil-safe: a hub with no transcript store fails a // transcript commit closed CodeUnavailable. transcripts TranscriptStore @@ -360,7 +360,7 @@ type Hub struct { // accountSessions is the REVERSE of sessionAccounts (account -> live // session_id), maintained wherever sessionAccounts is so the two never drift: // promoteSession adds, unbindSession removes, enroll clears. The delivery - // consumer (SEA-1569 T3) resolves a subscribed agent account to its live + // consumer (RIG-1569 T3) resolves a subscribed agent account to its live // session to dispatch a deliver — the reverse direction RelayCommsCall never // needs. Single-Runner MVP: an account has at most one live session, so this // is a plain 1:1 map; a future multi-session-per-agent change would widen the @@ -451,7 +451,7 @@ func (h *Hub) SetSessionReapSink(reap SessionReapSink) { h.reap = reap } -// SetPresenceSink wires the SEA-1569 T8 presence component as the hub's presence +// SetPresenceSink wires the RIG-1569 T8 presence component as the hub's presence // sink, AFTER both exist — the post-construction setter that breaks the // component<->hub construction cycle (the component takes the hub as its Status // relay; the hub takes the component as its PresenceSink). Mirrors SetSettleSink. @@ -487,7 +487,7 @@ func (h *Hub) SetDeliveryStore(delivery DeliveryStore) { } // SetTranscriptStore wires the durable transcript store the commit arm writes a -// relayed transcript_entry frame to (SEA-1667 T4), after construction so no +// relayed transcript_entry frame to (RIG-1667 T4), after construction so no // NewHub caller signature changes. Called once at server assembly; nil-safe (a // hub with no transcript store fails a transcript commit closed CodeUnavailable). // Wired under mu; read under mu. @@ -498,7 +498,7 @@ func (h *Hub) SetTranscriptStore(transcripts TranscriptStore) { } // SetTranscriptReader wires the durable transcript READ store T5's resume-body -// reconstructor reads through (SEA-1667), after construction so no NewHub caller +// reconstructor reads through (RIG-1667), after construction so no NewHub caller // signature changes. Called once at server assembly; nil-safe (a hub with no // reader fails ReconstructSessionBody closed CodeUnavailable). Wired under mu; // read under mu — the exact posture SetTranscriptStore uses for the write seam. @@ -683,7 +683,7 @@ func (h *Hub) deliverSession(sessionID string, sf *compassv1internal.SessionFram h.lifecycle.PublishSessionStatus(status) // Same arm, right after the lifecycle publish: notify the delivery consumer // of the author's settle edge so it can fire any agent-authored messages held - // for this session (SEA-1569 T3 §2, design.md:155-160). Read the sink under + // for this session (RIG-1569 T3 §2, design.md:155-160). Read the sink under // mu so the setter and this arm never race; nil-safe (a hub with no settle // sink is today's behavior). The sink enqueues into the consumer's own loop // and returns promptly — it does not block Deliver on store work. @@ -694,7 +694,7 @@ func (h *Hub) deliverSession(sessionID string, sf *compassv1internal.SessionFram settle.OnSessionSettled(sessionID, state) } // Same arm: notify the presence projection of the lifecycle transition so it - // recomputes + republishes-on-change the session's agent presence (SEA-1569 + // recomputes + republishes-on-change the session's agent presence (RIG-1569 // T8, design.md:472-479). Reuse the account resolved above (same binding, one // lookup) and pass it (the sink is per-account; accountForSession stays // private). Read the sink under mu, nil-safe, exactly as the settle sink @@ -711,7 +711,7 @@ func (h *Hub) deliverSession(sessionID string, sf *compassv1internal.SessionFram } // deliverAck advances the durable delivery cursor for a recipient's -// delivery_ack (SEA-1569 T3 §6): the Runner->Server receipt that a relayed +// delivery_ack (RIG-1569 T3 §6): the Runner->Server receipt that a relayed // deliver reached the session. It resolves session->agent from the hub's own // binding (the SAME binding RelayCommsCall resolves against), resolves the // acked message's channel through the delivery store (the ack carries only @@ -876,7 +876,7 @@ func (h *Hub) enroll(id string, subject store.Subject) (reattached bool) { h.runner = &attachedRunner{id: id, subject: subject, router: router} // Snapshot the live (account -> session) bindings BEFORE clearing them: each // previously-bound account loses its live session on this re-enroll and must - // be driven to presence OFFLINE (SEA-1569 T8). enroll emits no lifecycle + // be driven to presence OFFLINE (RIG-1569 T8). enroll emits no lifecycle // frames of its own, so without this a long-WORKING agent whose Runner // reconnected would stay WORKING in the projection forever. A first-ever // enroll (empty maps) snapshots nothing and fires nothing. @@ -886,7 +886,7 @@ func (h *Hub) enroll(id string, subject store.Subject) (reattached bool) { } // Snapshot the session ids whose bindings are about to be cleared, so the // delivery consumer can reap any held-deliver registry entries a no-frame - // author death left behind (SEA-1569 T3, design.md:172-175). sessionAccounts + // author death left behind (RIG-1569 T3, design.md:172-175). sessionAccounts // is keyed by session id, and Consumer.held is keyed by that same author // session id, so these are exactly the keys to drop. A first-ever enroll // (empty map) snapshots nothing. diff --git a/go/internal/runnerhub/hub_test.go b/go/internal/runnerhub/hub_test.go index 968968952..defb3e06e 100644 --- a/go/internal/runnerhub/hub_test.go +++ b/go/internal/runnerhub/hub_test.go @@ -180,7 +180,7 @@ func TestEnrollDuplicateReattaches(t *testing.T) { } } -// TestRunnerReadyHookFiresOnEachStreamAttach pins the SEA-1820 seam: a hook wired +// TestRunnerReadyHookFiresOnEachStreamAttach pins the RIG-1820 seam: a hook wired // via SetRunnerReadyHook is invoked once per fireRunnerReady (the Sessions // handler calls it each time a Runner's command stream attaches), on its own // goroutine so a blocking seed cannot wedge the handler's receive loop. The diff --git a/go/internal/runnerhub/presence_test.go b/go/internal/runnerhub/presence_test.go index 04bd0ebda..8624899cf 100644 --- a/go/internal/runnerhub/presence_test.go +++ b/go/internal/runnerhub/presence_test.go @@ -2,7 +2,7 @@ package runnerhub -// Hub presence surface (SEA-1721 T2): PresenceFor snapshots the in-memory enum +// Hub presence surface (RIG-1721 T2): PresenceFor snapshots the in-memory enum // (absent → OFFLINE), PublishActivity fires the set_status live event through the // wired presence source, and a hub with no source wired is nil-safe (all OFFLINE, // publish dropped). Driven through a hand-written fakePresenceSource, no store. diff --git a/go/internal/runnerhub/provision_dedup_test.go b/go/internal/runnerhub/provision_dedup_test.go index a2bd1bed6..088b03d73 100644 --- a/go/internal/runnerhub/provision_dedup_test.go +++ b/go/internal/runnerhub/provision_dedup_test.go @@ -2,7 +2,7 @@ package runnerhub -// Hub-level Provision idempotency (OQ6/SEA-1243): Hub.Provision derives the +// Hub-level Provision idempotency (OQ6/RIG-1243): Hub.Provision derives the // command router's dedup id from the caller's client_request_id, scoped to the // workspace identity (agent account + repo + ref). Two Provisions with the SAME // id AND the same workspace must JOIN one in-flight command (a timeout-retry @@ -183,7 +183,7 @@ func TestProvisionEmptyClientRequestIdDoesNotDedup(t *testing.T) { }) } -// The security regression (SEA-1243): a client_request_id reused across DIFFERENT +// The security regression (RIG-1243): a client_request_id reused across DIFFERENT // workspaces must NOT dedup. client_request_id is a client-chosen string; if it // were the sole dedup key, two provisions sharing one value for different agent // accounts would join — the second caller would be handed a container diff --git a/go/internal/runnerhub/reconstruct.go b/go/internal/runnerhub/reconstruct.go index defb1c167..94031003b 100644 --- a/go/internal/runnerhub/reconstruct.go +++ b/go/internal/runnerhub/reconstruct.go @@ -2,7 +2,7 @@ package runnerhub -// T5 (SEA-1667): the resume-body reconstructor. ReconstructSessionBody rebuilds +// T5 (RIG-1667): the resume-body reconstructor. ReconstructSessionBody rebuilds // the loadable SDK session file a resuming agent starts from, by pure // read-and-concatenate over the two-tier transcript store — no control-lane ops, // no entry-JSON parsing. See the method doc for the normal (PG-only) and the diff --git a/go/internal/runnerhub/reconstruct_test.go b/go/internal/runnerhub/reconstruct_test.go index 58cbc10f3..b61b3d476 100644 --- a/go/internal/runnerhub/reconstruct_test.go +++ b/go/internal/runnerhub/reconstruct_test.go @@ -2,7 +2,7 @@ package runnerhub -// T5 (SEA-1667): Hub.ReconstructSessionBody is the resume-body reconstructor — +// T5 (RIG-1667): Hub.ReconstructSessionBody is the resume-body reconstructor — // a PURE read-and-concatenate over the two-tier transcript store. In NORMAL // operation it reads the PG hot-tail ONLY (SessionTranscript): the latest // checkpoint's EntryJSON is a full SDK file body (header-first), emitted diff --git a/go/internal/runnerhub/relay_comms.go b/go/internal/runnerhub/relay_comms.go index 6e897661c..e2ca59712 100644 --- a/go/internal/runnerhub/relay_comms.go +++ b/go/internal/runnerhub/relay_comms.go @@ -68,7 +68,7 @@ func (h *Hub) promoteSession(containerName, sessionID string) { // consumer/component loop and returns promptly, so promoteSession never blocks // on store work and never holds h.mu across a sink call (mirrors the settle // edge at deliverSession). Both nil-safe (a hub with neither wired is today's - // behavior — SEA-1569 T6 session-start, T8 presence). + // behavior — RIG-1569 T6 session-start, T8 presence). sessionStart := h.sessionStart presence := h.presence h.mu.Unlock() @@ -76,7 +76,7 @@ func (h *Hub) promoteSession(containerName, sessionID string) { sessionStart.OnSessionStarted(sessionID, account) } - // The reconciliation edge (SEA-1569 T8, design.md:494-503): a Runner + // The reconciliation edge (RIG-1569 T8, design.md:494-503): a Runner // re-enroll clears bindings and each session re-promotes here, so presence is // reconstructed on this edge. Notify AFTER releasing the lock and only once // the binding is recorded, nil-safe; the sink enqueues into the component's @@ -91,7 +91,7 @@ func (h *Hub) promoteSession(containerName, sessionID string) { // RelayCommsCall for a stopped session_id fails closed CodeNotFound — the same // answer as a never-seen session, never a stale reuse. // -// It also drives presence to OFFLINE (SEA-1569 T8): a clean Stop tears the +// It also drives presence to OFFLINE (RIG-1569 T8): a clean Stop tears the // session down, but a STOPPED/DISCONNECTED frame arriving after the unbind can // no longer resolve the account at deliverSession, so without an edge here the // account's presence would stay WORKING/IDLE/WAITING forever. Fire a terminal @@ -168,7 +168,7 @@ func (h *Hub) accountForSession(sessionID string) (store.AccountID, bool) { } // SessionForAccount resolves the LIVE session bound to an agent account — the -// REVERSE of accountForSession, the direction the delivery consumer (SEA-1569 +// REVERSE of accountForSession, the direction the delivery consumer (RIG-1569 // T3) needs to dispatch a deliver to a resolved subscriber. The bool is false // when the account has no live session (never started, stopped, or dropped on a // Runner reconnect): the consumer pushes nothing now and lets the D2 cursor @@ -285,7 +285,7 @@ func (h *Hub) RelayCommsCall( // CommitConversationFrame durably commits one relayed transcript_entry frame to // the transcript store, keyed at most once on the agent-minted idempotency_key — // the DURABLE counterpart to the loss-tolerant Deliver/PublishEvents path (#24 / -// OQ-3, SEA-1667 T4). The Runner asserts no account; this resolves session_id -> +// OQ-3, RIG-1667 T4). The Runner asserts no account; this resolves session_id -> // account from the hub's own binding purely as the fail-closed liveness gate // (exactly as RelayCommsCall does), then writes the entry to the transcript // store under the session id. The transcript row is keyed by session_id, not by @@ -293,7 +293,7 @@ func (h *Hub) RelayCommsCall( // Runner" check, not an attribution written into the row. // // The conversation_posted / conversation_updated write-through was removed with -// the Zulip threading model, so the durable lane now carries ONLY the SEA-1570 +// the Zulip threading model, so the durable lane now carries ONLY the RIG-1570 // transcript_entry variant — the exact frame the Runner's Gateway forwards // (runner/gateway/post_conversation_frame.go). The method name and the request/ // response messages keep the established CommitConversationFrame shape. @@ -351,7 +351,7 @@ func (h *Hub) CommitConversationFrame( } // commitFrame dispatches one durable frame to the transcript store by its set -// oneof variant. The durable lane carries only the SEA-1570 transcript_entry +// oneof variant. The durable lane carries only the RIG-1570 transcript_entry // variant (the conversation_posted / conversation_updated write-through was // removed with the Zulip threading model), so a frame with any other variant — // or none — is CodeInvalidArgument, the terminal "malformed frame" the Runner diff --git a/go/internal/runnerhub/relay_comms_test.go b/go/internal/runnerhub/relay_comms_test.go index 97d6661f9..dac4f8c62 100644 --- a/go/internal/runnerhub/relay_comms_test.go +++ b/go/internal/runnerhub/relay_comms_test.go @@ -427,7 +427,7 @@ func TestProvisionWithEmptyAccountLeavesNoBindingAndFailsClosed(t *testing.T) { } } -// FIX 2 (SEA-1569 T3 review): enroll() must clear the reverse accountSessions +// FIX 2 (RIG-1569 T3 review): enroll() must clear the reverse accountSessions // map alongside sessionAccounts. The accountSessions doc (hub.go) states the // reverse map is "maintained wherever sessionAccounts is so the two never // drift: promoteSession adds, unbindSession removes, enroll clears" — the @@ -459,7 +459,7 @@ func TestEnrollClearsReverseAccountSessions(t *testing.T) { } } -// M1 (SEA-1569 T8 review): unbindSession (the clean-Stop teardown path) fires +// M1 (RIG-1569 T8 review): unbindSession (the clean-Stop teardown path) fires // exactly one terminal (DISCONNECTED → OFFLINE) presence edge for the account // whose live session was torn down. Pre-fix the hub fired the presence edge only // at deliverSession while the session was still bound, so a Stop left the @@ -484,7 +484,7 @@ func TestUnbindSessionFiresTerminalPresenceEdge(t *testing.T) { } } -// M1 (SEA-1569 T8 review): unbindSession must NOT fire a terminal edge when the +// M1 (RIG-1569 T8 review): unbindSession must NOT fire a terminal edge when the // account was already re-pointed to a NEWER session — the account is not offline, // its newer session is live. This binds acct-a to sess-old, re-points it to // sess-new via a second promoteSession, then unbinds the STALE sess-old; the @@ -513,7 +513,7 @@ func TestUnbindStaleSessionFiresNoTerminalEdgeWhenRepointed(t *testing.T) { } } -// M1 (SEA-1569 T8 review): enroll (the Runner-reconnect teardown path) fires one +// M1 (RIG-1569 T8 review): enroll (the Runner-reconnect teardown path) fires one // terminal (DISCONNECTED → OFFLINE) presence edge per PREVIOUSLY-bound account // before clearing every binding, and the maps are cleared. Pre-fix enroll emitted // no lifecycle frames at all, so a reconnect left every agent's presence stuck at @@ -556,7 +556,7 @@ func TestEnrollFiresTerminalPresenceEdgePerBoundAccountAndClears(t *testing.T) { } } -// M1 (SEA-1569 T8 review): a first-ever enroll (no prior bindings) fires no +// M1 (RIG-1569 T8 review): a first-ever enroll (no prior bindings) fires no // terminal presence edge — there is nothing bound to drive offline. func TestFirstEnrollFiresNoTerminalPresenceEdge(t *testing.T) { hub := newHubOnly() diff --git a/go/internal/runnerhub/relay_roster_setstatus_test.go b/go/internal/runnerhub/relay_roster_setstatus_test.go index 506756fc0..60419013e 100644 --- a/go/internal/runnerhub/relay_roster_setstatus_test.go +++ b/go/internal/runnerhub/relay_roster_setstatus_test.go @@ -2,7 +2,7 @@ package runnerhub -// The roster + set_status relay arms (SEA-1721 T2): RelayCommsCall dispatches a +// The roster + set_status relay arms (RIG-1721 T2): RelayCommsCall dispatches a // roster call to RosterAsAccount and a set_status call to SetStatusAsAccount // under the bound account, wraps the matching result oneof, and — for set_status // — fires the best-effort PublishActivity carrying the SERVER-TRUNCATED value diff --git a/go/internal/runnerhub/resume_start.go b/go/internal/runnerhub/resume_start.go index e03021cb8..6b8a62d92 100644 --- a/go/internal/runnerhub/resume_start.go +++ b/go/internal/runnerhub/resume_start.go @@ -2,7 +2,7 @@ package runnerhub -// T6 (SEA-1667): the resume handoff on the Server->Runner start relay. +// T6 (RIG-1667): the resume handoff on the Server->Runner start relay. // StartResume is the resume-carrying sibling of Start (commands.go): it relays // the SAME StartAgentSession command, but additionally attaches the // server-reconstructed session body onto the INTERNAL SessionsResponse.resume_body diff --git a/go/internal/runnerhub/router.go b/go/internal/runnerhub/router.go index 15ff67b2e..2e45b8b84 100644 --- a/go/internal/runnerhub/router.go +++ b/go/internal/runnerhub/router.go @@ -75,7 +75,7 @@ type commandRouter struct { // dispatches (send1) still awaiting a possible async refusal. A successful // deliver returns NO synchronous result and rides a later // AgentFrame.delivery_ack, so send1 registers no pendingCall and does not - // block (SEA-1569 §5). A REFUSAL does ride the Sessions request stream as a + // block (RIG-1569 §5). A REFUSAL does ride the Sessions request stream as a // RunnerError result correlated by request id, which complete() would // otherwise drop as "unknown". This set makes such a refusal OBSERVABLE // (logged + counted) instead of silently dropped. @@ -318,7 +318,7 @@ func (r *commandRouter) push(cmd *compassv1internal.SessionsResponse) error { } // send1 enqueues a single send-only DELIVER command onto the outbound queue -// WITHOUT registering a blocking pendingCall — the crux of SEA-1569 §5. A +// WITHOUT registering a blocking pendingCall — the crux of RIG-1569 §5. A // successful deliver returns NO synchronous result (success rides a later // AgentFrame.delivery_ack), so reusing dispatch — which registers an inflight // call and blocks on waitCall for a result that never comes — would hang until @@ -381,7 +381,7 @@ func waitCall(ctx context.Context, call *pendingCall) (*compassv1internal.Sessio // - an inflight blocking call (dispatch): hand it the result and wake it. // - a send-only deliver awaiting a possible async refusal (send1): the result // is a RunnerError refusal — count + log it and clear the entry, so the -// refusal is observable and not dropped (SEA-1569 §5). The cursor was never +// refusal is observable and not dropped (RIG-1569 §5). The cursor was never // advanced on send, so no rollback is needed; the D2 sweep redelivers. // - a truly-unknown id (a duplicate result, or a reaped call): ignored, the // original contract. diff --git a/go/internal/runnerhub/sessionstart_test.go b/go/internal/runnerhub/sessionstart_test.go index 515ac7ad1..b5785931a 100644 --- a/go/internal/runnerhub/sessionstart_test.go +++ b/go/internal/runnerhub/sessionstart_test.go @@ -2,7 +2,7 @@ package runnerhub -// SEA-1569 T6 — the hub's session-start-edge sink, fired at promoteSession when +// RIG-1569 T6 — the hub's session-start-edge sink, fired at promoteSession when // StartAgentSession binds a live agent session. The delivery consumer subscribes // to this edge (SetSessionStartSink) to run the reconnect sweep for the freshly // -live session. White-box (package runnerhub) so the tests drive the unexported diff --git a/go/internal/runtime/config_mount_test.go b/go/internal/runtime/config_mount_test.go index 0b1cf892d..6b7b15e96 100644 --- a/go/internal/runtime/config_mount_test.go +++ b/go/internal/runtime/config_mount_test.go @@ -2,7 +2,7 @@ package runtime -// Real-container substrate proof for config delivery (SEA-1675), against real +// Real-container substrate proof for config delivery (RIG-1675), against real // rootless podman. This is the seam the config-in-place-update design rests on // and that no other test exercises against a real container: // diff --git a/go/internal/runtime/portability_test.go b/go/internal/runtime/portability_test.go index c410fae7f..60212a726 100644 --- a/go/internal/runtime/portability_test.go +++ b/go/internal/runtime/portability_test.go @@ -2,7 +2,7 @@ package runtime -// SEA-1359 portability proof (SEA-1327 Decision 1): the REAL agent base image +// RIG-1359 portability proof (RIG-1327 Decision 1): the REAL agent base image // carries a self-contained, single-user Nix store the agent owns and can // activate a devenv from — with NO host /nix mount, no overlay, and no // assumption the host has Nix. This is the "T8 agent-owns-/nix test" the @@ -108,7 +108,7 @@ func requireRealImage(t *testing.T) string { return ref } -// TestRealImagePortability is the SEA-1359 acceptance proof. It drives the +// TestRealImagePortability is the RIG-1359 acceptance proof. It drives the // production AgentRuntime.Launch against the REAL base image and, as the // unprivileged agent user over the production ExecAsAgent path, proves the // in-image store is agent-owned and self-sufficient and that direnv activates a diff --git a/go/internal/runtime/secrets_materialize.go b/go/internal/runtime/secrets_materialize.go index 16b59cd54..778d8ea28 100644 --- a/go/internal/runtime/secrets_materialize.go +++ b/go/internal/runtime/secrets_materialize.go @@ -35,7 +35,7 @@ const providerCredentialAPIKey = "api_key" // compassDirName is the per-agent config subdir under $HOME, and envFileName is // the aggregate env-secret file within it. Env-delivery secrets are written here -// as KEY=VALUE lines (SEA-1327 T5) and sourced by the agent from its own +// as KEY=VALUE lines (RIG-1327 T5) and sourced by the agent from its own // namespace at startup — never `-e KEY=VALUE` (host-process-list visible) nor // `podman exec --env-file` (podman resolves that path host-side, where this // container-internal file does not exist). @@ -139,7 +139,7 @@ func (e SecretEnv) GoString() string { return e.String() } // SecretMaterializer installs a fetched secret set into a container over the // stdin-exec channel, routing each secret by Kind. It is the Runner-side half of -// SEA-1327 T5, driven from the SecretsVersion dispatch hook (initial materialize +// RIG-1327 T5, driven from the SecretsVersion dispatch hook (initial materialize // and rotation ride the same signal path). type SecretMaterializer struct { runtime ContainerRuntime diff --git a/go/internal/runtime/secrets_materialize_podman_test.go b/go/internal/runtime/secrets_materialize_podman_test.go index 2712e9823..97ebfc6d0 100644 --- a/go/internal/runtime/secrets_materialize_podman_test.go +++ b/go/internal/runtime/secrets_materialize_podman_test.go @@ -2,7 +2,7 @@ package runtime -// Real-podman coverage for env-delivery secret materialization (SEA-1327 T5). +// Real-podman coverage for env-delivery secret materialization (RIG-1327 T5). // // This test defends the write-then-read contract the broken `podman exec // --env-file` channel could never satisfy: the materializer writes the diff --git a/go/internal/secrets/resolver.go b/go/internal/secrets/resolver.go index adb7b6729..f9b83b281 100644 --- a/go/internal/secrets/resolver.go +++ b/go/internal/secrets/resolver.go @@ -209,7 +209,7 @@ func (r *SpecResolver) Resolve(ctx context.Context, reason string) ([]ResolvedSe // valid secret name; an empty value is rejected up front. // // Verified against secretspec v0.15.0 source (secrets.rs:1635-1647, compass -// ruling SEA-1327 f63edea3): `set ` with the value omitted from argv and +// ruling RIG-1327 f63edea3): `set ` with the value omitted from argv and // stdin not a tty takes the piped-stdin branch — a first-class // io::stdin().read_to_string() with no interactive prompt constructed — then // trims the value and rejects an empty one. So `secretspec set diff --git a/go/internal/secrets/resolver_test.go b/go/internal/secrets/resolver_test.go index 25495d671..a2b53915d 100644 --- a/go/internal/secrets/resolver_test.go +++ b/go/internal/secrets/resolver_test.go @@ -220,7 +220,7 @@ func TestSetEmptyValueRejected(t *testing.T) { // TestSecretSpecVersionPin is a drift guard: the resolver's stdin/trim/empty- // reject write contract and the runtime FFI dlopen were verified against -// secretspec-go v0.15.0 source (compass ruling SEA-1327 f63edea3). If a devenv +// secretspec-go v0.15.0 source (compass ruling RIG-1327 f63edea3). If a devenv // fork-sync moves the pin, this fails loudly so the set() contract is re-checked // against the new source rather than silently drifting. func TestSecretSpecVersionPin(t *testing.T) { @@ -246,7 +246,7 @@ func TestSecretSpecVersionPin(t *testing.T) { t.Fatalf("%s not found in go.mod; expected it pinned at %s", modulePath, wantVersion) } if got != wantVersion { - t.Fatalf("secretspec-go pinned at %s, want %s — the write-path contract (stdin/trim/empty-reject) was verified against %s; re-verify set() semantics against the new source before moving the pin (SEA-1327 f63edea3)", got, wantVersion, wantVersion) + t.Fatalf("secretspec-go pinned at %s, want %s — the write-path contract (stdin/trim/empty-reject) was verified against %s; re-verify set() semantics against the new source before moving the pin (RIG-1327 f63edea3)", got, wantVersion, wantVersion) } } diff --git a/go/internal/secrets/secrets.go b/go/internal/secrets/secrets.go index 24c6b47fb..8d7d806ac 100644 --- a/go/internal/secrets/secrets.go +++ b/go/internal/secrets/secrets.go @@ -1,5 +1,5 @@ // Package secrets is the Server-side secret resolve surface for the agent -// container runtime (SEA-1327 T3). It wraps SecretSpec resolution behind a +// container runtime (RIG-1327 T3). It wraps SecretSpec resolution behind a // Resolver interface and owns the resolve-surface value types the Runner fetch // (T4) and materializer (T5) consume. // diff --git a/go/internal/stack/config.go b/go/internal/stack/config.go index 5ed2ed6b8..878d6c9cd 100644 --- a/go/internal/stack/config.go +++ b/go/internal/stack/config.go @@ -92,7 +92,7 @@ type Config struct { // --mount flag parses (cmd/compass-runner/main.go parseMount). Empty (nil) // adds no extra mounts — the core applies no default, mirroring EgressAllow. // The dogfood e2e harness uses it to deliver a canned-model models.yml into - // the agent's ~/.omp/agent (SEA-1787 H3); the embedded supervisor and the + // the agent's ~/.omp/agent (RIG-1787 H3); the embedded supervisor and the // compass-stack CLI leave it unset. Mounts []string } diff --git a/go/internal/stack/spec_test.go b/go/internal/stack/spec_test.go index de9d25a12..a22f15c0c 100644 --- a/go/internal/stack/spec_test.go +++ b/go/internal/stack/spec_test.go @@ -23,7 +23,7 @@ func baseRunnerArgs(cfg Config, cert CertResult) []string { } // TestRunnerSpecForwardsOptionalFlagsConditionally is the load-bearing red→green -// for the A4 Config plumbing (SEA-1785). It pins the hard invariant a wrong diff +// for the A4 Config plumbing (RIG-1785). It pins the hard invariant a wrong diff // violates: the optional Config fields reach the runner's flags EXACTLY when set, // and NONE appears when they are zero — an embedded supervisor that leaves them // unset must get a byte-identical Args to today (forwarding `--agent-model ""`, diff --git a/go/internal/store/accounts.go b/go/internal/store/accounts.go index 55c680848..9c8551170 100644 --- a/go/internal/store/accounts.go +++ b/go/internal/store/accounts.go @@ -281,7 +281,7 @@ func (s *Store) CreateAgent(ctx context.Context, ownerUserID AccountID, a NewAge // registered coordination hook. The INSERT above just wrote it; invoke the // hook on THIS tx for the new agent's PARENT (the manager that gains this // report), so the coordination-channel reconcile commits atomically with the - // tree edge (SEA-1722 T5, design.md:550-551). Skipped when parent is empty: a + // tree edge (RIG-1722 T5, design.md:550-551). Skipped when parent is empty: a // root agent has no manager, so there is no coordination channel to reconcile. if a.ParentAgentID != "" { if err := s.invokeCoordinationHook(ctx, tx, a.ParentAgentID); err != nil { @@ -555,7 +555,7 @@ func (s *Store) ReparentAgent(ctx context.Context, caller, agentAccountID, newPa // INVARIANT: every write of agent_accounts.parent_agent_id must invoke the // registered coordination hook. The UPDATE above rewrote it, so reconcile - // BOTH affected managers' coordination channels on THIS tx (SEA-1722 T5, + // BOTH affected managers' coordination channels on THIS tx (RIG-1722 T5, // design.md:550-551,567): the NEW parent gains this report (reparent-in adds // it) and the OLD parent loses it (reparent-out removes it). The reconcile is // a per-manager membership resync (idempotent), so invoking it for each with diff --git a/go/internal/store/agent_config.go b/go/internal/store/agent_config.go index 3e1315340..896778b3c 100644 --- a/go/internal/store/agent_config.go +++ b/go/internal/store/agent_config.go @@ -19,7 +19,7 @@ import ( yaml "go.yaml.in/yaml/v3" ) -// The fleet CONFIG-BUNDLE store (SEA-1624 T1). One fleet-wide singleton bundle +// The fleet CONFIG-BUNDLE store (RIG-1624 T1). One fleet-wide singleton bundle // row (agent_config_bundle, 0001_init.sql) holds the gzip-tarball of the // skills/, extensions/, and mcp/ material every agent materializes into its // scoped config dir (T3/T4). Unlike the secrets NAMES registry (secrets.go, a @@ -42,7 +42,7 @@ const ( ) // Top-level regular-file members admitted by exact filename (not under a top -// dir): the fleet context file and the fleet model config (SEA-1678 T1). Any +// dir): the fleet context file and the fleet model config (RIG-1678 T1). Any // other top-level file stays rejected. const ( memberAgentsMD = "AGENTS.md" @@ -112,7 +112,7 @@ func (c *cappedReader) Read(p []byte) (int, error) { } // PutAgentConfig validates a fleet config bundle at the store door and, if it -// passes, upserts it as the single current bundle (SEA-1624 T1). It returns the +// passes, upserts it as the single current bundle (RIG-1624 T1). It returns the // bundle's canonical content version (the content hash computed by // validateAndHashConfigBundle): the sha256 over the DECOMPRESSED, // metadata-zeroed (path, bytes) content, so tar member @@ -180,7 +180,7 @@ func (s *Store) CurrentAgentConfig(ctx context.Context) (version string, bundle // singleton is already absent is a no-op success, not ErrNotFound — the caller's // intent (no bundle) already holds, so a repeated Delete or a Delete on a // never-configured fleet both succeed. This is the operator's explicit -// return-to-unconfigured path (SEA-1625 T2), chosen over blessing an +// return-to-unconfigured path (RIG-1625 T2), chosen over blessing an // empty-tarball push. func (s *Store) DeleteAgentConfig(ctx context.Context) error { if _, err := s.pool.Exec(ctx, @@ -193,7 +193,7 @@ func (s *Store) DeleteAgentConfig(ctx context.Context) error { // AgentConfigInfo reports the current bundle's version and the NAMES of its // declared members, bucketed by top dir (skills / extensions / mcp) — names -// only, never content (SEA-1625 T2). Each bucket is deduplicated and sorted: a +// only, never content (RIG-1625 T2). Each bucket is deduplicated and sorted: a // skill spreads many files under skills//, but the operator-facing view is // the set of declared s. ErrNotFound when no bundle is declared (the // caller decides empty-is-ok, mirroring CurrentAgentConfig). @@ -219,7 +219,7 @@ func (s *Store) AgentConfigInfo(ctx context.Context) (info AgentConfigInfoResult // AgentConfigInfoResult is the value-free member inventory of a config bundle: // version, the multi-member name buckets (skills/extensions/mcp + the CP-4 // rules/subagents), and presence flags for the singleton members (settings, -// AGENTS.md, models.yml). Names only, never content (SEA-1625 T2 / SEA-1678 T1). +// AGENTS.md, models.yml). Names only, never content (RIG-1625 T2 / RIG-1678 T1). type AgentConfigInfoResult struct { Version string Skills []string diff --git a/go/internal/store/agent_config_pgtest_test.go b/go/internal/store/agent_config_pgtest_test.go index fd864bdff..4bb6f4c54 100644 --- a/go/internal/store/agent_config_pgtest_test.go +++ b/go/internal/store/agent_config_pgtest_test.go @@ -2,7 +2,7 @@ package store -// Config-bundle POOL round-trips (SEA-1624 T1), pgtest gate — these exercise +// Config-bundle POOL round-trips (RIG-1624 T1), pgtest gate — these exercise // PutAgentConfig/CurrentAgentConfig against a real Postgres via the shared // harness (newTestStore/mustUser only exist under this tag). The door // validation + canonical-hash logic is proven purely in the default-gate @@ -150,7 +150,7 @@ func TestPutAgentConfigCurrentOnlyRetention(t *testing.T) { } } -// TestDeleteAgentConfigRoundTrip proves the return-to-unconfigured path (SEA-1625 +// TestDeleteAgentConfigRoundTrip proves the return-to-unconfigured path (RIG-1625 // T2): after a Put, DeleteAgentConfig clears the singleton so CurrentAgentConfig // reports ErrNotFound (the empty-config state), and the table holds zero rows. func TestDeleteAgentConfigRoundTrip(t *testing.T) { diff --git a/go/internal/store/agent_config_test.go b/go/internal/store/agent_config_test.go index aae5e230c..2dec87553 100644 --- a/go/internal/store/agent_config_test.go +++ b/go/internal/store/agent_config_test.go @@ -1,6 +1,6 @@ package store -// Config-bundle DOOR contracts (SEA-1624 T1), default gate — pure functions +// Config-bundle DOOR contracts (RIG-1624 T1), default gate — pure functions // over []byte, no Postgres. validateAndHashConfigBundle is the security-critical // store door: it validates every tar member and computes the canonical content // version in one streamed pass. These tests exercise every rejection path @@ -396,7 +396,7 @@ func itoa(n int) string { // mkYAMLMap is a minimal valid YAML mapping body for a settings/models member. const mkYAMLMap = "compaction:\n enabled: true\n" -// TestValidateConfigBundleAcceptsNewMembers pins the SEA-1678 grammar accepts: +// TestValidateConfigBundleAcceptsNewMembers pins the RIG-1678 grammar accepts: // settings/config.yml (YAML mapping), flat rules/*.md|.mdc, flat agents/*.md, // and the two top-level files AGENTS.md and models.yml (models YAML-mapping). func TestValidateConfigBundleAcceptsNewMembers(t *testing.T) { @@ -424,7 +424,7 @@ func TestValidateConfigBundleAcceptsNewMembers(t *testing.T) { } // TestValidateConfigBundleRejectsNewMembers pins the structural rejection matrix -// for the SEA-1678 grammar: settings variants/nesting/non-mapping, nested rules, +// for the RIG-1678 grammar: settings variants/nesting/non-mapping, nested rules, // non-.md agents, and a top-level file other than AGENTS.md/models.yml. func TestValidateConfigBundleRejectsNewMembers(t *testing.T) { cases := []struct { diff --git a/go/internal/store/agent_placements.go b/go/internal/store/agent_placements.go index c2e0e39c5..07da44b24 100644 --- a/go/internal/store/agent_placements.go +++ b/go/internal/store/agent_placements.go @@ -18,7 +18,7 @@ import ( // table; keeping the two apart is what stops the container hop 0003 introduced // from growing back into the security boundary. What placement is for is the // two reads below: StartAgentSession resolving the account that owns an incoming -// container_name, and reattach recovery (SEA-1516) naming every agent stranded +// container_name, and reattach recovery (RIG-1516) naming every agent stranded // by a Runner restart. // AgentPlacement is one agent's placement: the Runner it runs on and the @@ -109,7 +109,7 @@ func (s *Store) AgentForContainer(ctx context.Context, containerName string) (Ac } // ListAgentPlacementsForRunner returns every agent placed on runnerID. This is -// the reattach read (SEA-1516): after a Runner restart its surviving containers +// the reattach read (RIG-1516): after a Runner restart its surviving containers // are orphaned, and the Server re-drives Provision for exactly this set — which // is why each row carries the container name and not just the account. Ordered // by agent account id so a recovery pass is deterministic and its logs diffable. @@ -148,7 +148,7 @@ func (s *Store) ListAgentPlacementsForRunner(ctx context.Context, runnerID strin } // DeleteAgentPlacement releases the placement for containerName — the release -// path RecordAgentPlacement's godoc flagged as missing. Despawn (SEA-1618) tears +// path RecordAgentPlacement's godoc flagged as missing. Despawn (RIG-1618) tears // down a container and must free its placement so the unique container_name is // available again for a future spawn. It is IDEMPOTENT: a despawn may be retried, // and a second despawn of an already-removed container must succeed, so deleting diff --git a/go/internal/store/agent_placements_test.go b/go/internal/store/agent_placements_test.go index 9fb6e19ab..c668e5e69 100644 --- a/go/internal/store/agent_placements_test.go +++ b/go/internal/store/agent_placements_test.go @@ -3,7 +3,7 @@ package store // Agent placement: the durable record of which Runner an agent is on and the -// container name it runs under. Two things must hold for the SEA-1516 reattach +// container name it runs under. Two things must hold for the RIG-1516 reattach // work that reads it — a placement is SINGULAR per agent (a re-provision // replaces it, never accumulates), and the container -> agent mapping it // exposes is exclusive. Both are database invariants (the PK and the unique diff --git a/go/internal/store/agent_transcripts.go b/go/internal/store/agent_transcripts.go index 7aeb3ac98..ae193ec74 100644 --- a/go/internal/store/agent_transcripts.go +++ b/go/internal/store/agent_transcripts.go @@ -10,7 +10,7 @@ import ( "github.com/jackc/pgx/v5" ) -// The durable TWO-TIER transcript store (SEA-1667 T4). A Postgres HOT TAIL +// The durable TWO-TIER transcript store (RIG-1667 T4). A Postgres HOT TAIL // (agent_session_transcript_entries) holds [latest checkpoint .. now] = the // normal resume set; superseded/evicted/ended history is flushed as verbatim // JSONL segments to an object store behind the ObjectStore seam and indexed by diff --git a/go/internal/store/agent_transcripts_test.go b/go/internal/store/agent_transcripts_test.go index 0310651d9..560ea2ada 100644 --- a/go/internal/store/agent_transcripts_test.go +++ b/go/internal/store/agent_transcripts_test.go @@ -2,7 +2,7 @@ package store -// The durable two-tier transcript store (SEA-1667 T4), proven against real +// The durable two-tier transcript store (RIG-1667 T4), proven against real // Postgres with the object-store seam FAKED (no live S3). Covers the record's // T4 test cycle: FK rejection; idempotent duplicate key; ordering; the // session-scoped rebase across lifetimes; the post-supersession read view; diff --git a/go/internal/store/channel_policy_pgtest_test.go b/go/internal/store/channel_policy_pgtest_test.go index db512db11..693ffee27 100644 --- a/go/internal/store/channel_policy_pgtest_test.go +++ b/go/internal/store/channel_policy_pgtest_test.go @@ -2,7 +2,7 @@ package store -// Channel-policy store contracts (SEA-1722 T4, design.md:488-528): the post +// Channel-policy store contracts (RIG-1722 T4, design.md:488-528): the post // policy (OWNER_ONLY rejects a non-owner with the SAME ErrNotFound a non-member // gets — no oracle), the mandatory-subscription flag (an explicit unsubscribe is // refused, and the D1 read-side delivers to a member whose row says diff --git a/go/internal/store/channels.go b/go/internal/store/channels.go index 31ed09453..96b826339 100644 --- a/go/internal/store/channels.go +++ b/go/internal/store/channels.go @@ -714,9 +714,9 @@ func (s *Store) SetChannelPolicy(ctx context.Context, actor AccountID, channelID // the caller-facing not-found/forbidden merge is the caller's, layered on the // membership it reads from the returned channel. Two callers rely on it: the // comms coordination reconcile reads a just-committed coordination channel for -// its post-commit ChannelChanged emit (SEA-1722 T5), and the UpdatePinnedBoard +// its post-commit ChannelChanged emit (RIG-1722 T5), and the UpdatePinnedBoard // handler reads the member set and post policy together to authorize a board -// mutation against the channel's policy (SEA-1723 T6). +// mutation against the channel's policy (RIG-1723 T6). func (s *Store) GetChannel(ctx context.Context, id ChannelID) (Channel, error) { return s.getChannel(ctx, id) } diff --git a/go/internal/store/coordination.go b/go/internal/store/coordination.go index ab29a8856..8e5b29097 100644 --- a/go/internal/store/coordination.go +++ b/go/internal/store/coordination.go @@ -8,7 +8,7 @@ import ( ) // CoordinationHook is the manager-comms coordination-channel reconcile the comms -// layer registers on the store (SEA-1722 T5, design.md:542-551). The two +// layer registers on the store (RIG-1722 T5, design.md:542-551). The two // parent-edge writers (CreateAgent, ReparentAgent) invoke it on their OWN pgx.Tx // right after writing agent_accounts.parent_agent_id, so the reconcile runs in // the SAME transaction as the parent-edge write WITHOUT the store importing diff --git a/go/internal/store/coordination_pgtest_test.go b/go/internal/store/coordination_pgtest_test.go index 01c481d15..f735b5122 100644 --- a/go/internal/store/coordination_pgtest_test.go +++ b/go/internal/store/coordination_pgtest_test.go @@ -2,7 +2,7 @@ package store -// Coordination-channel store contracts (SEA-1722 T5, design.md:530-592): the +// Coordination-channel store contracts (RIG-1722 T5, design.md:530-592): the // two parent-edge writers (CreateAgent, ReparentAgent) invoke the registered // coordination hook on their OWN tx right after writing parent_agent_id, and the // tx-level store helpers the comms reconcile drives (per-owner group get-or- diff --git a/go/internal/store/delivery_cursors.go b/go/internal/store/delivery_cursors.go index e14adc994..a6cadefb4 100644 --- a/go/internal/store/delivery_cursors.go +++ b/go/internal/store/delivery_cursors.go @@ -301,7 +301,7 @@ func (s *Store) UnroutedMentionMessages(ctx context.Context, afterSeq int64, lim // between two owed seqs and currently stops the advance, so above_seqs can // accumulate acked seqs on a busy multi-channel deployment. Tightening this // advance to drain across cross-channel gaps without reintroducing commit-lag -// loss is a parked design question (SEA-1569 review, PR #55 Open Questions) — do +// loss is a parked design question (RIG-1569 review, PR #55 Open Questions) — do // not "fix" it by jumping the low-water past an un-acked lower owed seq, which // loses commit-lagged messages. A duplicate or reordered ack is a no-op. func (s *Store) AckDelivery(ctx context.Context, agent AccountID, channel ChannelID, messageID string) error { diff --git a/go/internal/store/delivery_cursors_test.go b/go/internal/store/delivery_cursors_test.go index da7823d9b..0eb34b4e9 100644 --- a/go/internal/store/delivery_cursors_test.go +++ b/go/internal/store/delivery_cursors_test.go @@ -2,7 +2,7 @@ package store -// Delivery-cursor contracts (SEA-1569 T2, design record D2): the durable +// Delivery-cursor contracts (RIG-1569 T2, design record D2): the durable // per-(agent, channel) low-water cursor. AckDelivery resolves a message id to a // seq (the overshoot clamp), records out-of-order acks in the above-set, and // drains the contiguous cursor across acked-or-self-authored seqs; a duplicate, diff --git a/go/internal/store/delivery_reads.go b/go/internal/store/delivery_reads.go index 199829408..fe4010228 100644 --- a/go/internal/store/delivery_reads.go +++ b/go/internal/store/delivery_reads.go @@ -5,7 +5,7 @@ import ( "fmt" ) -// The delivery consumer's read side (SEA-1569 T3, design record D1). These live +// The delivery consumer's read side (RIG-1569 T3, design record D1). These live // beside the T2 cursor methods (delivery_cursors.go) so the fan-out consumer's // store surface is proven against real Postgres in one pgtest-tagged file, the // same discipline the cursor reads follow. All four are pure reads — the diff --git a/go/internal/store/delivery_reads_test.go b/go/internal/store/delivery_reads_test.go index d5f7b6a28..54459db99 100644 --- a/go/internal/store/delivery_reads_test.go +++ b/go/internal/store/delivery_reads_test.go @@ -2,7 +2,7 @@ package store -// The delivery consumer's read side (SEA-1569 T3, design record D1): subscriber +// The delivery consumer's read side (RIG-1569 T3, design record D1): subscriber // resolution with the home-channel disjunct, the author agent/human split, and // the message-id -> channel / message reads the ack arm and settle gate use. // These are properties only a real Postgres proves (the SQL disjunct, the JOIN diff --git a/go/internal/store/errors.go b/go/internal/store/errors.go index 8b913cc34..3f059492c 100644 --- a/go/internal/store/errors.go +++ b/go/internal/store/errors.go @@ -28,7 +28,7 @@ var ( // ErrConflict is a conflict the store refuses: a uniqueness violation (a // duplicate account handle, a channel name already taken in its group, or a // re-used id), or an operation rejected because its target is already in a - // terminal state (a second answer to an already-answered ask, SEA-1243). + // terminal state (a second answer to an already-answered ask, RIG-1243). ErrConflict = errors.New("store: conflict") // ErrInvalidArgument is a malformed input the store rejects before touching diff --git a/go/internal/store/forge_cursors.go b/go/internal/store/forge_cursors.go index c647904b7..4ab45675e 100644 --- a/go/internal/store/forge_cursors.go +++ b/go/internal/store/forge_cursors.go @@ -5,7 +5,7 @@ import ( "fmt" ) -// The forge poll driver's durable state (SEA-1810 T2, design +// The forge poll driver's durable state (RIG-1810 T2, design // docs/designs/product/compass-forge-poll-driver/design.md §T2): the repo-LIST // per-page FETCH cursor (forge_list_cursors) and the board's per-REPO poll // targets (forge_repo_subscriptions). The two DL-053 anticipatory tables diff --git a/go/internal/store/forge_cursors_pgtest_test.go b/go/internal/store/forge_cursors_pgtest_test.go index 7603ed98b..59322b8b0 100644 --- a/go/internal/store/forge_cursors_pgtest_test.go +++ b/go/internal/store/forge_cursors_pgtest_test.go @@ -2,7 +2,7 @@ package store -// Forge poll-driver store contracts (SEA-1810 T2, design +// Forge poll-driver store contracts (RIG-1810 T2, design // docs/designs/product/compass-forge-poll-driver/design.md §T2 test cycle): the // migration 0016 four-table shape (PKs, provider CHECK domain 1..4, page/kind // CHECKs), the repo-LIST fetch cursor (read/upsert/prune with coordinate diff --git a/go/internal/store/gen_credential_keys.go b/go/internal/store/gen_credential_keys.go index 8424ae023..d1625c75d 100644 --- a/go/internal/store/gen_credential_keys.go +++ b/go/internal/store/gen_credential_keys.go @@ -2,7 +2,7 @@ // gen_credential_keys.go regenerates credential_keys_gen.go from the OMP SDK's // settings schema. It is the authoritative refresh step for the store door's -// credential denylist (SEA-1678 T1, OQ-2 (c)): the door rejects a +// credential denylist (RIG-1678 T1, OQ-2 (c)): the door rejects a // settings/config.yml that sets any SDK credential-marked path, and that path // set MUST track the SDK's own isCredential marker across fork bumps. // diff --git a/go/internal/store/inputs.go b/go/internal/store/inputs.go index c25b80bd8..4f6e94628 100644 --- a/go/internal/store/inputs.go +++ b/go/internal/store/inputs.go @@ -20,11 +20,11 @@ type NewUser struct { type NewAgent struct { Handle string DisplayName string - // Persona is the agent's system-prompt text, baked at creation (SEA-1571). + // Persona is the agent's system-prompt text, baked at creation (RIG-1571). // Empty means no persona override; the caller supplies it and the server // stores it verbatim, never synthesizing one. Persona string - // Role is the agent's operator-set block-0 selector (SEA-1732 T10). Empty + // Role is the agent's operator-set block-0 selector (RIG-1732 T10). Empty // means no role (default OMP block-0); the caller supplies it and the server // stores it verbatim, never synthesizing one. Unlike Persona (an append // overlay), the label selects config/prompts//SYSTEM.md, delivered as diff --git a/go/internal/store/issues_pgtest_test.go b/go/internal/store/issues_pgtest_test.go index b9c16182b..cb942841e 100644 --- a/go/internal/store/issues_pgtest_test.go +++ b/go/internal/store/issues_pgtest_test.go @@ -8,7 +8,7 @@ import ( "testing" ) -// Issues store contracts (SEA-1728 part 3a): the forge coordinate is the +// Issues store contracts (RIG-1728 part 3a): the forge coordinate is the // idempotency key so a re-poll keeps a stable id and never clobbers a human-set // lifecycle state, a persisted issue always has a real state (DEFAULT BACKLOG), // unknown ids are ErrNotFound, and the issue survives a store restart (DL-019 diff --git a/go/internal/store/messages.go b/go/internal/store/messages.go index e26b9f78a..6c393ccff 100644 --- a/go/internal/store/messages.go +++ b/go/internal/store/messages.go @@ -256,7 +256,7 @@ func resolveTopicForAppend(ctx context.Context, tx pgx.Tx, channelID string, top // before visibility filtering, so a subscriber learns the instance-wide durable // message count (one integer, no content) even for channels it cannot see; this // count-metadata exposure is accepted as within the threat model, not a leak to -// close by scoping the boundary — that would be a different token (SEA-1333 OQ4). +// close by scoping the boundary — that would be a different token (RIG-1333 OQ4). func (s *Store) MessagesHeadSeq(ctx context.Context) (uint64, error) { var head uint64 if err := s.pool.QueryRow(ctx, @@ -307,7 +307,7 @@ func updateMessageBlocksExec(ctx context.Context, db execer, id MessageID, block // UpdateMessageBlocksAsAuthor replaces a message's block set UNDER an acting // account — the only update path safe for a message id that arrives from // outside the Server's own trust boundary (a relayed agent MessageUpdated -// frame, SEA-1364 T3). +// frame, RIG-1364 T3). // // Why it is a fork and not a flag on the shared core. updateMessageBlocksExec // addresses the row by a bare MessageID with NO membership and NO authorship @@ -495,7 +495,7 @@ func (s *Store) ListMessages(ctx context.Context, q ListMessagesQuery) ([]Messag // lost update — the matching MessageUpdated also rides the live tail, so an // id-deduping client converges to current content (last-write-wins). // Freezing content too would need an update/change-seq and a larger schema - // change; membership-only is the ratified scope (SEA-1333 OQ5). + // change; membership-only is the ratified scope (RIG-1333 OQ5). const query = ` SELECT m.id, m.topic_id, m.author_account_id, m.at_unix_ms, m.blocks FROM messages m @@ -593,7 +593,7 @@ func (s *Store) AnswerAsk(ctx context.Context, actor AccountID, askID string, an // second commit clobbering the first's answer. The lock makes the second // answer block until the first commits, then re-read the updated blocks // (READ COMMITTED EvalPlanQual) and layer its own answer on top, so both - // survive (SEA-1226). + // survive (RIG-1226). tx, err := s.pool.Begin(ctx) if err != nil { return Message{}, Message{}, fmt.Errorf("store: begin answer ask: %w", err) diff --git a/go/internal/store/messages_authored_update_test.go b/go/internal/store/messages_authored_update_test.go index bb62894d6..4432c865c 100644 --- a/go/internal/store/messages_authored_update_test.go +++ b/go/internal/store/messages_authored_update_test.go @@ -3,7 +3,7 @@ package store // UpdateMessageBlocksAsAuthor: the AUTHORIZING block-update path, the store leg -// of the relayed-agent-input write-through (SEA-1364 T3). Its whole reason to +// of the relayed-agent-input write-through (RIG-1364 T3). Its whole reason to // exist is that updateMessageBlocksExec takes a bare MessageID and // performs NO membership or authorship check — safe for AnswerAsk, which has // already gated on the actor's visible set, but a privilege hole on a path whose diff --git a/go/internal/store/messages_snapshot_test.go b/go/internal/store/messages_snapshot_test.go index 6245dfca3..d8b6424d0 100644 --- a/go/internal/store/messages_snapshot_test.go +++ b/go/internal/store/messages_snapshot_test.go @@ -18,7 +18,7 @@ import ( // exactly the seq of the Kth message. The tests therefore assert on the stable, // exposed message IDs + counts rather than raw seq. -// TestListMessagesSnapshotSeqBoundsPage is the SEA-1333 red-first regression: +// TestListMessagesSnapshotSeqBoundsPage is the RIG-1333 red-first regression: // ListMessages must honor Page.SnapshotSeq as a point-in-time read boundary, // returning only messages with seq <= SnapshotSeq (comms.proto:353-368, // design.md:807-817). Today the field is accepted and ignored by the query, so @@ -108,7 +108,7 @@ func TestListMessagesSnapshotSeqBoundsPage(t *testing.T) { // boundary at seq 4, rows seq 5..8 that are fully committed before the read // never appear on any page, every boundary row appears exactly once, and no id // spans two pages (design.md:807-817). The `written` handshake makes this -// deterministic (SEA-1226 start-barrier + WaitGroup style, NO sleeps): the +// deterministic (RIG-1226 start-barrier + WaitGroup style, NO sleeps): the // writer appends seq 5..8 and closes `written`, and the reader waits on it // before paging, so the store provably holds those later rows at read time — // a build ignoring the boundary provably leaks them. The handshake serializes @@ -147,7 +147,7 @@ func TestListMessagesSnapshotSeqExcludesConcurrentWrites(t *testing.T) { // Goroutine A pages the catch-up under the boundary (page size 2, two pages), // unioning the ids it collects. Goroutine B appends new messages that get // seq > 4 and must never appear in A's view. Both release off one start - // barrier (SEA-1226 style). For a deterministic RED with no sleeps, B closes + // barrier (RIG-1226 style). For a deterministic RED with no sleeps, B closes // `written` once its appends have COMMITTED and A waits on it before paging: // this guarantees the seq>4 rows exist in the store at read time, so a build // that ignores the boundary provably leaks them, while the filtered build @@ -248,7 +248,7 @@ func idsOfMsgs(ms []Message) []MessageID { return out } -// TestSearchMessagesSnapshotSeqBoundsResults is the SEA-1333 red-first +// TestSearchMessagesSnapshotSeqBoundsResults is the RIG-1333 red-first // regression for SearchMessages: a bounded search returns only matches with // seq <= SnapshotSeq. SearchMessages orders by ts_rank then seq DESC, so the // assertion is on the id-SET membership + count, not strict order. RED until diff --git a/go/internal/store/messages_test.go b/go/internal/store/messages_test.go index 495905c1a..c69b9dfce 100644 --- a/go/internal/store/messages_test.go +++ b/go/internal/store/messages_test.go @@ -774,7 +774,7 @@ func TestAnswerAskNonexistentNotFound(t *testing.T) { } // TestAnswerAskValidation pins the reject arm of the atomic-answer contract the -// SEA-1243 reshape ratifies (record §"Server-side answer validation"): coverage +// RIG-1243 reshape ratifies (record §"Server-side answer validation"): coverage // must be EXACT (contract 3 — no unknown qid, no repeated qid, no gap) and each // covered answer must respect its question's option set and arity (contract 5 — // single-select arity, option-not-offered, duplicate option). Every listed @@ -882,7 +882,7 @@ func TestAnswerAskEmptySkipSatisfiesCoverage(t *testing.T) { } } -// TestAnswerAskRejectsReAnswer pins Fork 2 (SEA-1243): an ask is answered +// TestAnswerAskRejectsReAnswer pins Fork 2 (RIG-1243): an ask is answered // EXACTLY ONCE. The first answer persists and flips the Ask.Answered flag; a // second answer — even a different one — is rejected with ErrConflict rather // than silently overwriting the recorded answer. The trailing read proves the @@ -1007,7 +1007,7 @@ func TestAnswerAskRejectsDuplicateOption(t *testing.T) { } } -// TestAnswerAskConcurrentDistinctAsksSerialize is the SEA-1226 red-first +// TestAnswerAskConcurrentDistinctAsksSerialize is the RIG-1226 red-first // regression: two distinct asks on ONE message answered concurrently. AnswerAsk // reads the whole block set, records its answer on its own ask in that snapshot, // and writes ALL blocks back (updateMessageBlocksExec) — so an unserialized @@ -1041,14 +1041,14 @@ func TestAnswerAskConcurrentDistinctAsksSerialize(t *testing.T) { close(start) wg.Wait() - // Both answers must be durable. Under the SEA-1226 lost-update the later + // Both answers must be durable. Under the RIG-1226 lost-update the later // write's stale block snapshot overwrites the earlier answer, so one of // these reads back empty. if got := answeredAsk(t, ctx, s, author.ID, ch.ID, "ask-x"); !reflect.DeepEqual(got, []string{"opt-a"}) { - t.Fatalf("ask-x chosen = %v, want [opt-a] (lost update: SEA-1226)", got) + t.Fatalf("ask-x chosen = %v, want [opt-a] (lost update: RIG-1226)", got) } if got := answeredAsk(t, ctx, s, author.ID, ch.ID, "ask-y"); !reflect.DeepEqual(got, []string{"opt-b"}) { - t.Fatalf("ask-y chosen = %v, want [opt-b] (lost update: SEA-1226)", got) + t.Fatalf("ask-y chosen = %v, want [opt-b] (lost update: RIG-1226)", got) } } @@ -1130,7 +1130,7 @@ func TestAnswerAskConcurrentSameAskOneConflict(t *testing.T) { } // TestAppendMessageRejectsMalformedAsk pins the marshal-totality half of the -// SEA-1243 ask invariant (contract 1; blocks.go validateAskQuestions, fired at +// RIG-1243 ask invariant (contract 1; blocks.go validateAskQuestions, fired at // AppendMessage via marshalBlocks): an ask block is ErrInvalidArgument if it // carries zero questions, any empty question_id, or a duplicate question_id // within the ask — a duplicate or empty key would make an AskQuestionAnswer @@ -1205,7 +1205,7 @@ func TestListMessagesFailsLoudOnZeroQuestionAsk(t *testing.T) { } // TestListMessagesFailsLoudOnEmptyQuestionID pins the read-back half of the -// SEA-1243 question_id totality invariant (Greptile P1): the write path +// RIG-1243 question_id totality invariant (Greptile P1): the write path // (validateAskQuestions, blocks.go:95) rejects an empty question_id, but the // read path (unmarshalBlocks, blocks.go:170) today only rejects ZERO-question // asks — a stored ask whose single question has an empty question_id survives diff --git a/go/internal/store/migrations/0001_init.sql b/go/internal/store/migrations/0001_init.sql index 5d57e5b6f..9e0b6c1e5 100644 --- a/go/internal/store/migrations/0001_init.sql +++ b/go/internal/store/migrations/0001_init.sql @@ -60,7 +60,7 @@ CREATE TABLE user_accounts ( -- under its children. Same-owner and no-cycle are validated server-side on every -- write, not by the schema — the FK only guarantees the referent exists and is -- an agent account. INVARIANT: every write of parent_agent_id must invoke the --- registered coordination hook (SEA-1722 T5) — the manager-comms coordination +-- registered coordination hook (RIG-1722 T5) — the manager-comms coordination -- channel is auto-provisioned/reconciled from this edge, so a writer that sets -- it without invoking the hook (store.CreateAgent, store.ReparentAgent) leaves -- the tree and channel state divergent. @@ -124,7 +124,7 @@ CREATE INDEX channel_groups_owner_idx ON channel_groups (owner_user_id); -- A named conversation in a group (group_id NULL = ungrouped, owner-scoped). -- kind is 0 channel / 1 DM / 2 GROUP_DM. Membership lives in channel_members. -- --- Channel-policy fields (0014, SEA-1722 T4): post_policy mirrors the +-- Channel-policy fields (0014, RIG-1722 T4): post_policy mirrors the -- ChannelPostPolicy enum — 0 OPEN (any member may post, default), 1 OWNER_ONLY -- (only owner_account_id may post). owner_account_id is the owner/operator -- account for policy operations; NULL leaves the channel unowned (the only legal @@ -323,7 +323,7 @@ CREATE TABLE tokens ( CREATE INDEX tokens_subject_idx ON tokens (subject_kind, subject_id); -- ── Secrets names registry ────────────────────────────────────────────────── --- The Server-side secrets NAMES registry (SEA-1327 T3): the DECLARED set of +-- The Server-side secrets NAMES registry (RIG-1327 T3): the DECLARED set of -- secrets — their names and how each is delivered/routed — and NOTHING about -- their values. Values live only in the SecretSpec provider (keyring/1Password/ -- Vault/…); the Server resolves them at fetch time and never persists them. @@ -366,7 +366,7 @@ CREATE TABLE secrets ( CREATE INDEX secrets_declared_by_idx ON secrets (declared_by); -- ── Agent session ownership & placement ────────────────────────────────────── --- The durable session-ownership chain (SEA-1342 / SEA-1516): SubscribeAgentSession +-- The durable session-ownership chain (RIG-1342 / RIG-1516): SubscribeAgentSession -- resolves a session_id to the home channel it must authorize the caller against, -- persisted so the resolution survives a Server restart. The chain is -- session_id -> agent_account_id -> home_channel_id (the container hop that @@ -400,7 +400,7 @@ CREATE TABLE agent_sessions ( -- direction reattach reads once it knows which agents a Runner held. CREATE INDEX agent_sessions_agent_idx ON agent_sessions (agent_account_id); --- Operational placement state (SEA-1516 reattach): where each agent runs, and +-- Operational placement state (RIG-1516 reattach): where each agent runs, and -- under what name, written at ProvisionAgentWorkspace. Deliberately NOT part of -- the authz chain — placement is where an agent runs, not who may watch it. -- PK on the agent, not a surrogate: an agent is on AT MOST ONE Runner under one @@ -430,7 +430,7 @@ CREATE INDEX agent_placements_runner_idx ON agent_placements (runner_id); CREATE UNIQUE INDEX agent_placements_container_key ON agent_placements (container_name); -- ── Agent session transcripts (two-tier store) ─────────────────────────────── --- The durable TWO-TIER transcript store (SEA-1667 T4): a Postgres HOT TAIL +-- The durable TWO-TIER transcript store (RIG-1667 T4): a Postgres HOT TAIL -- holding [latest checkpoint .. now] = the normal resume set, plus a manifest of -- the object-store COLD ARCHIVE (verbatim JSONL segments). Both tables are -- FK-rooted in agent_sessions ON DELETE RESTRICT. @@ -469,7 +469,7 @@ CREATE TABLE agent_session_archive_segments ( ); -- ── Delivery cursors ────────────────────────────────────────────────────────── --- The durable per-(agent, channel) delivery cursor (SEA-1569 T2, design record +-- The durable per-(agent, channel) delivery cursor (RIG-1569 T2, design record -- D2). One row records how far an agent has confirmed delivery on a channel, so -- a sweep after a restart / reconnect replays exactly the owed-but-unacked tail -- and never the full history. The cursor is agent-only: agent_account_id @@ -535,7 +535,7 @@ CREATE TABLE agent_activity ( ); -- ── Agent config bundle (fleet singleton) ───────────────────────────────────── --- The Server-side fleet CONFIG-BUNDLE store (SEA-1624 T1): the ONE fleet-wide +-- The Server-side fleet CONFIG-BUNDLE store (RIG-1624 T1): the ONE fleet-wide -- agent config bundle — the gzip-tarball of skills/, extensions/, and mcp/ -- material every agent materializes into its scoped config dir. Unlike secrets -- (a set of named rows), config is a SINGLETON: exactly one current bundle for @@ -559,7 +559,7 @@ CREATE TABLE agent_config_bundle ( ); -- ── Issues: the durable board issue ────────────────────────────────────────── --- The store-of-record for a Compass board issue (SEA-1728, DL-019): the +-- The store-of-record for a Compass board issue (RIG-1728, DL-019): the -- forge-derived facts a poll ingests, plus the Compass-owned machinery a board -- item carries. The forge coordinate (forge_provider, forge_host, repo, number) -- is the IDEMPOTENCY KEY (issues_coordinate_key): a re-poll UPDATES the existing @@ -601,7 +601,7 @@ CREATE UNIQUE INDEX issues_coordinate_key ON issues (forge_provider, forge_host, repo, number); -- ── Forge subscriptions & fetch cursors ────────────────────────────────────── --- The DL-053 forge-poll fetch machinery (SEA-1810). Coordinate-aligned to the +-- The DL-053 forge-poll fetch machinery (RIG-1810). Coordinate-aligned to the -- 0013 issue convention: SMALLINT provider enum + forge_host in every key. Every -- provider CHECK admits the full declared enum IN (1, 2, 3, 4) — the CHECK's job -- is "never UNSPECIFIED(0)", not gating rollout (rollout is gated by which diff --git a/go/internal/store/objectstore.go b/go/internal/store/objectstore.go index 044ef3d8f..e0c0a3f67 100644 --- a/go/internal/store/objectstore.go +++ b/go/internal/store/objectstore.go @@ -12,7 +12,7 @@ import ( ) // S3Config is the server-side, endpoint-agnostic object-store configuration for -// the archive tier (SEA-1667 T4, slice B). It mirrors the COMPASS_DATABASE_DSN +// the archive tier (RIG-1667 T4, slice B). It mirrors the COMPASS_DATABASE_DSN // flag/env precedence (cmd/compass-server/main.go): the server holds the // endpoint/bucket/credentials, the agent and Runner hold none (DL-089). It is // S3-compatible and endpoint-agnostic — the same fields drive Garage, R2, diff --git a/go/internal/store/presence_reads.go b/go/internal/store/presence_reads.go index eac931869..d2b721253 100644 --- a/go/internal/store/presence_reads.go +++ b/go/internal/store/presence_reads.go @@ -5,7 +5,7 @@ import ( "fmt" ) -// The presence component's read side (SEA-1569 T8, design record D4). Two pure +// The presence component's read side (RIG-1569 T8, design record D4). Two pure // reads back the server-side presence projection: the unanswered-authored-ask // overlay (AgentHasOpenAsk) and the shared-channel visibility predicate the // SubscribeComms edge scopes an AgentPresenceChanged by (SharesVisibleChannel). diff --git a/go/internal/store/presence_reads_test.go b/go/internal/store/presence_reads_test.go index d889663dc..66cd9e353 100644 --- a/go/internal/store/presence_reads_test.go +++ b/go/internal/store/presence_reads_test.go @@ -2,7 +2,7 @@ package store -// The presence component's read side (SEA-1569 T8, design record D4): +// The presence component's read side (RIG-1569 T8, design record D4): // AgentHasOpenAsk (the WAITING overlay input) and SharesVisibleChannel (the // AgentPresenceChanged fan-out scoping). Both are properties only a real // Postgres proves — the JSONB path-existence probe that must catch an diff --git a/go/internal/store/secrets.go b/go/internal/store/secrets.go index 99d207f48..746a6cbbb 100644 --- a/go/internal/store/secrets.go +++ b/go/internal/store/secrets.go @@ -69,7 +69,7 @@ type SecretDeclaration struct { UpdatedAt time.Time } -// DeclareSecret adds a names-only registry row (SEA-1327 T3). It stores NO +// DeclareSecret adds a names-only registry row (RIG-1327 T3). It stores NO // value — the value lives in the SecretSpec provider. name is validated against // SecretSpec's env-var-name grammar at the door (a bad name is // ErrInvalidArgument before touching Postgres, since the name becomes a diff --git a/go/internal/store/secrets_test.go b/go/internal/store/secrets_test.go index 7a2f3ac4b..bb80b9310 100644 --- a/go/internal/store/secrets_test.go +++ b/go/internal/store/secrets_test.go @@ -2,7 +2,7 @@ package store -// Secret names-registry contracts (SEA-1327 T3): the round-trip of a declared +// Secret names-registry contracts (RIG-1327 T3): the round-trip of a declared // row with its delivery/kind/provider/host/actor intact and name-ordered, the // UNIQUE conflict on a duplicate name, the door name-validation that rejects a // bad name before any row is written, the declared_by FK on an unknown actor, diff --git a/go/internal/store/store.go b/go/internal/store/store.go index f043ff2de..cfe47b9a0 100644 --- a/go/internal/store/store.go +++ b/go/internal/store/store.go @@ -35,7 +35,7 @@ const migrationLockKey int64 = 0x0C0A_5500_0000_0001 // it with Open and release it with Close. type Store struct { pool *pgxpool.Pool - // objectStore is the archive-tier object-store seam (SEA-1667 T4), injected + // objectStore is the archive-tier object-store seam (RIG-1667 T4), injected // via SetObjectStore. nil until slice B wires a real client (store tests // inject an in-memory fake); a flush against a nil store fails loudly. objectStore ObjectStore @@ -44,7 +44,7 @@ type Store struct { // tunable (lowered by tests to exercise the valve). safetyValveCapBytes int // coordinationHook is the manager-comms coordination-channel reconcile - // (SEA-1722 T5), registered by the comms layer via SetCoordinationHook at + // (RIG-1722 T5), registered by the comms layer via SetCoordinationHook at // server assembly and invoked by the two parent-edge writers (CreateAgent, // ReparentAgent) on their own tx right after writing parent_agent_id. nil // until wired (a store with no hook — every store-only test — is a no-op). diff --git a/go/internal/store/types.go b/go/internal/store/types.go index 3814853f0..466dfe28d 100644 --- a/go/internal/store/types.go +++ b/go/internal/store/types.go @@ -158,10 +158,10 @@ type AgentAccount struct { OwnerUserID AccountID // HomeChannelID is the agent's home channel, minted at creation (RT-2). HomeChannelID ChannelID - // Persona is the agent's system-prompt text, baked at creation (SEA-1571); + // Persona is the agent's system-prompt text, baked at creation (RIG-1571); // empty means no persona override. Persona string - // Role is the agent's operator-set block-0 selector (SEA-1732 T10); empty + // Role is the agent's operator-set block-0 selector (RIG-1732 T10); empty // means no role (default OMP block-0). Unlike Persona (an append overlay), // the label selects config/prompts//SYSTEM.md, delivered as the // container's customSystemPrompt. @@ -395,7 +395,7 @@ type AskQuestion struct { // pending or when the question was answered by option choice alone. CustomText string // TimedOut is true when the answer was recorded by timeout auto-selection - // rather than a participant (SEA-1310 owns whether the Compass answer path + // rather than a participant (RIG-1310 owns whether the Compass answer path // times out; this is the audit carrier either way). TimedOut bool } diff --git a/go/internal/tokenstore/keyring_test.go b/go/internal/tokenstore/keyring_test.go index af7668433..54afcf70c 100644 --- a/go/internal/tokenstore/keyring_test.go +++ b/go/internal/tokenstore/keyring_test.go @@ -109,7 +109,7 @@ func TestKeyringStoreErrNotFoundNeverFallsBack(t *testing.T) { // Once the store has bound to the keyring, a later transient keyring failure // (locked keychain, cancelled prompt, D-Bus hiccup) must PROPAGATE as an error // — never silently divert that one operation to the file fallback, which would -// split-brain the credential across backends (SEA-2009). Sharpest for Delete: a +// split-brain the credential across backends (RIG-2009). Sharpest for Delete: a // silent fallback there returns nil while the credential stays live in the // keyring. This test is red against per-call fallback, green against bind-once. func TestKeyringStoreBoundKeyringPropagatesTransientError(t *testing.T) { @@ -135,7 +135,7 @@ func TestKeyringStoreBoundKeyringPropagatesTransientError(t *testing.T) { t.Error("Write: want error on transient keyring failure, got nil (must not fall back)") } if err := s.Delete(testURL); err == nil { - t.Error("Delete: want error on transient keyring failure, got nil — a silent nil hides a live credential (SEA-2009)") + t.Error("Delete: want error on transient keyring failure, got nil — a silent nil hides a live credential (RIG-2009)") } if fallbackFileExists(t, dir) { t.Error("fallback file written after keyring bind; credential split-brained across backends") diff --git a/go/internal/tokenstore/tokenstore.go b/go/internal/tokenstore/tokenstore.go index 26f293523..6ce4559ed 100644 --- a/go/internal/tokenstore/tokenstore.go +++ b/go/internal/tokenstore/tokenstore.go @@ -1,5 +1,5 @@ // Package tokenstore persists the native-client remote bearer token, keyring -// first with an atomic 0600-file fallback (SEA-1686 T5.2, DL-109). It is keyed +// first with an atomic 0600-file fallback (RIG-1686 T5.2, DL-109). It is keyed // by the remote server URL so two remotes never collide, and — critically — the // file fallback stores the {serverURL, token} pair so a re-pointed server_url // can never replay one remote's bearer to another (the F1 replay guard, OQ-4). @@ -75,7 +75,7 @@ const probeUser = "compass-app::keyring-probe" // The choice is made once and cached, so an operational keyring failure after a // successful bind propagates as an error rather than silently diverting one // operation to the file — which would split-brain the credential across -// backends (SEA-2009). +// backends (RIG-2009). type keyringStore struct { fallback *fileStore diff --git a/go/server/agent_config_service.go b/go/server/agent_config_service.go index 486b4e1de..e8380d5ab 100644 --- a/go/server/agent_config_service.go +++ b/go/server/agent_config_service.go @@ -1,7 +1,7 @@ //go:build unix // The fleet agent-config declaration handlers — the operator-facing write path on -// CompassService (SEA-1625 T2). PutAgentConfig / DeleteAgentConfig are admin-gated +// CompassService (RIG-1625 T2). PutAgentConfig / DeleteAgentConfig are admin-gated // on the network door (admin_gate.go classifies them adminOnly); GetAgentConfigInfo // is value-free (names only) and classified authenticatedOpen. They sit on the same // service struct as the rest of CompassService (service.go) rather than a separate diff --git a/go/server/agent_config_service_pgtest_test.go b/go/server/agent_config_service_pgtest_test.go index 9b2bd4cb0..47cbf9ff1 100644 --- a/go/server/agent_config_service_pgtest_test.go +++ b/go/server/agent_config_service_pgtest_test.go @@ -2,7 +2,7 @@ package server -// Store-gated CompassService config-declaration handler contracts (SEA-1625 T2): +// Store-gated CompassService config-declaration handler contracts (RIG-1625 T2): // PutAgentConfig persists + returns the store version and emits a ConfigVersion // signal carrying that version; GetAgentConfigInfo returns an empty-but-valid // response on an unconfigured fleet and the bucketed member NAMES (never content) diff --git a/go/server/comms_actor_pgtest_test.go b/go/server/comms_actor_pgtest_test.go index 559b612a2..49a524eb7 100644 --- a/go/server/comms_actor_pgtest_test.go +++ b/go/server/comms_actor_pgtest_test.go @@ -2,7 +2,7 @@ package server -// Comms-actor attribution over the authenticated network door (SEA-1195 T3b). +// Comms-actor attribution over the authenticated network door (RIG-1195 T3b). // The isolated auth-package test (internal/auth/interceptor_pgtest_test.go's // TestBearerInterceptorSetsCommsActorNotAdminFallback) proves withCaller sets the // comms actor when driven through a hand-built BearerInterceptor; it cannot prove diff --git a/go/server/cors_pgtest_test.go b/go/server/cors_pgtest_test.go index 2e941fb2e..8a4abb9f8 100644 --- a/go/server/cors_pgtest_test.go +++ b/go/server/cors_pgtest_test.go @@ -2,7 +2,7 @@ package server -// Integration test for the network door's CORS policy (SEA-1195 T3b), pinning +// Integration test for the network door's CORS policy (RIG-1195 T3b), pinning // the spec Requirement "The network door defaults closed to browser origins" // (docs/specs/product/compass.md:693-707): unless --cors-allowed-origin names a // single explicit browser origin the door applies NO CORS at all; when set it diff --git a/go/server/dev_door_pgtest_test.go b/go/server/dev_door_pgtest_test.go index 68dc17651..ddf38c62f 100644 --- a/go/server/dev_door_pgtest_test.go +++ b/go/server/dev_door_pgtest_test.go @@ -2,7 +2,7 @@ package server -// P1 dev-door regression test (SEA-1195 T3b, security-critical) — pins the +// P1 dev-door regression test (RIG-1195 T3b, security-critical) — pins the // closed hole from the Greptile finding "Dev Door Can Mint Admin Tokens". The // dev-only loopback endpoint (--dev-http) mounts CompassService behind // auth.NewAdminGate with NO bearer interceptor, so there is never an diff --git a/go/server/forge_notify_matrix_test.go b/go/server/forge_notify_matrix_test.go index 014e61a2f..677530c92 100644 --- a/go/server/forge_notify_matrix_test.go +++ b/go/server/forge_notify_matrix_test.go @@ -213,15 +213,15 @@ func TestForgeWebhookMatrix_LinearIngress(t *testing.T) { } t.Run("issue create (OPENED, project carried)", func(t *testing.T) { - ev, ok := parse(t, ln.openIssue(t, 5, "https://linear.app/rigel/SEA-5")) + ev, ok := parse(t, ln.openIssue(t, 5, "https://linear.app/rigel/RIG-5")) if !ok { t.Fatal("ok = false, want true") } - assertEvent(t, ev, wantEvent{provider: compassv1.ForgeProvider_FORGE_PROVIDER_LINEAR, kind: mxIssue, number: 5, change: mxOpened, url: "https://linear.app/rigel/SEA-5", project: "proj-alpha"}) + assertEvent(t, ev, wantEvent{provider: compassv1.ForgeProvider_FORGE_PROVIDER_LINEAR, kind: mxIssue, number: 5, change: mxOpened, url: "https://linear.app/rigel/RIG-5", project: "proj-alpha"}) }) t.Run("issue state change (STATE)", func(t *testing.T) { - ev, ok := parse(t, ln.changeIssueState(t, 5, "https://linear.app/rigel/SEA-5", "completed")) + ev, ok := parse(t, ln.changeIssueState(t, 5, "https://linear.app/rigel/RIG-5", "completed")) if !ok { t.Fatal("ok = false, want true") } @@ -231,7 +231,7 @@ func TestForgeWebhookMatrix_LinearIngress(t *testing.T) { }) t.Run("issue edit no-state (UPDATE)", func(t *testing.T) { - ev, ok := parse(t, ln.editIssue(t, 5, "https://linear.app/rigel/SEA-5")) + ev, ok := parse(t, ln.editIssue(t, 5, "https://linear.app/rigel/RIG-5")) if !ok { t.Fatal("ok = false, want true") } @@ -239,15 +239,15 @@ func TestForgeWebhookMatrix_LinearIngress(t *testing.T) { }) t.Run("comment create (COMMENT)", func(t *testing.T) { - ev, ok := parse(t, ln.commentOnIssue(t, 5, "https://linear.app/rigel/SEA-5", "a comment", "matt")) + ev, ok := parse(t, ln.commentOnIssue(t, 5, "https://linear.app/rigel/RIG-5", "a comment", "matt")) if !ok { t.Fatal("ok = false, want true") } - assertEvent(t, ev, wantEvent{provider: compassv1.ForgeProvider_FORGE_PROVIDER_LINEAR, kind: mxIssue, number: 5, change: mxComment, url: "https://linear.app/rigel/SEA-5", comment: true, forgeAccount: "matt", project: "proj-alpha"}) + assertEvent(t, ev, wantEvent{provider: compassv1.ForgeProvider_FORGE_PROVIDER_LINEAR, kind: mxIssue, number: 5, change: mxComment, url: "https://linear.app/rigel/RIG-5", comment: true, forgeAccount: "matt", project: "proj-alpha"}) }) t.Run("issue remove (counted-and-dropped, ok=false)", func(t *testing.T) { - _, ok := parse(t, ln.removeIssue(t, 5, "https://linear.app/rigel/SEA-5")) + _, ok := parse(t, ln.removeIssue(t, 5, "https://linear.app/rigel/RIG-5")) if ok { t.Error("ok = true, want false (remove has no notification kind)") } diff --git a/go/server/lifecycle_e2e_pgtest_test.go b/go/server/lifecycle_e2e_pgtest_test.go index ebf20a027..939feddb8 100644 --- a/go/server/lifecycle_e2e_pgtest_test.go +++ b/go/server/lifecycle_e2e_pgtest_test.go @@ -2,7 +2,7 @@ package server -// End-to-end T7 of the FROZEN spawn/despawn design (SEA-1617 / record SEA-1360): +// End-to-end T7 of the FROZEN spawn/despawn design (RIG-1617 / record RIG-1360): // the WHOLE agent-initiated spawn/despawn wire, driven over a REAL per-container // AgentGateway unix socket against a real Postgres + a real Runner-over-stub- // engine. Where lifecycle_pgtest_test.go (T5) drives the lifecycleService seam @@ -488,7 +488,7 @@ type e2eWire struct { // below. func newE2EWire(t *testing.T) *e2eWire { t.Helper() - dsn := pgtest.RequireDSN(t) // hard-fails on infra-missing (SEA-1523), never skips silently. + dsn := pgtest.RequireDSN(t) // hard-fails on infra-missing (RIG-1523), never skips silently. // First cleanup registered, so LIFO removes the tree LAST — after the loop's // drain and the host's socket close have both run (see below). runtimeDir := runnertest.ShortRuntimeDir(t, e2eNamePrefix, e2eAccountIDHexLen) diff --git a/go/server/network_door.go b/go/server/network_door.go index 430571769..84470c7fd 100644 --- a/go/server/network_door.go +++ b/go/server/network_door.go @@ -167,7 +167,7 @@ const networkBodyReadTimeout = 30 * time.Second // the request), and RunnerService.Enroll (unary) — has a bounded request body, // so the deadline protects them without ever cutting a legitimate call. // -// Residual risk (accepted, tracked as a SEA-1298 follow-up): the exemption is +// Residual risk (accepted, tracked as a RIG-1298 follow-up): the exemption is // keyed on r.URL.Path and applied before authentication, so an UNAUTHENTICATED // client can still slow-drip a request body to these two paths with no deadline // armed. The bearer interceptor rejects it on the headers, but the HTTP-layer @@ -182,7 +182,7 @@ var bodyDeadlineExempt = map[string]struct{}{ } // withBodyReadDeadline wraps the network-door handler to close the slow-body DoS -// window that ReadHeaderTimeout leaves open (SEA-1298): it sets a per-request +// window that ReadHeaderTimeout leaves open (RIG-1298): it sets a per-request // read deadline via http.ResponseController, so a client that sends headers // promptly then drips the body no longer ties up a connection. The deadline is // per-HTTP/2-stream (Go 1.20+ SetReadDeadline semantics), so one slow request @@ -304,7 +304,7 @@ func buildNetworkServer( netRoot = networkCORS(cfg.CORSAllowedOrigin).Handler(netMux) } // Outermost: bound the request-body read so a slow-body drip cannot tie up - // a connection (SEA-1298). Wraps whatever netRoot is above (CORS or the bare + // a connection (RIG-1298). Wraps whatever netRoot is above (CORS or the bare // mux) at the HTTP-body layer; the long-lived Runner request streams are // exempt (bodyDeadlineExempt). netRoot = withBodyReadDeadline(netRoot, networkBodyReadTimeout) @@ -316,7 +316,7 @@ func buildNetworkServer( // header read and idle connection lifetime to close the slow-loris DoS // window (the UDS/dev doors are loopback/local). The request-body half // of that window (a client that sends headers promptly then drips the - // body, SEA-1298) is closed by withBodyReadDeadline above rather than a + // body, RIG-1298) is closed by withBodyReadDeadline above rather than a // blunt http.Server.ReadTimeout: a ReadTimeout caps the whole request // lifetime and would kill the long-lived Runner request streams, so the // body deadline is applied per-request and skips those (bodyDeadlineExempt). diff --git a/go/server/network_door_deadline_test.go b/go/server/network_door_deadline_test.go index ea8cfe29c..52d2b6ffd 100644 --- a/go/server/network_door_deadline_test.go +++ b/go/server/network_door_deadline_test.go @@ -2,7 +2,7 @@ package server -// SEA-1298 — the network door's slow-body (slowloris) read deadline. +// RIG-1298 — the network door's slow-body (slowloris) read deadline. // // withBodyReadDeadline is the outermost network-door middleware: for every // request whose path is NOT in bodyDeadlineExempt it arms a per-request diff --git a/go/server/network_door_proxy_bypass_pgtest_test.go b/go/server/network_door_proxy_bypass_pgtest_test.go index 4d99bfcea..fc5ee680e 100644 --- a/go/server/network_door_proxy_bypass_pgtest_test.go +++ b/go/server/network_door_proxy_bypass_pgtest_test.go @@ -2,7 +2,7 @@ package server -// Auth-door COMPOSITION tests (SEA-1946): proof that the authenticated +// Auth-door COMPOSITION tests (RIG-1946): proof that the authenticated // network door derives caller identity ONLY from the Authorization: Bearer // credential resolved against the store, and NEVER from any proxy-injected // header. The Compass Bridge will be fronted by `tailscale serve` (a reverse diff --git a/go/server/network_door_test.go b/go/server/network_door_test.go index 78b0d4778..008018ab5 100644 --- a/go/server/network_door_test.go +++ b/go/server/network_door_test.go @@ -2,7 +2,7 @@ package server -// Integration tests for the authenticated TLS network door (SEA-1195 T3b): TLS +// Integration tests for the authenticated TLS network door (RIG-1195 T3b): TLS // termination against an in-test self-signed pair, the bearer+admin-gate chain // over a real connect client, the IssueToken handler's input contract, the // oracle-safety of the bearer rejection paths, and the bootstrap-admin token's diff --git a/go/server/runner_enroll_compose_pgtest_test.go b/go/server/runner_enroll_compose_pgtest_test.go index 9a33114d7..6b20ca5ff 100644 --- a/go/server/runner_enroll_compose_pgtest_test.go +++ b/go/server/runner_enroll_compose_pgtest_test.go @@ -2,7 +2,7 @@ package server -// Whole-flow composition of the Server<->Runner enrollment seam (SEA-1914 S2, +// Whole-flow composition of the Server<->Runner enrollment seam (RIG-1914 S2, // DL-178). This is the one seam no suite on main composes: a REAL Runner (the // production internal/runner.Dial client) enrolling through the PRODUCTION // RunnerService door — the one buildNetworkServer mounts behind its Runner-subject diff --git a/go/server/secrets_service.go b/go/server/secrets_service.go index d5613dfd3..d4eaf558a 100644 --- a/go/server/secrets_service.go +++ b/go/server/secrets_service.go @@ -1,7 +1,7 @@ //go:build unix // The SecretsService implementation — the account-facing side of the compass.v1 -// secrets contract (SEA-1327 T7). It sits beside CompassService/CommsService on +// secrets contract (RIG-1327 T7). It sits beside CompassService/CommsService on // the same account doors (socket + dev + network), behind the bearer + admin-gate // interceptors that classify the three procedures authenticatedOpen (admin_gate.go): // the door admits any authenticated account and THIS handler enforces the fine diff --git a/go/server/serve.go b/go/server/serve.go index 90521a50a..f69cf9681 100644 --- a/go/server/serve.go +++ b/go/server/serve.go @@ -72,7 +72,7 @@ type ServeConfig struct { // (T1). Required: the comms vertical is store-backed, so Serve opens the // store at startup and refuses to serve without it. DatabaseDSN string - // S3 is the object-store archive tier config (SEA-1667 T4). Optional: when + // S3 is the object-store archive tier config (RIG-1667 T4). Optional: when // unset (no endpoint/bucket) the server boots without an archive tier and the // store's nil object-store guard fails a flush loudly only if one is ever // attempted. Mirrors the DATABASE_DSN flag/env precedence at the CLI. @@ -103,14 +103,14 @@ type ServeConfig struct { // consumes Linear webhooks needs it non-empty, enforced by deepLinkFor's // boot guard where the responder is assembled. PublicURL string - // Forge is the board-ingestion poll driver config (SEA-1810). All-optional + // Forge is the board-ingestion poll driver config (RIG-1810). All-optional // exactly like S3: forge polling disabled (empty SeedRepos, Poll false) // leaves the driver off — today's behavior, zero new requirements on // existing deployments. See ForgeConfig and forgePollingEnabled. Forge ForgeConfig } -// ForgeConfig configures the board-ingestion poll driver (SEA-1810, DL-053). +// ForgeConfig configures the board-ingestion poll driver (RIG-1810, DL-053). // All-optional: polling is disabled (empty SeedRepos and Poll false) unless the // operator opts in, leaving the driver off (today's behavior). The 0016 tables // exist but sit empty — a migration is not a behavior change. @@ -259,7 +259,7 @@ func secretsStateDir(cfg ServeConfig) string { return filepath.Join(base, "secrets") } -// openStore opens the store of record and wires the SEA-1667 T4 object-store +// openStore opens the store of record and wires the RIG-1667 T4 object-store // archive seam onto it. When the S3 config is ABSENT (no endpoint/bucket) the // seam is left nil and the server boots socket-only — the store's nil-guard // fails a flush loudly only if one is ever attempted, so a dev server with no @@ -388,7 +388,7 @@ func Serve(ctx context.Context, cfg ServeConfig) error { publishReady(bus) // The store of record (T1) backs the comms vertical and the token store, and - // carries the SEA-1667 T4 object-store archive seam. Open it before serving so + // carries the RIG-1667 T4 object-store archive seam. Open it before serving so // a bad DSN, a failed migration, or a bad S3 config fails startup here, not // mid-request. st, err := openStore(ctx, cfg) @@ -458,7 +458,7 @@ func Serve(ctx context.Context, cfg ServeConfig) error { commsPath, commsHandler := compassv1connect.NewCommsServiceHandler(commsSvc) // Register the coordination-channel reconcile as the store's in-tx hook, so // the two parent-edge writers auto-provision/reconcile a manager's - // coordination channel atomically with the tree edge (SEA-1722 T5). Wired here + // coordination channel atomically with the tree edge (RIG-1722 T5). Wired here // before serving; the store invokes it on its own tx. commsSvc.RegisterCoordinationHook(st) @@ -480,11 +480,11 @@ func Serve(ctx context.Context, cfg ServeConfig) error { hubLog := slog.Default() hub := newRunnerHub(st, brd, tail, commsSvc, hubLog) svc := newService(cfg.Version, bus, st, hub, brd, issueBrd, tail) - // Break the hub<->lifecycle (SEA-1618 T5), hub<->board (agent primary - // lifecycle T3-a, RelayBoardCall), and comms<->hub ask-answer wake (SEA-1577) + // Break the hub<->lifecycle (RIG-1618 T5), hub<->board (agent primary + // lifecycle T3-a, RelayBoardCall), and comms<->hub ask-answer wake (RIG-1577) // construction cycles; see wireHubServiceCycles in sinks.go. wireHubServiceCycles(hub, commsSvc, st, issueBrd) - // Seed the root Manager "supervisor" on first launch (SEA-1820). The seed + // Seed the root Manager "supervisor" on first launch (RIG-1820). The seed // needs a Runner whose command stream can serve Provision/Start, which is not // up at boot — the embedded stack starts the Runner only after the server is // serving, and its command stream attaches only after it enrolls — so it @@ -513,7 +513,7 @@ func Serve(ctx context.Context, cfg ServeConfig) error { return err } - // The board-ingestion poll driver (SEA-1810, DL-053) and the agent forge-WRITE + // The board-ingestion poll driver (RIG-1810, DL-053) and the agent forge-WRITE // path (T8) are the two forge startup phases; see wireForgePollDriver and // wireForgeWriteCaller. Both fail fast HERE, on the same udsListener.Close()+ // listeners.close() cleanup path the Rehydrate fault above uses. @@ -548,14 +548,14 @@ func Serve(ctx context.Context, cfg ServeConfig) error { return classifyServe(doors.net.ServeTLS(netListener, "", ""), "compass.v1 network door") }) } - // The forge poll driver (SEA-1810), one more member of the same scoped group + // The forge poll driver (RIG-1810), one more member of the same scoped group // so it inherits exactly the doors' lifecycle: cancelled on SIGINT/SIGTERM // via gctx, first-error-wins, drained with everything else. nil when forge // polling is disabled. Run returns nil on ctx-cancel (clean shutdown). if forgeDriver != nil { g.Go(func() error { return forgeDriver.Run(gctx) }) } - // The comms-bus consumers (SEA-1569): the T3 delivery fan-out consumer and + // The comms-bus consumers (RIG-1569): the T3 delivery fan-out consumer and // the T8 presence projection, both tailing the comms bus with their bus-tail // goroutines on the serve group rooted on gctx (cancels at shutdown; each also // ends when the comms bus closes in drainDoors). @@ -786,7 +786,7 @@ func classifyServe(err error, ctx string) error { return fmt.Errorf("%s terminated with an error: %w", ctx, err) } -// buildForgeDriver wires the SEA-1810 board-ingestion poll driver into boot. The +// buildForgeDriver wires the RIG-1810 board-ingestion poll driver into boot. The // caller builds it ONLY when forge polling is enabled (the disabled path — one // Warn if enabled rows exist — is handled in Serve), so this always returns a // live driver or a startup error. In order it: (1) resolves the forge secret @@ -840,7 +840,7 @@ func buildForgeDriver( }), nil } -// wireForgePollDriver builds the board-ingestion poll driver (SEA-1810, DL-053) +// wireForgePollDriver builds the board-ingestion poll driver (RIG-1810, DL-053) // when forge polling is enabled (Poll || a non-empty seed), else returns a nil // driver after emitting one Warn if the table already holds enabled rows for the // bound (provider, host). Its startup secret resolve and seed reconcile fail diff --git a/go/server/serve_admin_handle_pgtest_test.go b/go/server/serve_admin_handle_pgtest_test.go index e2e90135a..3889c0729 100644 --- a/go/server/serve_admin_handle_pgtest_test.go +++ b/go/server/serve_admin_handle_pgtest_test.go @@ -2,7 +2,7 @@ package server -// The --admin-handle wiring (SEA-1362 T1): the operator-settable bootstrap-admin +// The --admin-handle wiring (RIG-1362 T1): the operator-settable bootstrap-admin // handle must actually name the created account, not merely a log field. These // tests OBSERVE the account the store minted — a round-trip of the flag into // ServeConfig is necessary but not sufficient, because an inert knob round-trips diff --git a/go/server/serve_forge_pgtest_test.go b/go/server/serve_forge_pgtest_test.go index b96c3d82f..c1b33480f 100644 --- a/go/server/serve_forge_pgtest_test.go +++ b/go/server/serve_forge_pgtest_test.go @@ -2,7 +2,7 @@ package server -// Store-gated end-to-end proofs for the SEA-1810 forge boot wiring: the pieces +// Store-gated end-to-end proofs for the RIG-1810 forge boot wiring: the pieces // buildForgeDriver assembles (the forgePollStore adapter over a real *store.Store, // the shared IssueProjection sink, ingest.NewDriver) driven over a FAKE pager // against a REAL Postgres — no live GitHub. Behind `pgtest && unix` (SKIP when no diff --git a/go/server/serve_forge_test.go b/go/server/serve_forge_test.go index 6cc59d89a..2e049cc88 100644 --- a/go/server/serve_forge_test.go +++ b/go/server/serve_forge_test.go @@ -2,7 +2,7 @@ package server -// DB-free unit tests for the SEA-1810 forge wiring that need no Postgres: the +// DB-free unit tests for the RIG-1810 forge wiring that need no Postgres: the // ForgeConfig enable predicate + defaulting, the TTL-caching TokenSource // (record test 6), and the two distinct startup secret-validation error texts // (record test 7's discriminability — validateForgeSecret is a pure function of diff --git a/go/server/serve_pgtest_test.go b/go/server/serve_pgtest_test.go index a516c23e0..02d7b306c 100644 --- a/go/server/serve_pgtest_test.go +++ b/go/server/serve_pgtest_test.go @@ -89,7 +89,7 @@ func TestServeShutdownIsClean(t *testing.T) { // // The drain-deadline-overrun path (a wedged slow-client stream) is not // forced here: making it deterministic needs a handler stalled mid-replay, - // tracked separately in SEA-1263. Forcing a server self-exit error cleanly + // tracked separately in RIG-1263. Forcing a server self-exit error cleanly // is likewise not deterministic from this harness (both servers exit only on // ctx cancel or a bind fault that Serve rejects up front), so that sub-case // is intentionally omitted rather than added as a flaky test. diff --git a/go/server/serve_seed.go b/go/server/serve_seed.go index 4423b7e83..2a650ac2d 100644 --- a/go/server/serve_seed.go +++ b/go/server/serve_seed.go @@ -19,7 +19,7 @@ import ( // The root Manager seeded on first launch. A fixed handle so the empty-tree gate // and CreateAgent's unique-handle constraint together make the seed idempotent; // role "manager" selects config/prompts/manager/SYSTEM.md as the container's -// block-0 prompt (SEA-1732), which is what makes the seeded agent a real Manager +// block-0 prompt (RIG-1732), which is what makes the seeded agent a real Manager // rather than a default agent. const ( rootSupervisorHandle = "supervisor" @@ -81,7 +81,7 @@ var setupThreadBody string // the Runner — even if the session actually died with a restarted Runner. Real // liveness-checked re-drive (consult the Runner's authoritative live set, spawn // under a fresh key when the cached session is gone) is tracked as a follow-up; -// SEA-1820 covers first-launch seed and the never-started re-drive above. +// RIG-1820 covers first-launch seed and the never-started re-drive above. // // A failure is logged, not fatal: the server stays up and the next Runner // reconnect re-fires the seed. diff --git a/go/server/service.go b/go/server/service.go index e3789fff2..d49ea0683 100644 --- a/go/server/service.go +++ b/go/server/service.go @@ -180,7 +180,7 @@ func (s *service) ProvisionAgentWorkspace( // it, the container -> account mapping lived only in the RunnerHub's // in-memory binding, so a Server restart or Runner re-enroll between // Provision and Start left StartAgentSession unable to say whose session it - // was recording. It is also what SEA-1516 reattach recovery reads to name + // was recording. It is also what RIG-1516 reattach recovery reads to name // every agent stranded by a Runner restart. if err := s.store.RecordAgentPlacement(ctx, store.AccountID(req.Msg.GetAgentAccountId()), runnerID, resp.GetContainerName()); err != nil { return nil, connect.NewError(connect.CodeInternal, fmt.Errorf("recording agent placement: %w", err)) @@ -273,7 +273,7 @@ func (s *service) StopAgentSession( if err != nil { return nil, err } - // SEA-1667 T4 session-end flush (the third flush trigger, design.md §1040-1046): + // RIG-1667 T4 session-end flush (the third flush trigger, design.md §1040-1046): // archive the remaining hot-tail as one session_end segment so history is // COMPLETE for analytics. It does NOT prune the PG tail and is NEVER read on // resume. BEST-EFFORT: the Stop relay already irreversibly killed the agent, so @@ -565,7 +565,7 @@ func (s *service) SubscribeAgentSession( } } -// startResumeSession is the resume leg of StartAgentSession (T6, SEA-1667). It +// startResumeSession is the resume leg of StartAgentSession (T6, RIG-1667). It // runs BEFORE any Runner call for the parts that must: (1) authorize the caller // on the resumed session via RequireAgentSessionSubscriber — an unknown or // foreign resume_session_id is one indistinguishable NotFound (the diff --git a/go/server/service_placement_pgtest_test.go b/go/server/service_placement_pgtest_test.go index 3fe6ebc79..4375faf3b 100644 --- a/go/server/service_placement_pgtest_test.go +++ b/go/server/service_placement_pgtest_test.go @@ -647,7 +647,7 @@ type recordingRunner struct { // failStart, when set, makes the loop answer every Start with a RunnerError // (ALREADY_RUNNING) instead of a session id — the mid-chain failure the - // spawn-rollback test drives (SEA-1618 T5). Set under mu before the command + // spawn-rollback test drives (RIG-1618 T5). Set under mu before the command // is driven, read under mu in serve, so -race sees a clean handoff. failStart bool @@ -704,7 +704,7 @@ func (r *recordingRunner) serve( } } if cmd.GetDeliverControl() != nil { - // A send-only control deliver (SEA-1569 §5): a real Runner answers a + // A send-only control deliver (RIG-1569 §5): a real Runner answers a // SUCCESSFUL deliver with NO result (success rides a later // delivery_ack), so record it and send nothing — the RIG-1641 T4 e2e // observes the pushed steer/deliver as this recorded wire command. diff --git a/go/server/service_resume_pgtest_test.go b/go/server/service_resume_pgtest_test.go index 5c16d102f..7b00d3d80 100644 --- a/go/server/service_resume_pgtest_test.go +++ b/go/server/service_resume_pgtest_test.go @@ -2,7 +2,7 @@ package server -// T6 (SEA-1667): the resume branch of StartAgentSession. When +// T6 (RIG-1667): the resume branch of StartAgentSession. When // resume_session_id is non-empty the handler (1) gates the caller via // RequireAgentSessionSubscriber BEFORE any Runner call — an unknown or foreign // id is NotFound and no Start is ever pushed; (2) BindLifetime write-once to diff --git a/go/server/service_sessionend_pgtest_test.go b/go/server/service_sessionend_pgtest_test.go index b1c35ed05..1e51a9fe5 100644 --- a/go/server/service_sessionend_pgtest_test.go +++ b/go/server/service_sessionend_pgtest_test.go @@ -2,7 +2,7 @@ package server -// The SEA-1667 T4 session-end flush trigger (the third of three, design.md +// The RIG-1667 T4 session-end flush trigger (the third of three, design.md // §1040-1046), driven through the real StopAgentSession handler against a real // Postgres and a real Runner door. On a successful Stop the handler archives the // session's remaining hot-tail as ONE session_end segment so history is complete diff --git a/go/server/sinks.go b/go/server/sinks.go index 20a9abca2..c42cebe90 100644 --- a/go/server/sinks.go +++ b/go/server/sinks.go @@ -51,7 +51,7 @@ import ( // comms — the CommsService handler, which executes an agent-initiated comms call // under the account a session resolves to (RelayCommsCall). log carries the // hub's gap/unknown-frame diagnostics; nil falls back to slog.Default(). st is -// the store of record: the hub's durable transcript lane (SEA-1667 T4) +// the store of record: the hub's durable transcript lane (RIG-1667 T4) // write-throughs a relayed transcript_entry to it via SetTranscriptStore, wired // here so the one store instance backs the transcript commit path. func newRunnerHub(st *store.Store, brd *board.Projection, tail runnerhub.SessionTailSink, commsSvc *comms.Comms, log *slog.Logger) *runnerhub.Hub { @@ -65,7 +65,7 @@ func newRunnerHub(st *store.Store, brd *board.Projection, tail runnerhub.Session log, ) hub.SetTranscriptStore(st) - // SEA-1667 T5: the same store backs the resume-body reconstructor's read + // RIG-1667 T5: the same store backs the resume-body reconstructor's read // seam (SessionResumeSnapshot + ReadArchiveSegment), wired here beside the // write seam so the one store instance serves both legs. hub.SetTranscriptReader(st) @@ -90,13 +90,13 @@ var _ runnerhub.ForgeCaller = (*forgeService)(nil) // wireHubServiceCycles breaks the post-construction cycles between the hub and // the account-facing services that are built before it (the hub relays through // them, so they cannot take the hub at construction): the hub<->lifecycle cycle -// (SEA-1618 T5, RelayLifecycleCall) and the hub<->board cycle (agent primary +// (RIG-1618 T5, RelayLifecycleCall) and the hub<->board cycle (agent primary // lifecycle T3-a, RelayBoardCall — the board caller executes against the store + // the issue projection). Called once at assembly before any RPC is served. func wireHubServiceCycles(hub *runnerhub.Hub, commsSvc *comms.Comms, st *store.Store, issueBrd *board.IssueProjection) { hub.SetLifecycleCaller(newLifecycleService(st, hub)) hub.SetBoardCaller(newBoardService(st, issueBrd)) - // The roster read (SEA-1721 T2) joins the hub's in-memory presence enum; the + // The roster read (RIG-1721 T2) joins the hub's in-memory presence enum; the // hub in turn reads it from the T8 presence projection wired at // startPresencePublisher (hub.SetPresenceSource). comms->hub is set here (the // hub is stable and delegates lazily), hub->publisher when the publisher @@ -121,10 +121,10 @@ func (h hubPresenceSource) PresenceFor(accountIDs []store.AccountID) map[store.A return out } -// startDeliveryConsumer builds the SEA-1569 T3 fan-out consumer over the comms +// startDeliveryConsumer builds the RIG-1569 T3 fan-out consumer over the comms // bus, wires the consumer<->hub construction cycle (the consumer takes hub as // its ControlDispatcher + SessionResolver; the hub takes the consumer as its -// SettleSink AND its SessionStartSink — the reconnect sweep edge (SEA-1569 T6) — +// SettleSink AND its SessionStartSink — the reconnect sweep edge (RIG-1569 T6) — // with st as its delivery-cursor store, the post-construction // setters that break the cycle), and starts its bus-tail goroutine on the serve // group rooted on gctx (so it cancels at shutdown; it also ends when the comms @@ -145,7 +145,7 @@ func startDeliveryConsumer(gctx context.Context, g *errgroup.Group, commsBus *ev g.Go(func() error { return c.Run(gctx) }) } -// startPresencePublisher builds the SEA-1569 T8 presence projection over the +// startPresencePublisher builds the RIG-1569 T8 presence projection over the // comms bus (it both tails and publishes onto it) + the store's open-ask read // surface + the hub's Status relay for reconciliation, wires the // component<->hub construction cycle (the hub takes the component as its @@ -157,13 +157,13 @@ func startDeliveryConsumer(gctx context.Context, g *errgroup.Group, commsBus *ev func startPresencePublisher(gctx context.Context, g *errgroup.Group, commsBus *events.Bus[*compassv1.SubscribeCommsResponse], st *store.Store, hub *runnerhub.Hub, log *slog.Logger) { p := presence.NewPublisher(commsBus, st, hub, log) hub.SetPresenceSink(p) - // The roster read source (SEA-1721 T2): the hub reads the enum snapshot and + // The roster read source (RIG-1721 T2): the hub reads the enum snapshot and // fires the set_status activity publish through the same projection it feeds. hub.SetPresenceSource(p) g.Go(func() error { return p.Run(gctx) }) } -// startCommsBusConsumers starts both comms-bus consumers (SEA-1569): the T3 +// startCommsBusConsumers starts both comms-bus consumers (RIG-1569): the T3 // delivery fan-out consumer and the T8 presence projection. Serve calls this one // helper so the two starts, which share the same construction inputs (comms bus, // store, hub, serve group, gctx), stay one statement at the call site. diff --git a/packages/compass-agent/scripts/verify-abort-mutants.test.ts b/packages/compass-agent/scripts/verify-abort-mutants.test.ts index d2cae4c11..6836c13a5 100644 --- a/packages/compass-agent/scripts/verify-abort-mutants.test.ts +++ b/packages/compass-agent/scripts/verify-abort-mutants.test.ts @@ -17,7 +17,7 @@ import { /** Verbatim tail of a green `bun test` run on this package. */ const GREEN = ` src/transport/control-source.test.ts: -[compass-agent] control unmapped: control:steer — payload staged (SEA-1310) +[compass-agent] control unmapped: control:steer — payload staged (RIG-1310) 13 pass 0 fail diff --git a/packages/compass-agent/src/agent.test.ts b/packages/compass-agent/src/agent.test.ts index ee733e622..2a642fb45 100644 --- a/packages/compass-agent/src/agent.test.ts +++ b/packages/compass-agent/src/agent.test.ts @@ -646,7 +646,7 @@ describe("CompassAgent — terminal status distinguishes failure from clean stop }); // --------------------------------------------------------------------------- -// SEA-1310 §8 — RT-3 turn-end delivery (DELIVER arm). +// RIG-1310 §8 — RT-3 turn-end delivery (DELIVER arm). // // deliver() rides the immediate handle (not the control script), so these tests // construct CompassAgent directly and call `agent.deliver(msg)`, driving turn @@ -795,7 +795,7 @@ async function tick(): Promise { await Promise.resolve(); } -describe("CompassAgent — RT-3 turn-end delivery (SEA-1310 §8 deliver arm)", () => { +describe("CompassAgent — RT-3 turn-end delivery (RIG-1310 §8 deliver arm)", () => { test("mid-turn delivers coalesce into ONE turn-end prompt", async () => { const h = startDeliverAgent(); h.drive({ type: "agent_start" } as AgentSessionEvent); @@ -908,7 +908,7 @@ describe("CompassAgent — RT-3 turn-end delivery (SEA-1310 §8 deliver arm)", ( await h.close(); }); - // The high-severity race (SEA-1310 §8): a control-driven prompt sets the inner + // The high-severity race (RIG-1310 §8): a control-driven prompt sets the inner // agent streaming SYNCHRONOUSLY (pi-agent-core agent.ts:1072) but flips // `#turnActive` only later, off the async `agent_start` event. A deliver that // lands in that window must NOT be flushed — flushing would inject into a @@ -937,7 +937,7 @@ describe("CompassAgent — RT-3 turn-end delivery (SEA-1310 §8 deliver arm)", ( await h.close(); }); - // Rejection-safety belt (SEA-1310 §8): if a flush's prompt is REFUSED (the + // Rejection-safety belt (RIG-1310 §8): if a flush's prompt is REFUSED (the // only prompt-rejection shape — a not-injected batch), the batch must not be // acked (no false receipt) and its ids must leave the processed set so the // Server's redelivery re-injects them. Forced via the model-independent @@ -1482,7 +1482,7 @@ describe("CompassAgent — RIG-2644 idle deliver / strand recovery after replay_ }); test("a real tracked turn flushes on agent_end; the strand recovery does not double-flush", async () => { - // The spin-up race the isStreaming gate exists to close (RIG-2488/SEA-1310) + // The spin-up race the isStreaming gate exists to close (RIG-2488/RIG-1310) // must stay closed: a deliver landing while a control-prompt has spun the // inner agent streaming but agent_start has not yet propagated (#turnActive // still false, isStreaming true) queues AND arms a recovery. When the REAL @@ -1585,7 +1585,7 @@ describe("CompassAgent — RIG-2644 idle deliver / strand recovery after replay_ }); // --------------------------------------------------------------------------- -// SEA-1310 §8 — channel-borne steer arm. +// RIG-1310 §8 — channel-borne steer arm. // // steer() rides the same immediate handle deliver does (not the control script), // so these tests reuse startDeliverAgent()/deliverMsg()/ackIds()/tick() and call @@ -1593,7 +1593,7 @@ describe("CompassAgent — RIG-2644 idle deliver / strand recovery after replay_ // it injects via `session.agent.steer` (drained by the running loop, no turn // started); idle it STARTS A TURN with the mention as content via // `session.agent.prompt`, mirroring the idle-deliver path (design: architecture-lineage idle arm). -describe("CompassAgent — channel-borne steer (SEA-1310 §8 steer arm)", () => { +describe("CompassAgent — channel-borne steer (RIG-1310 §8 steer arm)", () => { test("a mid-turn steer injects via session.agent.steer and does NOT start a turn", async () => { const h = startDeliverAgent(); h.drive({ type: "agent_start" } as AgentSessionEvent); @@ -1908,7 +1908,7 @@ describe("CompassAgent — SessionInjection op-kind signal (RIG-2486 T1)", () => }); }); -describe("formatDeliversForPrompt — coalescing format (SEA-1310 §8)", () => { +describe("formatDeliversForPrompt — coalescing format (RIG-1310 §8)", () => { test("renders each message's text, in order, within its topic section", () => { const batch = [ deliverMsg("m1", "first", "t-1"), diff --git a/packages/compass-agent/src/agent.ts b/packages/compass-agent/src/agent.ts index 0f83e3541..838faa8b9 100644 --- a/packages/compass-agent/src/agent.ts +++ b/packages/compass-agent/src/agent.ts @@ -95,7 +95,7 @@ export class CompassAgent { // are applied as replay (context), and live prompt/steer are refused until // `#replayComplete` — a belt-and-suspenders on the frozen replay barrier. #replayComplete = false; - // SEA-1310 §8 — RT-3 turn-end delivery (DELIVER arm). A delivered channel + // RIG-1310 §8 — RT-3 turn-end delivery (DELIVER arm). A delivered channel // message is coalesced to a turn-end prompt: mid-turn delivers queue and flush // as ONE prompt when the turn settles; an idle deliver starts a turn at once. // @@ -205,7 +205,7 @@ export class CompassAgent { // re-throws (error). async run(): Promise { const unsubscribe = this.#session.subscribe((event) => { - // Turn-tracking (SEA-1310 §8): an ADDITIONAL read of the same event, + // Turn-tracking (RIG-1310 §8): an ADDITIONAL read of the same event, // beside the mapper fan-out below — never disturbing it. A turn-start // edge marks the session active; `agent_end` settles it and flushes any // coalesced delivers into one turn-end prompt. @@ -275,7 +275,7 @@ export class CompassAgent { ); } - // SEA-1310 §8 — deliver a channel message into the live session (RT-3). The + // RIG-1310 §8 — deliver a channel message into the live session (RT-3). The // entry the immediate handle calls when a `DeliverControl.message` decodes. // The replay barrier is enforced UPSTREAM at the control source (a // pre-ReplayComplete immediate op is refused-and-counted before it reaches @@ -295,7 +295,7 @@ export class CompassAgent { // dropped (counted), independent of the control-source's control_seq dedup // (frozen record :811-812). // - // Re-ack subtlety (SEA-1310 §8 review MEDIUM): `#processedMessageIds` holds + // Re-ack subtlety (RIG-1310 §8 review MEDIUM): `#processedMessageIds` holds // ids from ENQUEUE time (:205, before injection), not injection time. The // Publish PRIORITY lane an ack rides is never-drop only within its retry // budget (publish-spine.ts:156-158) — a Runner restart or a >~1s socket @@ -398,8 +398,8 @@ export class CompassAgent { }); } - // SEA-1310 §8 — channel-borne steer arm. The entry the immediate handle calls - // when a `SteerControl.message` decodes (populated by SEA-1569 (T7)). Unlike + // RIG-1310 §8 — channel-borne steer arm. The entry the immediate handle calls + // when a `SteerControl.message` decodes (populated by RIG-1569 (T7)). Unlike // deliver (which coalesces to a turn-end prompt), a steer is an @-mention // interrupt: mid-turn it injects into the running loop (interrupt at the next // tool boundary); idle it starts a fresh turn to drain the injected steer @@ -603,7 +603,7 @@ export class CompassAgent { } } - // Track a session turn edge (SEA-1310 §8, RIG-2732 W3). A turn-start edge + // Track a session turn edge (RIG-1310 §8, RIG-2732 W3). A turn-start edge // marks the session active; `agent_end` settles it and flushes the coalesced // deliver AND forge-notification queues as turn-end prompts. See the // `#turnActive` field comment for why the flush is safe synchronously on the @@ -643,7 +643,7 @@ export class CompassAgent { // synchronous `prompt` call), never gated behind the prompt's completion — so // a crash mid-turn does not lose a receipt for a batch that WAS injected. // - // Rejection-safety belt (SEA-1310 §8 / RIG-2732 W3): `Agent.prompt` injects + // Rejection-safety belt (RIG-1310 §8 / RIG-2732 W3): `Agent.prompt` injects // synchronously up to its first await and can only signal a NOT-injected // batch as a settled REJECTION — a synchronous throw at its very top: the // AgentBusyError streaming guard (agent.ts:985) or the "No model" check @@ -891,12 +891,12 @@ export class CompassAgent { } // Coalesce a batch of delivered channel messages into ONE prompt input string -// (SEA-1310 §8). Pure + exported so it is unit-testable. The batch is GROUPED +// (RIG-1310 §8). Pure + exported so it is unit-testable. The batch is GROUPED // per topic (`msg.topicId`) at format time: a topic belongs to exactly one // channel, so topic-grouping is per-(channel, topic), one digest section per // topic within the channel batch (D3/D4). This is FORMAT-TIME only — the flush // still emits one coalesced prompt and one ack per message (`#flushTurnEnd`), -// so the SEA-1310 §8 ack-safety belt is untouched. +// so the RIG-1310 §8 ack-safety belt is untouched. // // Topic order is first-seen; message order within a topic is preserved. Each // message's `text`-case blocks are concatenated and an `askAnswer`-case block diff --git a/packages/compass-agent/src/cli.config-passthrough.test.ts b/packages/compass-agent/src/cli.config-passthrough.test.ts index b64064131..b4ff9ad11 100644 --- a/packages/compass-agent/src/cli.config-passthrough.test.ts +++ b/packages/compass-agent/src/cli.config-passthrough.test.ts @@ -1,4 +1,4 @@ -// SEA-1678 T4 — the entrypoint's fleet-config passthrough (design +// RIG-1678 T4 — the entrypoint's fleet-config passthrough (design // compass-agent-config-passthrough §CP-1/CP-2/CP-4), object-injection variant. // // Matt's pivot: the Runner-mounted bundle stays the delivery vehicle, but the @@ -518,7 +518,7 @@ describe("(g) the SDK resolves a mounted subagent by name (subprocess, HOME-froz }, 20_000); }); -// ── SEA-1678 T6: the Reload RE-READ (the record's load-bearing acceptance) ───── +// ── RIG-1678 T6: the Reload RE-READ (the record's load-bearing acceptance) ───── // // The record's acceptance is that the update path is proven on the agent's // OBSERVED value, not just a flipped symlink: after a ConfigVersion Reload the @@ -569,7 +569,7 @@ async function runMainAcrossReload( return { before, after }; } -describe("main re-reads the mount on a ConfigVersion Reload (SEA-1678 T6)", () => { +describe("main re-reads the mount on a ConfigVersion Reload (RIG-1678 T6)", () => { // The load-bearing acceptance: after a Reload the agent OBSERVES the updated // settings value. Boot resolves the fleet overlay (222) over the project // value (111); a version flip changes the fleet member to 333; the re-exec'd diff --git a/packages/compass-agent/src/cli.test.ts b/packages/compass-agent/src/cli.test.ts index 353dc03f4..900506fa8 100644 --- a/packages/compass-agent/src/cli.test.ts +++ b/packages/compass-agent/src/cli.test.ts @@ -161,7 +161,7 @@ describe("resolvePersona", () => { }); }); -// COMPASS_ROLE is the server-authoritative block-0 role selector (SEA-1732 T10). +// COMPASS_ROLE is the server-authoritative block-0 role selector (RIG-1732 T10). // The entrypoint resolves the LABEL here (trimmed; blank → unset), then reads its // `prompts//SYSTEM.md` from the mount and injects it as customSystemPrompt. // Same unset/trim semantics as the model selector and persona. @@ -244,7 +244,7 @@ describe("authSeedPath", () => { }); }); -// The env-file path is the frozen SEA-1327 T5 placement: a 0600 +// The env-file path is the frozen RIG-1327 T5 placement: a 0600 // `$HOME/.compass/env` written by the Runner's materializer, beside the seed. describe("envFilePath", () => { test("resolves under the supplied HOME", () => { @@ -294,7 +294,7 @@ describe("parseEnvFile", () => { expect( parseEnvFile( // The ratified four, plus a COMPASS_ control var the four-key list - // predated (COMPASS_RESUME_SESSION_FILE, SEA-1570 T8): the prefix + // predated (COMPASS_RESUME_SESSION_FILE, RIG-1570 T8): the prefix // rule reserves it too, so a file can never hijack the resume path. "HOME=/evil\nCOMPASS_MODEL=x\nCOMPASS_WORKDIR=y\nCOMPASS_PERSONA=z\nCOMPASS_RESUME_SESSION_FILE=/evil\nCOMPASS_FUTURE_VAR=nope\nOK=1", ), @@ -507,11 +507,11 @@ function fakeCarrier( } // Like `deps`, but captures the tee-backed SessionManager `main` builds — the -// surviving durable rider (SEA-1570) is a transcript frame, launched when a +// surviving durable rider (RIG-1570) is a transcript frame, launched when a // session write teems onto the sink's durable lane. A test resolves the gate, // then drives an `appendMessage` through the captured manager to put a durable // TranscriptEntry send in flight (the way the removed conversation write-through -// used to, before SEA-1708). The real tee storage is used (default +// used to, before RIG-1708). The real tee storage is used (default // createSessionStorage), so the full sink → tee → durable-unary path runs. function depsCapturingManager( session: FakeSession, @@ -1290,7 +1290,7 @@ describe("main", () => { } }); - // ── SEA-1570: the tee-storage composition + resume ──────────────────────── + // ── RIG-1570: the tee-storage composition + resume ──────────────────────── // // `main` builds the tee storage over the socket sink and injects the // resulting IndexedSessionStorage into SessionManager.create, passed to @@ -1373,7 +1373,7 @@ describe("main", () => { expect(texts).toContain("resumed turn"); }); - // The real Option-B shape (SEA-1570 T2): the Runner materializes the resume + // The real Option-B shape (RIG-1570 T2): the Runner materializes the resume // file at an absolute path OUTSIDE the SDK default session dir. On the unfixed // code loadIndex scans only sessionDir → the file is un-indexed → setSessionFile's // statSync gate ENOENTs → silent fresh session → entriesAtCreate empty → RED. @@ -1671,7 +1671,7 @@ describe("main", () => { // ── main(): sourcing $HOME/.compass/env into process.env ───────────────────── // -// The materialized env-secret file (SEA-1327 T5) must reach `process.env` before +// The materialized env-secret file (RIG-1327 T5) must reach `process.env` before // createAgentSession, so the session's extensions/MCP/tools inherit the secrets. // These run over the same composition seam as the `main` tests above, writing // the env file under the per-test scratch HOME (pinned in beforeEach). Every @@ -2176,7 +2176,7 @@ function nextEventLoopTurn(): Promise { return promise; } -// ── SEA-1570 session-JSONL fixtures ────────────────────────────────────────── +// ── RIG-1570 session-JSONL fixtures ────────────────────────────────────────── // // Build a current-version (v3) session body the SDK loader accepts verbatim: a // 256-byte title slot, a session header, then one JSONL line per entry. Current @@ -2491,7 +2491,7 @@ describe("main wires the mounted agent-config into createAgentSession", () => { }); test("the native comms + lifecycle tools reach customTools alongside the MCP tools", async () => { - // gap-1 (SEA-1741): main constructs the comms/lifecycle brokers from the + // gap-1 (RIG-1741): main constructs the comms/lifecycle brokers from the // existing transport and merges their tools into customTools so the // container agent can spawn/post. Derive the EXPECTED names at runtime from // the same factories main uses (a rename reddens here, never silently @@ -2542,13 +2542,13 @@ describe("main wires the mounted agent-config into createAgentSession", () => { expect(names).toContain("agents_despawn_peer"); expect(names).toContain("forge_get_issue"); expect(names).toContain("forge_create_pull_request"); - // Headless approval policy (SEA-1741): the entrypoint pins autoApprove so + // Headless approval policy (RIG-1741): the entrypoint pins autoApprove so // the write-approval natives auto-execute with no human in the container. expect(seen[0].autoApprove).toBe(true); }); test("every native's execute keeps arity 2 — tripwire on the customToolToDefinition arg-shuffle", () => { - // SEA-1741 seam invariant. The natives are `AgentTool`s registered through + // RIG-1741 seam invariant. The natives are `AgentTool`s registered through // `customTools`; the SDK classifies a marker-less AgentTool as a CustomTool // and runs it through `customToolToDefinition`, which invokes `execute` // with the CustomTool arg order (toolCallId, params, onUpdate, ctx, signal) @@ -2618,7 +2618,7 @@ describe("main wires the mounted agent-config into createAgentSession", () => { expect(seen[0].additionalExtensionPaths).toEqual([]); expect(seen[0].disableExtensionDiscovery).toBe(true); // No MCP tools (empty mount → empty connect), but the comms/lifecycle/forge - // natives are ALWAYS merged in (SEA-1741/RIG-2672) — so customTools carries + // natives are ALWAYS merged in (RIG-1741/RIG-2672) — so customTools carries // exactly those, and never a discovered MCP tool. expect(toolNames(seen[0].customTools)).toContain("agents_spawn_peer"); expect(seen[0].customTools).toHaveLength(17); @@ -2651,13 +2651,13 @@ describe("main wires the mounted agent-config into createAgentSession", () => { expect(skillNames(seen[0].skills)).toEqual(["only"]); expect(seen[0].additionalExtensionPaths).toEqual([]); // No MCP tools from a skills-only mount, but the natives always merge in - // (SEA-1741/RIG-2672) — so customTools is exactly the comms/lifecycle/forge + // (RIG-1741/RIG-2672) — so customTools is exactly the comms/lifecycle/forge // natives. expect(toolNames(seen[0].customTools)).toContain("comms_post_message"); expect(seen[0].customTools).toHaveLength(17); }); - // ── SEA-1732 T10: COMPASS_ROLE → prompts//SYSTEM.md → customSystemPrompt ── + // ── RIG-1732 T10: COMPASS_ROLE → prompts//SYSTEM.md → customSystemPrompt ── // // The role selector delivers a per-role block-0 as `customSystemPrompt` (which // REPLACES OMP's default block-0), while persona STILL appends AFTER (record diff --git a/packages/compass-agent/src/cli.ts b/packages/compass-agent/src/cli.ts index 8957e7b41..2e69803ef 100644 --- a/packages/compass-agent/src/cli.ts +++ b/packages/compass-agent/src/cli.ts @@ -16,7 +16,7 @@ // - the provider credential from the 0600 `$HOME/.compass/auth-seed.json` the // Runner's materializer writes (design §T5); // - the materialized tool/MCP secrets from the 0600 `$HOME/.compass/env` the -// Runner's materializer writes as `KEY=VALUE` lines (SEA-1327 T5), sourced +// Runner's materializer writes as `KEY=VALUE` lines (RIG-1327 T5), sourced // into the process environment before the session is built. // // It composes three things and runs them: an `AgentSession` from @@ -93,7 +93,7 @@ export function authSeedPath(home: string): string { return `${home}/.compass/auth-seed.json`; } -/** The 0600 aggregate env-secret file the Runner materializes (SEA-1327 T5). */ +/** The 0600 aggregate env-secret file the Runner materializes (RIG-1327 T5). */ export function envFilePath(home: string): string { return `${home}/.compass/env`; } @@ -548,7 +548,7 @@ export interface MainDeps { /** Runner-socket carrier. Defaults to `createUnixSocketTransport`. */ createTransport?: (socketPath: string) => RunnerTransport; /** - * Tee-storage constructor (SEA-1570). Defaults to `createTeeSessionStorage`. + * Tee-storage constructor (RIG-1570). Defaults to `createTeeSessionStorage`. * A seam for the same reason as the other two: the real one wraps the SDK's * `IndexedSessionStorage` over a filesystem backend and awaits `initialize()` * off disk, so a test composes `main` over a recording storage instead. @@ -604,7 +604,7 @@ export async function main( ); } - // Materialized tool/MCP secrets (SEA-1327 T5): the Runner writes a 0600 + // Materialized tool/MCP secrets (RIG-1327 T5): the Runner writes a 0600 // aggregate KEY=VALUE file inside the container; source it into the process // environment so createAgentSession's extensions/MCP/tools — and any // subprocess they spawn — inherit the secrets. The merge target is @@ -651,14 +651,14 @@ export async function main( const cwd = env.COMPASS_WORKDIR?.trim() || process.cwd(); // The socket carrier + sink come FIRST: the tee storage backend teems every - // committed session write onto the sink's DURABLE lane (SEA-1570), so the + // committed session write onto the sink's DURABLE lane (RIG-1570), so the // sink must exist before the storage that holds it. const transport = (deps.createTransport ?? createUnixSocketTransport)( AGENT_SOCKET_PATH, ); const sink = createSocketFrameSink(transport); - // Native comms + lifecycle tools (SEA-1741 gap-1). The existing `transport` + // Native comms + lifecycle tools (RIG-1741 gap-1). The existing `transport` // is reused directly: `RunnerTransport` structurally satisfies both // `CommsTransport` and `LifecycleTransport` (each is a one-method subset — // comms.ts:74 / lifecycle.ts), so the brokers wrap it with no adapter. Their @@ -711,7 +711,7 @@ export async function main( // not a populated repo; sealed#1019 no-auto-clone), mirroring the auth-seed // anchoring above. const sessionDir = SessionManager.getDefaultSessionDir(cwd); - // Resume (SEA-1570): T8 exports COMPASS_RESUME_SESSION_FILE on the agent exec. + // Resume (RIG-1570): T8 exports COMPASS_RESUME_SESSION_FILE on the agent exec. // Resolve it BEFORE the storage is built so it can be threaded into the tee // backend and indexed at initialize()→loadIndex() — the resume file lives at // an absolute path OUTSIDE sessionDir (Option B, T2), so setSessionFile's @@ -747,7 +747,7 @@ export async function main( console.error(`[compass-agent] config version: ${mounted.version}`); } - // The role's block-0 prompt (SEA-1732 T10): when a role is set, read its + // The role's block-0 prompt (RIG-1732 T10): when a role is set, read its // `prompts//SYSTEM.md` from the same mount and inject it below as // `customSystemPrompt` — REPLACING OMP's default block-0. The read is // tolerant (absent/empty file → undefined), so a set-but-unshipped role @@ -762,7 +762,7 @@ export async function main( ) : undefined; - // Fleet OMP config passthrough (SEA-1678, design compass-agent-config-passthrough + // Fleet OMP config passthrough (RIG-1678, design compass-agent-config-passthrough // §CP-1/CP-2/CP-4), applied AFTER loadMountedConfig and BEFORE // createAgentSession. Matt's pivot: the mount stays the delivery vehicle, but // the agent CONSUMES it by OBJECT INJECTION wherever the runtime SDK (16.5.2) @@ -890,12 +890,12 @@ export async function main( additionalExtensionPaths: mounted.additionalExtensionPaths, disableExtensionDiscovery: mounted.disableExtensionDiscovery, // The connected MCP tools MERGED with the native comms/lifecycle tools - // (SEA-1741 gap-1, constructed above): all reach the session as natives via + // (RIG-1741 gap-1, constructed above): all reach the session as natives via // the same customTools→state.tools→#withNatives path, so the container // agent can spawn peers and post to channels. customTools: [...mcp.tools, ...nativeTools], enableMCP: false, - // Headless approval policy (SEA-1741, design compass-agent-comms-tools + // Headless approval policy (RIG-1741, design compass-agent-comms-tools // §"the container runs headless with write-approval tools auto-executing"): // the container has NO human to answer an approval prompt, and the native // comms/lifecycle tools declare approval:"write" — so without auto-approve @@ -907,7 +907,7 @@ export async function main( // that ever changes, gate this on an explicit headless signal so the // auto-approve posture fails safe outside a container. autoApprove: true, - // Fleet config object injection (SEA-1678 pivot): + // Fleet config object injection (RIG-1678 pivot): // - `rules` (CP-4): the fleet rules COMPOSED with the checkout's // discovered rules (both load; fleet-first), computed above. Passed // unconditionally — empty fleet set still composes cleanly. @@ -921,7 +921,7 @@ export async function main( rules, ...(contextFiles ? { contextFiles } : {}), ...(fleetSettings ? { settingsManager: fleetSettings } : {}), - // Role (SEA-1732 T10) + persona compose INDEPENDENTLY, and BOTH apply: + // Role (RIG-1732 T10) + persona compose INDEPENDENTLY, and BOTH apply: // - `customSystemPrompt` (role): the role's block-0 text, routed through // the SDK's custom-system-prompt template (sdk.ts:2727) — REPLACES // OMP's default block-0 while the template STILL injects skills + rules @@ -1020,7 +1020,7 @@ export async function main( const sdkGetApiKey = session.agent.getApiKey?.bind(session.agent); session.agent.getApiKey = createSeedApiKeyResolver(home, sdkGetApiKey); - // Construction cycle (SEA-1310 §8): createSocketControlSource needs the + // Construction cycle (RIG-1310 §8): createSocketControlSource needs the // ImmediateControl handle at construction, but the handle must forward into // the CompassAgent — which is constructed AFTER (it takes `control` as a ctor // arg). A mutable holder resolves it: the handle closes over `agent` and the diff --git a/packages/compass-agent/src/comms.test.ts b/packages/compass-agent/src/comms.test.ts index efb1a4523..64f90754c 100644 --- a/packages/compass-agent/src/comms.test.ts +++ b/packages/compass-agent/src/comms.test.ts @@ -1881,14 +1881,14 @@ describe("compass_set_status", () => { const transport = new FakeTransport(setStatusResult()); const setStatus = tool(new CommsBroker(transport), "compass_set_status"); - await exec(setStatus, "tc-s1", { activity: "reviewing SEA-1721" }); + await exec(setStatus, "tc-s1", { activity: "reviewing RIG-1721" }); const req = transport.requests[0]; expect(req?.callId).toBe("tc-s1"); expect(req?.call.case).toBe("setStatus"); if (req?.call.case !== "setStatus") throw new Error("expected a setStatus call"); - expect(req.call.value.activity).toBe("reviewing SEA-1721"); + expect(req.call.value.activity).toBe("reviewing RIG-1721"); expect("clientRequestId" in req.call.value).toBe(false); }); diff --git a/packages/compass-agent/src/comms.ts b/packages/compass-agent/src/comms.ts index 9362a05aa..71711c512 100644 --- a/packages/compass-agent/src/comms.ts +++ b/packages/compass-agent/src/comms.ts @@ -332,7 +332,7 @@ function presenceLabel(presence: AgentPresence): string { /** * The native comms tool set. Five tools; never an ask-answering one. * - * Wired into the container entrypoint by `cli.ts main()` (SEA-1741): the tools + * Wired into the container entrypoint by `cli.ts main()` (RIG-1741): the tools * are merged into the session's `customTools` and so register as `#withNatives` * natives. This package's tests also exercise the end-to-end contract directly. */ diff --git a/packages/compass-agent/src/compassv1.ts b/packages/compass-agent/src/compassv1.ts index 5723cd1e2..bdeb72dba 100644 --- a/packages/compass-agent/src/compassv1.ts +++ b/packages/compass-agent/src/compassv1.ts @@ -102,7 +102,7 @@ export { // ops plus a Runner-assigned `controlSeq` envelope field (retention cursor). // The control source decodes one AgentControl per Control-stream message; // the agent classifies each by the set oneof case. Payload fields for - // steer/deliver/replay/config stay empty shells (SEA-1310 parked). + // steer/deliver/replay/config stay empty shells (RIG-1310 parked). type AgentControl, AgentControlSchema, // The stdout envelope (internal-only §T5): a oneof over the payload messages. @@ -118,9 +118,9 @@ export { ControlAckSchema, type DeliverControl, DeliverControlSchema, - // The agent's per-message delivery receipt (SEA-1569), an AgentFrame oneof + // The agent's per-message delivery receipt (RIG-1569), an AgentFrame oneof // variant riding the Publish spine — correlates to the delivered message by - // id. Emitted by the CompassAgent at injection time (SEA-1310 §8 deliver arm). + // id. Emitted by the CompassAgent at injection time (RIG-1310 §8 deliver arm). type DeliveryAck, DeliveryAckSchema, // The agent's per-notification forge delivery receipt (RIG-2732 W3), an @@ -145,7 +145,7 @@ export { SteerControlSchema, // The `transcript_entry` variant's payload: one committed SDK session entry // (entry_json + checkpoint + entry_seq) the tee backend commits locally and - // tees upstream as a durable frame (SEA-1570). Constructed with + // tees upstream as a durable frame (RIG-1570). Constructed with // `create(TranscriptEntrySchema, …)` so the branded message satisfies the // AgentFrame oneof. type TranscriptEntry, diff --git a/packages/compass-agent/src/config-passthrough-probe.ts b/packages/compass-agent/src/config-passthrough-probe.ts index 3d125b575..4eba1f0a5 100644 --- a/packages/compass-agent/src/config-passthrough-probe.ts +++ b/packages/compass-agent/src/config-passthrough-probe.ts @@ -1,4 +1,4 @@ -// Test-support driver for the SEA-1678 T4 acceptance (g) that requires a +// Test-support driver for the RIG-1678 T4 acceptance (g) that requires a // launch-frozen $HOME (design compass-agent-config-passthrough §CP-4). // // After the object-injection pivot, only ONE fleet member still reaches the SDK diff --git a/packages/compass-agent/src/config-reader.ts b/packages/compass-agent/src/config-reader.ts index 018140816..9210b6973 100644 --- a/packages/compass-agent/src/config-reader.ts +++ b/packages/compass-agent/src/config-reader.ts @@ -356,7 +356,7 @@ export async function readMountedAgentsMd( } /** - * The role's block-0 system prompt `prompts//SYSTEM.md` (SEA-1732 T10), + * The role's block-0 system prompt `prompts//SYSTEM.md` (RIG-1732 T10), * read as TEXT for direct injection via `createAgentSession({ customSystemPrompt })` * — which REPLACES OMP's block-0 (routed through the SDK's custom-system-prompt * template, sdk.ts:2727). The operator-set role label (COMPASS_ROLE) selects the diff --git a/packages/compass-agent/src/frame.ts b/packages/compass-agent/src/frame.ts index fb07dfbd7..30de938d3 100644 --- a/packages/compass-agent/src/frame.ts +++ b/packages/compass-agent/src/frame.ts @@ -2,7 +2,7 @@ // produces/consumes and the bytes on the stdio channel the Runner drives. // // The frame CONTRACT is frozen (design: architecture-lineage, spine-inversion; -// extended by SEA-1570 with the transcript-tee lane): +// extended by RIG-1570 with the transcript-tee lane): // - stdout: `AgentFrame` — oneof frame { // SessionFrame session; TranscriptEntry transcript_entry; // DeliveryAck delivery_ack } @@ -10,7 +10,7 @@ // field is the "unknown frame" the Runner logs + counts. The opaque // OMP-native execution trace + board lifecycle ride the single `session` // variant (SessionFrame) → the session-tail Publish spine. TRANSCRIPT -// (SEA-1570) rides the single `transcript_entry` variant (TranscriptEntry): +// (RIG-1570) rides the single `transcript_entry` variant (TranscriptEntry): // one committed SDK session entry the tee backend commits locally and // forwards on the DURABLE conversation-frame lane (never the droppable // Publish spine) so the Server can reconstruct the session on resume. @@ -45,11 +45,11 @@ import { // oneof field, and the reader a single field to classify on. export type OutboundFrame = | { readonly kind: "session"; readonly value: SessionFrame } - // SEA-1570: one committed SDK session entry, teed upstream. `value` is a + // RIG-1570: one committed SDK session entry, teed upstream. `value` is a // branded generated message (`create(TranscriptEntrySchema, …)`), and `kind` // matches the generated oneof case name 1:1 like every other variant. | { readonly kind: "transcriptEntry"; readonly value: TranscriptEntry } - // SEA-1310 §8: the agent's per-message delivery receipt for a turn-end + // RIG-1310 §8: the agent's per-message delivery receipt for a turn-end // delivery. `value` is a branded generated message (`create(DeliveryAckSchema, // …)`) and `kind` matches the generated oneof case name 1:1 like every other // variant, so the sink stamps it generically (no ProtojsonLineSink change). @@ -69,7 +69,7 @@ export type OutboundFrame = // entirely behind this interface. export interface FrameSink { emit(frame: OutboundFrame): void; - // SEA-1570 transcript lane: send one frame on the DURABLE unary and AWAIT its + // RIG-1570 transcript lane: send one frame on the DURABLE unary and AWAIT its // commit, REJECTING on definitive give-up (inner-retry exhaustion). Unlike // `emit()` — which stays void + silent-give-up for the loss-tolerable // conversation/session lanes — the tee backend awaits this inside the diff --git a/packages/compass-agent/src/gen/compass/v1/agent_gateway_pb.ts b/packages/compass-agent/src/gen/compass/v1/agent_gateway_pb.ts index e49b024f1..6b68b3faa 100644 --- a/packages/compass-agent/src/gen/compass/v1/agent_gateway_pb.ts +++ b/packages/compass-agent/src/gen/compass/v1/agent_gateway_pb.ts @@ -1,5 +1,5 @@ // The compass.v1 agent->Runner call transport (design -// docs/designs/product/compass-agent-runner-transport/design.md, SEA-1351 T1). +// docs/designs/product/compass-agent-runner-transport/design.md, RIG-1351 T1). // // INTERNAL-ONLY surface. Unlike compass.proto / comms.proto — the public, // generated-client door between a UI and the Server — AgentGateway is the @@ -1320,7 +1320,7 @@ export type PostConversationFrameRequest = Message<"compass.v1.PostConversationF /** * Agent-minted, stable across retries of the same logical frame; the Runner * commits at-most-once per key so a lost-response retry is not duplicated. An - * ENVELOPE field (dedup), not a payload field — SEA-1310's parked payload + * ENVELOPE field (dedup), not a payload field — RIG-1310's parked payload * decision is untouched. * * @generated from field: string idempotency_key = 2; diff --git a/packages/compass-agent/src/gen/compass/v1/agent_pb.ts b/packages/compass-agent/src/gen/compass/v1/agent_pb.ts index b2a636296..38bd801de 100644 --- a/packages/compass-agent/src/gen/compass/v1/agent_pb.ts +++ b/packages/compass-agent/src/gen/compass/v1/agent_pb.ts @@ -105,7 +105,7 @@ export type AgentFrame = Message<"compass.v1.AgentFrame"> & { } | { /** * delivery_ack — the agent's per-message delivery receipt for a - * DeliverControl relayed down the session (SEA-1569). The success + * DeliverControl relayed down the session (RIG-1569). The success * receipt for a delivery rides this frame, not the Runner result * stream (RT-3); the Server advances the delivery cursor on it. * @@ -118,7 +118,7 @@ export type AgentFrame = Message<"compass.v1.AgentFrame"> & { * transcript_entry — one committed SDK session entry, teed upstream on * the DURABLE conversation-frame lane (PostConversationFrame → * CommitConversationFrame), not the loss-tolerable Publish spine - * (SEA-1570). The Server persists it; the agent's local copy is + * (RIG-1570). The Server persists it; the agent's local copy is * container-ephemeral. Reconstructed into a session-JSONL body on * resume (T4/T5). * @@ -151,7 +151,7 @@ export const AgentFrameSchema: GenMessage = /*@__PURE__*/ /** * The `transcript_entry` variant's payload: one committed SDK session entry, * teed upstream by the agent's session-storage backend as a durable frame - * (SEA-1570). `append` → a delta entry (checkpoint = false); `writeFull` (an + * (RIG-1570). `append` → a delta entry (checkpoint = false); `writeFull` (an * SDK compaction/title rewrite) → a checkpoint entry (checkpoint = true, the * full body as one payload). INTERNAL-only, like the rest of this file. * @@ -253,10 +253,10 @@ export const SessionFrameSchema: GenMessage = /*@__PURE__*/ * `AgentMessage` (a four-way union with an opaque provider payload) and a tool * set (whose SDK representation includes a non-serializable `execute` handle), * neither of which any existing compass.v1 message represents. That payload- - * shape decision is parked (SEA-1310); the shells keep the oneof complete on + * shape decision is parked (RIG-1310); the shells keep the oneof complete on * the wire and are populated by a stacked PR once the shapes settle * (DeliverControl and the channel-borne SteerControl were so populated by - * SEA-1569, each carrying a comms Message). Defining the empty shells now is + * RIG-1569, each carrying a comms Message). Defining the empty shells now is * additive and buf-breaking-safe (field additions to a proto3 message). * * @generated from message compass.v1.AgentControl @@ -370,12 +370,12 @@ export const ReplayCompleteSchema: GenMessage = /*@__PURE__*/ /** * SteerControl carries a comms Message: a channel `@`-mention routed into the - * agent's live session as a steer (SEA-1569), sourced from a channel + * agent's live session as a steer (RIG-1569), sourced from a channel * PostMessage, wrapped in an AgentControl and relayed via the runner control * seam (DispatchControl) — the same path DeliverControl rides, carrying the * same single first-party Message (DL-073; no seq, the id is in the Message). * The generic SDK-AgentMessage steer (Runner-originated, outside any channel) - * stays parked under SEA-1310. + * stays parked under RIG-1310. * * @generated from message compass.v1.SteerControl */ @@ -408,7 +408,7 @@ export const SteerControlSchema: GenMessage = /*@__PURE__*/ messageDesc(file_compass_v1_agent, 6); /** - * Empty shells — payload fields parked (SEA-1310). Present so the AgentControl + * Empty shells — payload fields parked (RIG-1310). Present so the AgentControl * oneof is complete on the wire; populated by a stacked PR. * TranscriptReplay carries an inbound SDK AgentMessage; * ConfigControl carries a tool set. @@ -440,9 +440,9 @@ export const ConfigControlSchema: GenMessage = /*@__PURE__*/ /** * DeliverControl carries a comms Message to deliver into the agent's live - * session (SEA-1569): the Server wraps it in an AgentControl and relays it via + * session (RIG-1569): the Server wraps it in an AgentControl and relays it via * the runner control seam (DispatchControl); the Runner writes it down the - * per-container socket. Populated from the SEA-1310 parked shell. + * per-container socket. Populated from the RIG-1310 parked shell. * * @generated from message compass.v1.DeliverControl */ @@ -487,7 +487,7 @@ export const DeliverControlSchema: GenMessage = /*@__PURE__*/ messageDesc(file_compass_v1_agent, 9); /** - * DeliveryAck — the agent's per-message delivery receipt (SEA-1569), an + * DeliveryAck — the agent's per-message delivery receipt (RIG-1569), an * AgentFrame oneof variant riding the Publish spine. Correlates to the * delivered message by id; on receipt the Server advances the delivery cursor * (the success receipt for a delivery, per RT-3 — not a Runner result). diff --git a/packages/compass-agent/src/gen/compass/v1/comms_pb.ts b/packages/compass-agent/src/gen/compass/v1/comms_pb.ts index 0b57c7708..4cd0a4fe7 100644 --- a/packages/compass-agent/src/gen/compass/v1/comms_pb.ts +++ b/packages/compass-agent/src/gen/compass/v1/comms_pb.ts @@ -719,7 +719,7 @@ export type AskQuestion = Message$1<"compass.v1.AskQuestion"> & { /** * True when the answer was recorded by timeout auto-selection rather than a - * participant (SEA-1310 owns whether/when the Compass answer path can time + * participant (RIG-1310 owns whether/when the Compass answer path can time * out; the field is the audit carrier either way). * * @generated from field: bool timed_out = 9; @@ -875,7 +875,7 @@ export type SubscribeCommsResponse = Message$1<"compass.v1.SubscribeCommsRespons case: "resyncRequired"; } | { /** - * A live agent's presence changed (SEA-1569). Derived from the session + * A live agent's presence changed (RIG-1569). Derived from the session * lifecycle (not a heartbeat); PUBLIC — UI board state consumes it. * * @generated from field: compass.v1.AgentPresenceChanged agent_presence_changed = 17; @@ -1070,7 +1070,7 @@ export const CommsResyncRequiredSchema: GenMessage = /*@__P messageDesc(file_compass_v1_comms, 23); /** - * A live agent's presence changed (SEA-1569). Presence is derived from the + * A live agent's presence changed (RIG-1569). Presence is derived from the * session lifecycle (D4) — a projection of the session state and the Runner * link, not a heartbeat. PUBLIC (UI board state, comms presence, the * delivery-settle gate consume it); NOT gen-fenced. @@ -2318,7 +2318,7 @@ export const ChannelKindSchema: GenEnum = /*@__PURE__*/ enumDesc(file_compass_v1_comms, 3); /** - * The presence states a live agent projects (SEA-1569, OQ-1). MVP is four + * The presence states a live agent projects (RIG-1569, OQ-1). MVP is four * states derived from the session lifecycle; PUBLIC, NOT gen-fenced. * * @generated from enum compass.v1.AgentPresence diff --git a/packages/compass-agent/src/gen/compass/v1/compass_pb.ts b/packages/compass-agent/src/gen/compass/v1/compass_pb.ts index db8ae4bd2..9b6783c44 100644 --- a/packages/compass-agent/src/gen/compass/v1/compass_pb.ts +++ b/packages/compass-agent/src/gen/compass/v1/compass_pb.ts @@ -1054,7 +1054,7 @@ export type ProvisionAgentWorkspaceRequest = Message<"compass.v1.ProvisionAgentW agentAccountId: string; /** - * Repo carriage removed (SEA-1527, Matt 2026-07-29): spawn/provision no longer + * Repo carriage removed (RIG-1527, Matt 2026-07-29): spawn/provision no longer * clone a repo for the agent. The container is provisioned with a git * credential + workspace and the agent self-clones whatever it needs after * launch. @@ -1193,7 +1193,7 @@ export type StartAgentSessionRequest = Message<"compass.v1.StartAgentSessionRequ * logical session: the Server (subscriber-authz gated) reconstructs the * stored transcript into a session-JSONL body the Runner materializes into * the new container at provision. Empty = fresh. No storage locator ever - * rides any request — storage is Server-internal (SEA-1570). + * rides any request — storage is Server-internal (RIG-1570). * * @generated from field: string resume_session_id = 3; */ @@ -2057,7 +2057,7 @@ export type TrackerRef = Message<"compass.v1.TrackerRef"> & { kind: string; /** - * the tracker's native issue id, e.g. "SEA-1042" + * the tracker's native issue id, e.g. "RIG-1042" * * @generated from field: string id = 2; */ @@ -2291,7 +2291,7 @@ export const ServerStateSchema: GenEnum = /*@__PURE__*/ * applies as written). OQ6, design docs/designs/platform/go-toolchain-default.md * :1378-1396. * - * Scope: T4 (SEA-1243) ships the DISCONNECTED *signal* only. The server-side + * Scope: T4 (RIG-1243) ships the DISCONNECTED *signal* only. The server-side * reattach-window enforcement — the per-session registry, the bounded timer, * the expiry→ERRORED transition, and GetAgentStatus reconciliation on reattach * — is T9 (go-toolchain-default.md:979). Until T9 lands, a dropped Runner link @@ -2419,7 +2419,7 @@ export const AgentPlanEntryStatusSchema: GenEnum = /*@__PU * steer/deliver control discriminant (agent.proto), re-declared here on the * public surface because SessionEvent — the public SubscribeAgentSession payload * — cannot reference the fenced internal enum without breaching the gen-fence - * (SEA-1267); see the steer/deliver-seam design record, OQ2. + * (RIG-1267); see the steer/deliver-seam design record, OQ2. * * @generated from enum compass.v1.SessionInjectionKind */ @@ -2824,7 +2824,7 @@ export const CompassService: GenService<{ * (enforced in the handler: caller account kind == User, an agent account is * rejected PermissionDenied); ListSecrets is callable by user AND agent tokens * (the Setup agent drives it). The proto carries no gate — authz is the - * handler's (SEA-1327 T7). + * handler's (RIG-1327 T7). * * @generated from service compass.v1.SecretsService */ diff --git a/packages/compass-agent/src/gen/compass/v1/forge_pb.ts b/packages/compass-agent/src/gen/compass/v1/forge_pb.ts index e99e85fca..5e97854f4 100644 --- a/packages/compass-agent/src/gen/compass/v1/forge_pb.ts +++ b/packages/compass-agent/src/gen/compass/v1/forge_pb.ts @@ -1,4 +1,4 @@ -// The compass.v1 forge notification + shared carrier leaf (SEA-1731 A1, design +// The compass.v1 forge notification + shared carrier leaf (RIG-1731 A1, design // docs/designs/product/compass-server-ownership-layer-amendment/design.md §A1). // // INTERNAL-ONLY surface. Like agent.proto / agent_gateway.proto / runner.proto, diff --git a/packages/compass-agent/src/lifecycle.ts b/packages/compass-agent/src/lifecycle.ts index fb672ba83..9660bc14c 100644 --- a/packages/compass-agent/src/lifecycle.ts +++ b/packages/compass-agent/src/lifecycle.ts @@ -129,7 +129,7 @@ function lifecycleFailure( /** * The native lifecycle tool set. Exactly two tools: spawn and despawn a peer. * - * Wired into the container entrypoint by `cli.ts main()` (SEA-1741): the tools + * Wired into the container entrypoint by `cli.ts main()` (RIG-1741): the tools * are merged into the session's `customTools` and so register as `#withNatives` * natives. This package's tests also exercise the end-to-end contract directly. */ diff --git a/packages/compass-agent/src/mapping.test.ts b/packages/compass-agent/src/mapping.test.ts index aa9b9e984..889ad181e 100644 --- a/packages/compass-agent/src/mapping.test.ts +++ b/packages/compass-agent/src/mapping.test.ts @@ -246,7 +246,7 @@ describe("EventMapper — monotonic event_id across the stream", () => { describe("EventMapper — streamed text is session-only (live chunk, no comms settle)", () => { // A text_delta emits ONE session assistant_text chunk (live trace); text_end - // settles NO frame (SEA-1708 removed the comms write-through). The session + // settles NO frame (RIG-1708 removed the comms write-through). The session // chunk is the only text surface — a delta that stopped emitting, or a // text_end that leaked any frame, reddens. test("text_delta → one session assistantText chunk", () => { diff --git a/packages/compass-agent/src/mapping.ts b/packages/compass-agent/src/mapping.ts index d13b05f5d..67a01f44d 100644 --- a/packages/compass-agent/src/mapping.ts +++ b/packages/compass-agent/src/mapping.ts @@ -21,7 +21,7 @@ // transitions ride the same variant as `SessionFrame.state` (typed_event empty). // // The streaming conversation write-through (MessagePosted/MessageUpdated → comms) -// is REMOVED (SEA-1708): a streamed assistant `text_delta` produces only a live +// is REMOVED (RIG-1708): a streamed assistant `text_delta` produces only a live // session `assistant_text` chunk per delta; `text_end` settles no comms block. // Thinking is session-only (no comms counterpart). // @@ -282,7 +282,7 @@ export class EventMapper { return [this.#assistantText(inner.delta)]; } case "text_end": { - // Comms surface removed (SEA-1708): the streaming conversation + // Comms surface removed (RIG-1708): the streaming conversation // write-through is gone, so a settled block emits no frame. The live // session `assistant_text` chunks (per delta) are the only text // surface. diff --git a/packages/compass-agent/src/session-tee.test.ts b/packages/compass-agent/src/session-tee.test.ts index 493b24407..361d99f04 100644 --- a/packages/compass-agent/src/session-tee.test.ts +++ b/packages/compass-agent/src/session-tee.test.ts @@ -1,4 +1,4 @@ -// TranscriptTeeBackend (SEA-1570 T2): the container-local FS backend that tees +// TranscriptTeeBackend (RIG-1570 T2): the container-local FS backend that tees // every committed session write upstream as a durable TranscriptEntry frame. // // Each test defends a load-bearing contract over a RECORDING FrameSink (captures @@ -255,7 +255,7 @@ describe("TranscriptTeeBackend reads", () => { expect(index.map((e) => e.size)).toEqual([2, 4]); }); - // loadIndex ALSO indexes an explicit out-of-dir resumeFile (SEA-1570 T2, + // loadIndex ALSO indexes an explicit out-of-dir resumeFile (RIG-1570 T2, // Option B): the Runner-materialized resume file lives outside sessionDir, so // the SDK wrapper would ENOENT it unless the scan surfaces it. Non-vacuity: a // backend that only scanned the dir would omit the B file → red. diff --git a/packages/compass-agent/src/session-tee.ts b/packages/compass-agent/src/session-tee.ts index a611b4d63..645004118 100644 --- a/packages/compass-agent/src/session-tee.ts +++ b/packages/compass-agent/src/session-tee.ts @@ -1,4 +1,4 @@ -// The tee seam (SEA-1570 T2): a container-local-filesystem `SessionStorageBackend` +// The tee seam (RIG-1570 T2): a container-local-filesystem `SessionStorageBackend` // (indexed-session-storage.ts:25-36 — the ten async methods) that TEES every // committed write upstream as a durable `TranscriptEntry` frame while keeping the // authoritative bytes on the local disk the SDK's own session loader reads. @@ -17,7 +17,7 @@ // wrapper (session-manager.ts:973-974) and the wrapper throws ENOENT for // un-indexed paths, so the Runner-materialized file must appear in the scan. // loadIndex therefore ALSO indexes an explicit `resumeFile` (options, -// SEA-1570 T2 Option B) by its exact absolute path, so a resume file that +// RIG-1570 T2 Option B) by its exact absolute path, so a resume file that // lives OUTSIDE `sessionDir` is discoverable and need not live under it. // - the rest (`updateSessionTitle`/`truncate`/`move`/`remove`) → local-only // (titles are a Server-side rendering concern; nothing durable depends on @@ -78,7 +78,7 @@ export interface TranscriptTeeOptions { /** Override the escalating retry schedule (tests inject a fast one). */ readonly emitBackoffMs?: readonly number[]; /** An extra absolute session-file path to index beyond the scanned session dir - (the Runner-materialized resume file; SEA-1570 T8/T2). Canonicalized with + (the Runner-materialized resume file; RIG-1570 T8/T2). Canonicalized with `path.resolve` and indexed under that resolved key so the SDK wrapper's lookup gate (statSync ~:177 / readText ~:205 / readTextSlices ~:213 in indexed-session-storage.ts, all keyed on `setSessionFile`'s @@ -242,7 +242,7 @@ export class TranscriptTeeBackend implements SessionStorageBackend { throw err; } } - // SEA-1570 T2 (Option B): also index the explicit Runner-materialized + // RIG-1570 T2 (Option B): also index the explicit Runner-materialized // resume file, which lives OUTSIDE the scanned session dir. Dedup by exact // path (a resume file that happens to live in sessionDir is already // listed). A not-yet-materialized resume file (ENOENT) is a valid fresh diff --git a/packages/compass-agent/src/transport/control-source.test.ts b/packages/compass-agent/src/transport/control-source.test.ts index c8dd4b911..323941890 100644 --- a/packages/compass-agent/src/transport/control-source.test.ts +++ b/packages/compass-agent/src/transport/control-source.test.ts @@ -187,7 +187,7 @@ function steerOp(seq: bigint): WireAgentControl { } // A populated steer op: a SteerControl carrying a comms Message with an id and -// one text block (SEA-1310 §8 / SEA-1569 — the channel `@`-mention wire is no +// one text block (RIG-1310 §8 / RIG-1569 — the channel `@`-mention wire is no // longer an empty shell). Mirrors deliverOp. function populatedSteerOp( seq: bigint, @@ -211,7 +211,7 @@ function populatedSteerOp( } // A populated deliver op: a DeliverControl carrying a comms Message with an id -// and one text block (SEA-1310 §8 — the wire is no longer an empty shell). +// and one text block (RIG-1310 §8 — the wire is no longer an empty shell). function deliverOp( seq: bigint, id: string, @@ -432,7 +432,7 @@ test("an empty-shell steer is counted-unmapped, not yielded, and immediate.* is expect(steerUnmapped?.reason).toContain("payload staged"); }); -test("a populated deliver decodes its Message and dispatches it through immediate.deliver (SEA-1310 §8)", async () => { +test("a populated deliver decodes its Message and dispatches it through immediate.deliver (RIG-1310 §8)", async () => { // Non-vacuity: if decodeImmediatePayload still returned undefined for a // deliver, delivers would be empty and the op counted "payload staged" → red; // if the deliver were yielded on the iterable instead of dispatched @@ -468,7 +468,7 @@ test("a populated deliver decodes its Message and dispatches it through immediat expect(staged).toBeUndefined(); }); -test("a populated steer decodes its Message and dispatches it through immediate.steer (SEA-1310 §8)", async () => { +test("a populated steer decodes its Message and dispatches it through immediate.steer (RIG-1310 §8)", async () => { // Non-vacuity: if decodeImmediatePayload returned undefined for a steer, // steers would be empty and the op counted "payload staged" → red; if the // steer were yielded on the iterable instead of dispatched immediately, ops @@ -1234,7 +1234,7 @@ test("F2(d): the SAME drop shape as F2(c) survives indefinitely once ops are APP ); }, 30000); -test("a long apply survives >budget socket flaps — an op in flight is progress (SEA-1540)", async () => { +test("a long apply survives >budget socket flaps — an op in flight is progress (RIG-1540)", async () => { // The latent kill this fix closes. The source is apply-then-ack and its // single consumer (CompassAgent's control loop) awaits the WHOLE turn before // pulling the next op, so while a long turn applies op N the ack cursor @@ -1253,7 +1253,7 @@ test("a long apply survives >budget socket flaps — an op in flight is progress // nothing applied and the in-flight arm gone, `noProgress` climbs one per // drop and the source `buffer.fail`s at open 10, so it never re-opens past // the budget, `overBudget` never fires, and the opens-stalled detector wins - // the race → "failed". That reverted calc IS the SEA-1540 defect. + // the race → "failed". That reverted calc IS the RIG-1540 defect. // // Isolation: like F2(c)/F2(d) the reset-on-open line is the shared premise — // every connection outlives the min-uptime floor (t += 6000 per header), so diff --git a/packages/compass-agent/src/transport/control-source.ts b/packages/compass-agent/src/transport/control-source.ts index 8d832a59c..4c0d42931 100644 --- a/packages/compass-agent/src/transport/control-source.ts +++ b/packages/compass-agent/src/transport/control-source.ts @@ -19,9 +19,9 @@ // mere receipt (P1 #6). // - `steer` / `deliver` are the IMMEDIATE-dispatch class (mid-turn interrupt / // turn-end delivery): processed on the event loop at decode, ahead of any -// queued iterator op. As of SEA-1310 §8 BOTH carry the comms Message on the +// queued iterator op. As of RIG-1310 §8 BOTH carry the comms Message on the // wire (`SteerControl.message` / `DeliverControl.message`, the latter added -// by SEA-1569 (T7)) — decoded here and dispatched through `immediate.steer` / +// by RIG-1569 (T7)) — decoded here and dispatched through `immediate.steer` / // `immediate.deliver`, where the CompassAgent dedups on `msg.id`, injects // (steer as a mid-turn interrupt / idle-start turn; deliver coalesced to a // turn-end prompt), and acks per message. An empty SteerControl (no `message` @@ -31,7 +31,7 @@ // refused-and-counted, never applied. // - `replay` / `config` are also empty shells in C1 (OQ-1) — no payload to seed // context / configure the session — so they too are counted-unmapped at -// decode until SEA-1310 populates them (then yielded like `prompt`). +// decode until RIG-1310 populates them (then yielded like `prompt`). // // Because an immediate op counted at decode is "applied" ahead of an earlier // iterator op still queued behind a running turn (invariant 2), the highest @@ -113,7 +113,7 @@ export const CONTROL_RECONNECT_MIN_UPTIME_MS = 5000; // cursor advanced) OR an op currently in flight — one yielded to the consumer // and awaiting its apply-then-ack. Reset by progress, never by elapsed time. // -// The in-flight arm is load-bearing, not a nicety (SEA-1540). The source is +// The in-flight arm is load-bearing, not a nicety (RIG-1540). The source is // apply-then-ack and its single consumer (CompassAgent's control loop) awaits // the WHOLE turn before pulling the next op, so while a long turn applies op N // the ack cursor cannot advance — op N is acked only when the consumer returns @@ -159,10 +159,10 @@ export const CONTROL_RECONNECT_NO_PROGRESS_MAX = 10; // The immediate-dispatch handle: the SDK actions a mid-turn `steer` / turn-end // `deliver` drives without waiting for the iterator's next pull. Frozen C4 -// signature (design.md C4 Interfaces). As of SEA-1310 §8 the handle carries the +// signature (design.md C4 Interfaces). As of RIG-1310 §8 the handle carries the // full comms `Message` (`.id` intact) — no longer the empty shell of C4b: BOTH // arms decode their `message` field (`SteerControl.message`, populated by -// SEA-1569 (T7); `DeliverControl.message`) and forward it here, where the CompassAgent +// RIG-1569 (T7); `DeliverControl.message`) and forward it here, where the CompassAgent // dedups on `msg.id`, injects (steer as a mid-turn interrupt / idle-start turn; // deliver coalesced to a turn-end prompt), and acks per message. export interface ImmediateControl { @@ -187,9 +187,9 @@ export interface ImmediateControl { } // Decode the immediate-op payload into the comms `Message` the `immediate` -// handle applies. `DeliverControl.message` (SEA-1310 §8) carries the full comms +// handle applies. `DeliverControl.message` (RIG-1310 §8) carries the full comms // Message with its `.id` — return it when present. `SteerControl.message` (added -// by SEA-1569 (T7)) likewise carries the comms Message. An empty SteerControl (no +// by RIG-1569 (T7)) likewise carries the comms Message. An empty SteerControl (no // `message` field) has nothing to read and yields `undefined` → counted-unmapped // (staged) at the caller; a deliver whose `message` is absent is malformed → also // `undefined` → counted-unmapped. The caller never fabricates a payload. @@ -274,7 +274,7 @@ const defaultOnUnmapped = (u: UnmappedEvent): void => * `publishSpine()` ack lane) * @param immediate the SDK steer/deliver actions the immediate path drives — * threaded per the frozen signature; not invoked while the wire carries empty - * shells (OQ-2(A)), SEA-1310 populates the payload + * shells (OQ-2(A)), RIG-1310 populates the payload * @param options optional `onUnmapped` / `now` collaborators */ export function createSocketControlSource( @@ -314,7 +314,7 @@ export function createSocketControlSource( // enforces it locally (invariant 1) — a belt-and-suspenders on the Runner's // hold and CompassAgent's iterator-side barrier. let replayComplete = false; - // SEA-1540: an op is "in flight" when the iterator has yielded it to the + // RIG-1540: an op is "in flight" when the iterator has yielded it to the // consumer and is awaiting the apply-then-ack the next pull proves. Set by // the iterator's next() and read by pump's no-progress budget: a drop while // an apply is in flight is progress, not a wedge — a long turn cannot advance @@ -401,7 +401,7 @@ export function createSocketControlSource( // Immediate-dispatch class. Barrier-enforced (invariant 1): a live // immediate op before ReplayComplete is refused-and-counted. Otherwise // decode the payload: both STEER and DELIVER carry the comms Message - // (SEA-1310 §8; steer's `message` field populated by SEA-1569 (T7)) and + // (RIG-1310 §8; steer's `message` field populated by RIG-1569 (T7)) and // dispatch through `immediate.steer` / `immediate.deliver`. An empty // SteerControl (no `message` field) decodes to undefined and is // counted-unmapped (staged) without fabricating a payload (OQ-2(A)). @@ -416,7 +416,7 @@ export function createSocketControlSource( } else if (msg === undefined) { count( `control:${kind}`, - "empty-shell steer/deliver — payload staged (SEA-1310)", + "empty-shell steer/deliver — payload staged (RIG-1310)", ); } else if (wire.control.case === "steer") { immediate.steer(msg, wire.control.value.fromHandle); @@ -431,11 +431,11 @@ export function createSocketControlSource( case "replay": case "config": { // Empty shells in C1 (OQ-1): no payload to seed context / configure the - // session, so counted-unmapped at decode. SEA-1310 populates them and + // session, so counted-unmapped at decode. RIG-1310 populates them and // they flow through the iterable like prompt. count( `control:${kind}`, - "empty-shell replay/config — payload staged (SEA-1310)", + "empty-shell replay/config — payload staged (RIG-1310)", ); acks.markApplied(seq); return; @@ -498,7 +498,7 @@ export function createSocketControlSource( // genuinely new application (a redelivery the source dedups and re-acks is // correctly NOT progress), and the in-flight arm keeps a long apply // mid-turn — which cannot advance the cursor until the consumer returns for - // the next op — from reading as a wedge (SEA-1540). + // the next op — from reading as a wedge (RIG-1540). let noProgress = 0; let appliedAtLastDrop = acks.appliedCount; for (;;) { @@ -591,7 +591,7 @@ export function createSocketControlSource( // an op in flight at drop time (`applyInFlight`) — a long apply // mid-turn cannot advance the ack cursor until the consumer returns for // the next op, so without the in-flight arm a healthy session flapping - // during one long turn would be killed mid-apply (SEA-1540). Either arm + // during one long turn would be killed mid-apply (RIG-1540). Either arm // zeroes the counter, so a healthy session is untouched however widely // its blips are spaced — the distinction a reconnect-RATE window could // not draw, since a healthy sparse-blip session and a socket wedging at diff --git a/packages/compass-agent/src/transport/control/ack-cursor.test.ts b/packages/compass-agent/src/transport/control/ack-cursor.test.ts index 47f928da8..f47c928fc 100644 --- a/packages/compass-agent/src/transport/control/ack-cursor.test.ts +++ b/packages/compass-agent/src/transport/control/ack-cursor.test.ts @@ -1,4 +1,4 @@ -// The AckCursor's progress signal (SEA-1364 C4b follow-up hardening). +// The AckCursor's progress signal (RIG-1364 C4b follow-up hardening). // // `appliedCount` is not bookkeeping — the Control source's no-progress // reconnect budget reads it as its ONLY termination signal for a slow-flapping diff --git a/packages/compass-agent/src/transport/control/ack-cursor.ts b/packages/compass-agent/src/transport/control/ack-cursor.ts index 72c8aae15..775d61dec 100644 --- a/packages/compass-agent/src/transport/control/ack-cursor.ts +++ b/packages/compass-agent/src/transport/control/ack-cursor.ts @@ -24,7 +24,7 @@ import type { PublishSpine } from "./../publish-spine"; // 1999 immediate applies serializes 1,999,000 seqs onto the priority lane, // which is never dropped — unlike the trace queue's `TRACE_QUEUE_CAP` // drop-oldest there is no backstop here. Range-encoding `applied_above` is the -// fix and lands in SEA-1466; this file only documents and exposes the growth. +// fix and lands in RIG-1466; this file only documents and exposes the growth. // `markApplied` is idempotent — a redelivered already-applied op // re-acks (so the Runner retires it) without corrupting the cursor. Every apply // emits a `ControlAck` on the shared Publish spine's priority lane; the Runner @@ -40,7 +40,7 @@ export class AckCursor { } // Current size of the out-of-order applied set — the observability seam for - // the unbounded growth documented above; range-encoding lands in SEA-1466. + // the unbounded growth documented above; range-encoding lands in RIG-1466. get pendingAbove(): number { return this.#above.size; } diff --git a/packages/compass-agent/src/transport/control/buffer.test.ts b/packages/compass-agent/src/transport/control/buffer.test.ts index 894957bbf..d58f025b7 100644 --- a/packages/compass-agent/src/transport/control/buffer.test.ts +++ b/packages/compass-agent/src/transport/control/buffer.test.ts @@ -1,4 +1,4 @@ -// The AsyncBuffer single-consumer contract (SEA-1364 C4b follow-up hardening). +// The AsyncBuffer single-consumer contract (RIG-1364 C4b follow-up hardening). // // AsyncBuffer is the queue behind the socket ControlSource's iterable, and it // holds AT MOST ONE parked consumer (`#waiting`). Before the guard, a second diff --git a/packages/compass-agent/src/transport/frame-sink.test.ts b/packages/compass-agent/src/transport/frame-sink.test.ts index ddc9a646a..2ff84d673 100644 --- a/packages/compass-agent/src/transport/frame-sink.test.ts +++ b/packages/compass-agent/src/transport/frame-sink.test.ts @@ -176,7 +176,7 @@ function lifecycleFrame(state: AgentSessionState): OutboundFrame { } // A durable transcript frame — the surviving rider on the PostConversationFrame -// unary (SEA-1570). `seq` disambiguates frames within a test. +// unary (RIG-1570). `seq` disambiguates frames within a test. function transcriptFrame(seq: bigint): OutboundFrame { return { kind: "transcriptEntry", @@ -560,7 +560,7 @@ test("STOPPED leads across cycled batches with a live consumer and loses no trac }); test("a deliveryAck rides the Publish PRIORITY lane, not the durable unary", async () => { - // SEA-1310 §8: a per-message delivery receipt is a control-plane ack. Per the + // RIG-1310 §8: a per-message delivery receipt is a control-plane ack. Per the // spine contract (publish-spine.ts:24-26,62) it rides the Publish spine's // never-drop PRIORITY lane, NOT the durable PostConversationFrame unary — the // Runner gateway's isConversationFrame guard REJECTS an ack on that unary, so @@ -638,7 +638,7 @@ function spineTransport(spine: PublishSpine): RunnerTransport { } test("a deliveryAck rides the Publish PRIORITY sub-lane, never the drop-oldest trace queue", () => { - // SEA-1310 §8 (re-review MEDIUM): the socket-level test above pins + // RIG-1310 §8 (re-review MEDIUM): the socket-level test above pins // Publish-not-durable but CANNOT distinguish enqueuePriority from // enqueueTrace (both land on publishFrames). A future edit flipping emit()'s // deliveryAck arm (frame-sink.ts:178) to enqueueTrace would compile and pass diff --git a/packages/compass-agent/src/transport/frame-sink.ts b/packages/compass-agent/src/transport/frame-sink.ts index 9b9624974..eba0ce028 100644 --- a/packages/compass-agent/src/transport/frame-sink.ts +++ b/packages/compass-agent/src/transport/frame-sink.ts @@ -9,12 +9,12 @@ // terminal STOPPED) is a PRIORITY frame the spine never drops and flushes // ahead of the trace backlog; a trace-only frame (state UNSPECIFIED) rides // the bounded, drop-oldest trace queue. -// - a "transcriptEntry" frame is DURABLE (SEA-1570): it is sent on the +// - a "transcriptEntry" frame is DURABLE (RIG-1570): it is sent on the // PostConversationFrame UNARY via emitDurable(), awaited, and retried with // bounded backoff until delivered-or-erred, carrying an agent-minted // idempotency_key so a lost-response retry is deduped by the Runner (C2), // never duplicated. It is NEVER dropped on a reconnect. -// - a "deliveryAck" frame is a control-plane ack (SEA-1310 §8): it rides the +// - a "deliveryAck" frame is a control-plane ack (RIG-1310 §8): it rides the // Publish spine's never-drop PRIORITY lane, ahead of the trace backlog. It // is NOT durable — the Runner's isConversationFrame guard REJECTS an ack on // the PostConversationFrame unary; the Runner consumes it off the @@ -278,7 +278,7 @@ export function createSocketFrameSink(transport: RunnerTransport): FrameSink { frame.kind === "forgeNotificationAck" ) { // A per-notification/message delivery receipt is a control-plane ack - // (SEA-1310 §8; RIG-2732 W3 forge ack): it rides the Publish spine's + // (RIG-1310 §8; RIG-2732 W3 forge ack): it rides the Publish spine's // never-drop PRIORITY lane, NOT the durable unary. The Runner's // isConversationFrame guard REJECTS an ack on the PostConversationFrame // unary (post_conversation_frame.go:94-108), and its consume side @@ -297,7 +297,7 @@ export function createSocketFrameSink(transport: RunnerTransport): FrameSink { }, emitDurable(frame: OutboundFrame): Promise { - // SEA-1570 transcript lane: the durable send is forked into the FiberSet + // RIG-1570 transcript lane: the durable send is forked into the FiberSet // (same drain tracking as emit's launch), but its definitive give-up // PROPAGATES to the caller so the tee backend can buffer/retry/fatal (R4). // The Deferred→promise reject bridge is wired at FORK time (design record diff --git a/packages/compass-agent/src/transport/index.test.ts b/packages/compass-agent/src/transport/index.test.ts index 00c8f8b6c..b4f47959c 100644 --- a/packages/compass-agent/src/transport/index.test.ts +++ b/packages/compass-agent/src/transport/index.test.ts @@ -1,4 +1,4 @@ -// The T4 transport contract (SEA-1351): createUnixSocketTransport must dial a +// The T4 transport contract (RIG-1351): createUnixSocketTransport must dial a // Runner-style Unix socket, speak h2c to the AgentGateway.Comms RPC, and return // the typed CommsCallResult. These tests stand up a real connect-node h2c server // bound to a Unix socket and drive an actual comms() call through it — proving diff --git a/packages/compass-agent/src/transport/index.ts b/packages/compass-agent/src/transport/index.ts index cadf3316b..227cd2f38 100644 --- a/packages/compass-agent/src/transport/index.ts +++ b/packages/compass-agent/src/transport/index.ts @@ -1,6 +1,6 @@ // The agent side of the agent->Runner call transport: a RunnerCallTransport over // a Connect client that dials the Runner's per-container Unix socket -// (design docs/designs/product/compass-agent-runner-transport/design.md, SEA-1351 +// (design docs/designs/product/compass-agent-runner-transport/design.md, RIG-1351 // T4). The in-container first-party agent reaches its Runner over a bind-mounted // Unix socket — a local hop, no network path, so the egress seal is untouched. // @@ -37,7 +37,7 @@ import { setTransportRuntime } from "./runtime-channel"; /** * The agent's handle on the AgentGateway RPCs over the Runner socket. T4 - * (SEA-1351) landed `comms`; the transport-consolidation C4 lane extends it with + * (RIG-1351) landed `comms`; the transport-consolidation C4 lane extends it with * the frame/control spine the socket sink + source ride: * * - `comms` — the agent-initiated comms call, consumed by the comms-tools diff --git a/packages/compass-client/src/gen/compass/v1/comms_pb.ts b/packages/compass-client/src/gen/compass/v1/comms_pb.ts index 0b57c7708..4cd0a4fe7 100644 --- a/packages/compass-client/src/gen/compass/v1/comms_pb.ts +++ b/packages/compass-client/src/gen/compass/v1/comms_pb.ts @@ -719,7 +719,7 @@ export type AskQuestion = Message$1<"compass.v1.AskQuestion"> & { /** * True when the answer was recorded by timeout auto-selection rather than a - * participant (SEA-1310 owns whether/when the Compass answer path can time + * participant (RIG-1310 owns whether/when the Compass answer path can time * out; the field is the audit carrier either way). * * @generated from field: bool timed_out = 9; @@ -875,7 +875,7 @@ export type SubscribeCommsResponse = Message$1<"compass.v1.SubscribeCommsRespons case: "resyncRequired"; } | { /** - * A live agent's presence changed (SEA-1569). Derived from the session + * A live agent's presence changed (RIG-1569). Derived from the session * lifecycle (not a heartbeat); PUBLIC — UI board state consumes it. * * @generated from field: compass.v1.AgentPresenceChanged agent_presence_changed = 17; @@ -1070,7 +1070,7 @@ export const CommsResyncRequiredSchema: GenMessage = /*@__P messageDesc(file_compass_v1_comms, 23); /** - * A live agent's presence changed (SEA-1569). Presence is derived from the + * A live agent's presence changed (RIG-1569). Presence is derived from the * session lifecycle (D4) — a projection of the session state and the Runner * link, not a heartbeat. PUBLIC (UI board state, comms presence, the * delivery-settle gate consume it); NOT gen-fenced. @@ -2318,7 +2318,7 @@ export const ChannelKindSchema: GenEnum = /*@__PURE__*/ enumDesc(file_compass_v1_comms, 3); /** - * The presence states a live agent projects (SEA-1569, OQ-1). MVP is four + * The presence states a live agent projects (RIG-1569, OQ-1). MVP is four * states derived from the session lifecycle; PUBLIC, NOT gen-fenced. * * @generated from enum compass.v1.AgentPresence diff --git a/packages/compass-client/src/gen/compass/v1/compass_pb.ts b/packages/compass-client/src/gen/compass/v1/compass_pb.ts index db8ae4bd2..9b6783c44 100644 --- a/packages/compass-client/src/gen/compass/v1/compass_pb.ts +++ b/packages/compass-client/src/gen/compass/v1/compass_pb.ts @@ -1054,7 +1054,7 @@ export type ProvisionAgentWorkspaceRequest = Message<"compass.v1.ProvisionAgentW agentAccountId: string; /** - * Repo carriage removed (SEA-1527, Matt 2026-07-29): spawn/provision no longer + * Repo carriage removed (RIG-1527, Matt 2026-07-29): spawn/provision no longer * clone a repo for the agent. The container is provisioned with a git * credential + workspace and the agent self-clones whatever it needs after * launch. @@ -1193,7 +1193,7 @@ export type StartAgentSessionRequest = Message<"compass.v1.StartAgentSessionRequ * logical session: the Server (subscriber-authz gated) reconstructs the * stored transcript into a session-JSONL body the Runner materializes into * the new container at provision. Empty = fresh. No storage locator ever - * rides any request — storage is Server-internal (SEA-1570). + * rides any request — storage is Server-internal (RIG-1570). * * @generated from field: string resume_session_id = 3; */ @@ -2057,7 +2057,7 @@ export type TrackerRef = Message<"compass.v1.TrackerRef"> & { kind: string; /** - * the tracker's native issue id, e.g. "SEA-1042" + * the tracker's native issue id, e.g. "RIG-1042" * * @generated from field: string id = 2; */ @@ -2291,7 +2291,7 @@ export const ServerStateSchema: GenEnum = /*@__PURE__*/ * applies as written). OQ6, design docs/designs/platform/go-toolchain-default.md * :1378-1396. * - * Scope: T4 (SEA-1243) ships the DISCONNECTED *signal* only. The server-side + * Scope: T4 (RIG-1243) ships the DISCONNECTED *signal* only. The server-side * reattach-window enforcement — the per-session registry, the bounded timer, * the expiry→ERRORED transition, and GetAgentStatus reconciliation on reattach * — is T9 (go-toolchain-default.md:979). Until T9 lands, a dropped Runner link @@ -2419,7 +2419,7 @@ export const AgentPlanEntryStatusSchema: GenEnum = /*@__PU * steer/deliver control discriminant (agent.proto), re-declared here on the * public surface because SessionEvent — the public SubscribeAgentSession payload * — cannot reference the fenced internal enum without breaching the gen-fence - * (SEA-1267); see the steer/deliver-seam design record, OQ2. + * (RIG-1267); see the steer/deliver-seam design record, OQ2. * * @generated from enum compass.v1.SessionInjectionKind */ @@ -2824,7 +2824,7 @@ export const CompassService: GenService<{ * (enforced in the handler: caller account kind == User, an agent account is * rejected PermissionDenied); ListSecrets is callable by user AND agent tokens * (the Setup agent drives it). The proto carries no gate — authz is the - * handler's (SEA-1327 T7). + * handler's (RIG-1327 T7). * * @generated from service compass.v1.SecretsService */ diff --git a/proto/compass/v1/agent.proto b/proto/compass/v1/agent.proto index 02deefc25..7ab0daa0e 100644 --- a/proto/compass/v1/agent.proto +++ b/proto/compass/v1/agent.proto @@ -71,14 +71,14 @@ message AgentFrame { // the cursor and drops the individually-acked ones. ControlAck control_ack = 5; // delivery_ack — the agent's per-message delivery receipt for a - // DeliverControl relayed down the session (SEA-1569). The success + // DeliverControl relayed down the session (RIG-1569). The success // receipt for a delivery rides this frame, not the Runner result // stream (RT-3); the Server advances the delivery cursor on it. DeliveryAck delivery_ack = 6; // transcript_entry — one committed SDK session entry, teed upstream on // the DURABLE conversation-frame lane (PostConversationFrame → // CommitConversationFrame), not the loss-tolerable Publish spine - // (SEA-1570). The Server persists it; the agent's local copy is + // (RIG-1570). The Server persists it; the agent's local copy is // container-ephemeral. Reconstructed into a session-JSONL body on // resume (T4/T5). TranscriptEntry transcript_entry = 7; @@ -93,7 +93,7 @@ message AgentFrame { // The `transcript_entry` variant's payload: one committed SDK session entry, // teed upstream by the agent's session-storage backend as a durable frame -// (SEA-1570). `append` → a delta entry (checkpoint = false); `writeFull` (an +// (RIG-1570). `append` → a delta entry (checkpoint = false); `writeFull` (an // SDK compaction/title rewrite) → a checkpoint entry (checkpoint = true, the // full body as one payload). INTERNAL-only, like the rest of this file. message TranscriptEntry { @@ -152,10 +152,10 @@ message SessionFrame { // `AgentMessage` (a four-way union with an opaque provider payload) and a tool // set (whose SDK representation includes a non-serializable `execute` handle), // neither of which any existing compass.v1 message represents. That payload- -// shape decision is parked (SEA-1310); the shells keep the oneof complete on +// shape decision is parked (RIG-1310); the shells keep the oneof complete on // the wire and are populated by a stacked PR once the shapes settle // (DeliverControl and the channel-borne SteerControl were so populated by -// SEA-1569, each carrying a comms Message). Defining the empty shells now is +// RIG-1569, each carrying a comms Message). Defining the empty shells now is // additive and buf-breaking-safe (field additions to a proto3 message). message AgentControl { // Runner-assigned, monotonic per session: the retention/redelivery cursor @@ -187,12 +187,12 @@ message PromptControl { message ReplayComplete {} // SteerControl carries a comms Message: a channel `@`-mention routed into the -// agent's live session as a steer (SEA-1569), sourced from a channel +// agent's live session as a steer (RIG-1569), sourced from a channel // PostMessage, wrapped in an AgentControl and relayed via the runner control // seam (DispatchControl) — the same path DeliverControl rides, carrying the // same single first-party Message (DL-073; no seq, the id is in the Message). // The generic SDK-AgentMessage steer (Runner-originated, outside any channel) -// stays parked under SEA-1310. +// stays parked under RIG-1310. message SteerControl { // The mention message to steer into the session. Message message = 1; @@ -205,7 +205,7 @@ message SteerControl { string from_handle = 2; } -// Empty shells — payload fields parked (SEA-1310). Present so the AgentControl +// Empty shells — payload fields parked (RIG-1310). Present so the AgentControl // oneof is complete on the wire; populated by a stacked PR. // TranscriptReplay carries an inbound SDK AgentMessage; // ConfigControl carries a tool set. @@ -213,9 +213,9 @@ message TranscriptReplay {} message ConfigControl {} // DeliverControl carries a comms Message to deliver into the agent's live -// session (SEA-1569): the Server wraps it in an AgentControl and relays it via +// session (RIG-1569): the Server wraps it in an AgentControl and relays it via // the runner control seam (DispatchControl); the Runner writes it down the -// per-container socket. Populated from the SEA-1310 parked shell. +// per-container socket. Populated from the RIG-1310 parked shell. message DeliverControl { // The message to deliver into the session. Message message = 1; @@ -235,7 +235,7 @@ message DeliverControl { string from_handle = 3; } -// DeliveryAck — the agent's per-message delivery receipt (SEA-1569), an +// DeliveryAck — the agent's per-message delivery receipt (RIG-1569), an // AgentFrame oneof variant riding the Publish spine. Correlates to the // delivered message by id; on receipt the Server advances the delivery cursor // (the success receipt for a delivery, per RT-3 — not a Runner result). diff --git a/proto/compass/v1/agent_gateway.proto b/proto/compass/v1/agent_gateway.proto index 6732ef314..db5744d8f 100644 --- a/proto/compass/v1/agent_gateway.proto +++ b/proto/compass/v1/agent_gateway.proto @@ -1,5 +1,5 @@ // The compass.v1 agent->Runner call transport (design -// docs/designs/product/compass-agent-runner-transport/design.md, SEA-1351 T1). +// docs/designs/product/compass-agent-runner-transport/design.md, RIG-1351 T1). // // INTERNAL-ONLY surface. Unlike compass.proto / comms.proto — the public, // generated-client door between a UI and the Server — AgentGateway is the @@ -428,7 +428,7 @@ message PostConversationFrameRequest { AgentFrame frame = 1; // Agent-minted, stable across retries of the same logical frame; the Runner // commits at-most-once per key so a lost-response retry is not duplicated. An - // ENVELOPE field (dedup), not a payload field — SEA-1310's parked payload + // ENVELOPE field (dedup), not a payload field — RIG-1310's parked payload // decision is untouched. string idempotency_key = 2; } diff --git a/proto/compass/v1/comms.proto b/proto/compass/v1/comms.proto index ffa627c6b..b2cbfd036 100644 --- a/proto/compass/v1/comms.proto +++ b/proto/compass/v1/comms.proto @@ -427,7 +427,7 @@ message AskQuestion { // for allow_multiple, alongside) picking options. string custom_text = 8; // True when the answer was recorded by timeout auto-selection rather than a - // participant (SEA-1310 owns whether/when the Compass answer path can time + // participant (RIG-1310 owns whether/when the Compass answer path can time // out; the field is the audit carrier either way). bool timed_out = 9; } @@ -484,7 +484,7 @@ message SubscribeCommsResponse { AccountChanged account_changed = 14; AgentWorkspaceChanged agent_workspace_changed = 15; CommsResyncRequired resync_required = 16; - // A live agent's presence changed (SEA-1569). Derived from the session + // A live agent's presence changed (RIG-1569). Derived from the session // lifecycle (not a heartbeat); PUBLIC — UI board state consumes it. AgentPresenceChanged agent_presence_changed = 17; // A topic was created, renamed, merged, or archived (Zulip threading model) @@ -546,7 +546,7 @@ message AgentWorkspaceChanged { // Mirrors compass.proto's ResyncRequired. message CommsResyncRequired {} -// A live agent's presence changed (SEA-1569). Presence is derived from the +// A live agent's presence changed (RIG-1569). Presence is derived from the // session lifecycle (D4) — a projection of the session state and the Runner // link, not a heartbeat. PUBLIC (UI board state, comms presence, the // delivery-settle gate consume it); NOT gen-fenced. @@ -560,7 +560,7 @@ message AgentPresenceChanged { string activity = 3; } -// The presence states a live agent projects (SEA-1569, OQ-1). MVP is four +// The presence states a live agent projects (RIG-1569, OQ-1). MVP is four // states derived from the session lifecycle; PUBLIC, NOT gen-fenced. enum AgentPresence { AGENT_PRESENCE_UNSPECIFIED = 0; diff --git a/proto/compass/v1/compass.proto b/proto/compass/v1/compass.proto index c7187bb5f..60af43ddb 100644 --- a/proto/compass/v1/compass.proto +++ b/proto/compass/v1/compass.proto @@ -174,7 +174,7 @@ enum SecretKind { // (enforced in the handler: caller account kind == User, an agent account is // rejected PermissionDenied); ListSecrets is callable by user AND agent tokens // (the Setup agent drives it). The proto carries no gate — authz is the -// handler's (SEA-1327 T7). +// handler's (RIG-1327 T7). service SecretsService { // Declare a secret's registry row (name/delivery/kind/routing) and write its // value via the resolver. User-only. `value` is never logged. @@ -366,7 +366,7 @@ message AgentSessionStatus { // applies as written). OQ6, design docs/designs/platform/go-toolchain-default.md // :1378-1396. // -// Scope: T4 (SEA-1243) ships the DISCONNECTED *signal* only. The server-side +// Scope: T4 (RIG-1243) ships the DISCONNECTED *signal* only. The server-side // reattach-window enforcement — the per-session registry, the bounded timer, // the expiry→ERRORED transition, and GetAgentStatus reconciliation on reattach // — is T9 (go-toolchain-default.md:979). Until T9 lands, a dropped Runner link @@ -536,7 +536,7 @@ message SessionInjection { // steer/deliver control discriminant (agent.proto), re-declared here on the // public surface because SessionEvent — the public SubscribeAgentSession payload // — cannot reference the fenced internal enum without breaching the gen-fence -// (SEA-1267); see the steer/deliver-seam design record, OQ2. +// (RIG-1267); see the steer/deliver-seam design record, OQ2. enum SessionInjectionKind { SESSION_INJECTION_KIND_UNSPECIFIED = 0; SESSION_INJECTION_KIND_STEER = 1; @@ -565,7 +565,7 @@ message ProvisionAgentWorkspaceRequest { // from CommsService). Names whose credentials + home channel the container // is provisioned for. string agent_account_id = 1; - // Repo carriage removed (SEA-1527, Matt 2026-07-29): spawn/provision no longer + // Repo carriage removed (RIG-1527, Matt 2026-07-29): spawn/provision no longer // clone a repo for the agent. The container is provisioned with a git // credential + workspace and the agent self-clones whatever it needs after // launch. @@ -631,7 +631,7 @@ message StartAgentSessionRequest { // logical session: the Server (subscriber-authz gated) reconstructs the // stored transcript into a session-JSONL body the Runner materializes into // the new container at provision. Empty = fresh. No storage locator ever - // rides any request — storage is Server-internal (SEA-1570). + // rides any request — storage is Server-internal (RIG-1570). string resume_session_id = 3; } @@ -900,7 +900,7 @@ message ChangedStats { // no-write-to-self elision keys off `kind`+`id`. message TrackerRef { string kind = 1; // "linear" | "jira" | "github" — the tracker family - string id = 2; // the tracker's native issue id, e.g. "SEA-1042" + string id = 2; // the tracker's native issue id, e.g. "RIG-1042" string status = 3; // the tracker's native status name in the user's org string url = 4; } diff --git a/proto/compass/v1/forge.proto b/proto/compass/v1/forge.proto index d58ef5fbf..42abbbe91 100644 --- a/proto/compass/v1/forge.proto +++ b/proto/compass/v1/forge.proto @@ -1,4 +1,4 @@ -// The compass.v1 forge notification + shared carrier leaf (SEA-1731 A1, design +// The compass.v1 forge notification + shared carrier leaf (RIG-1731 A1, design // docs/designs/product/compass-server-ownership-layer-amendment/design.md §A1). // // INTERNAL-ONLY surface. Like agent.proto / agent_gateway.proto / runner.proto, diff --git a/proto/compass/v1/guest_control.proto b/proto/compass/v1/guest_control.proto index bbba72d42..60a5a954d 100644 --- a/proto/compass/v1/guest_control.proto +++ b/proto/compass/v1/guest_control.proto @@ -13,7 +13,7 @@ // It is generated ONLY into the internal Go lane (guestd's handler + the host's // client via buf.gen.internal-go.yaml -> go/internal/gen), never onto the // public @compass/client surface or any TS lane — a host<->guest control plane -// is not a server-door client, so the SEA-1267 gen-fence intent holds. The +// is not a server-door client, so the RIG-1267 gen-fence intent holds. The // public buf.gen.yaml excludes this file; buf.gen.agent-ts.yaml (an allowlist) // simply never lists it. // diff --git a/proto/compass/v1/runner.proto b/proto/compass/v1/runner.proto index 825910e3e..36fa21829 100644 --- a/proto/compass/v1/runner.proto +++ b/proto/compass/v1/runner.proto @@ -163,7 +163,7 @@ service RunnerService { rpc CommitConversationFrame(CommitConversationFrameRequest) returns (CommitConversationFrameResponse); // FetchSecrets (unary, Runner->Server): the Runner fetches the full resolved - // secret set for one session to materialize into the agent container (SEA-1327 + // secret set for one session to materialize into the agent container (RIG-1327 // T4). Inject-all: no name filter, no per-agent grants (the filter is the // named future per-agent-scoping seam). The response is no-log: a logging // interceptor must never dump resolved values. Additive to the frozen dial-out @@ -172,7 +172,7 @@ service RunnerService { // FetchAgentConfig (server-streaming, Runner->Server): the Runner fetches the // fleet config bundle to materialize into the agent container at provision - // (SEA-1568 T3/T4). Server-streaming so the bundle is never bounded by the + // (RIG-1568 T3/T4). Server-streaming so the bundle is never bounded by the // connect/gRPC unary recv cap: the first response frame carries the version, // subsequent frames carry the tarball bytes in chunks. The security caps // (decompressed size, file count) live at unpack (T1's door, re-enforced at @@ -251,14 +251,14 @@ message SessionsResponse { SecretsVersion secrets_version = 8; // config_version (tag 9): the Server signals the fleet that the config // bundle changed; the Runner re-fetches via FetchAgentConfig, re-materializes - // the new version dir, and Reloads live agents in place (SEA-1568 T3/T6). + // the new version dir, and Reloads live agents in place (RIG-1568 T3/T6). // Fleet-wide, no per-account key. Signal-only — never carries bytes, and, // like secrets_version, is NOT request_id-correlated and has NO // SessionsRequest result variant: it is a notification, not a command, so the // Runner sends no result frame for it. Sibling to secrets_version (tag 8). ConfigVersion config_version = 9; // deliver_control (tag 11; 8 secrets_version / 9 config_version / 10 remove / - // 11 deliver_control landed): the Server relays a control op — for SEA-1569, a message + // 11 deliver_control landed): the Server relays a control op — for RIG-1569, a message // delivery — down to the Runner, which writes it to the session's // per-container socket. Carries the op as payload (DispatchControl). No // SUCCESS result variant: the delivery receipt rides AgentFrame.delivery_ack @@ -274,7 +274,7 @@ message SessionsResponse { RemoveAgentWorkspaceRequest remove = 10; } // resume_body — the INTERNAL resume-body carrier, a TOP-LEVEL sibling of - // request_id OUTSIDE the command oneof (SEA-1570): the Server attaches it on + // request_id OUTSIDE the command oneof (RIG-1570): the Server attaches it on // an authorized resume start beside the verbatim public `start` request, // which itself carries only the authz-checked resume_session_id (no locator, // = 8 and deliver_control = 11, and 12 is skipped (the design-abandoned @@ -284,7 +284,7 @@ message SessionsResponse { } // ResumeBody — the INTERNAL resume-body carrier attached to SessionsResponse on -// an authorized resume (SEA-1570). Additive, INTERNAL-ONLY: rides the +// an authorized resume (RIG-1570). Additive, INTERNAL-ONLY: rides the // path-filtered internal gen lane, never the public client surface. The Server // attaches it; no client can supply it, and the public `start` request is // relayed verbatim (T6). @@ -292,12 +292,12 @@ message ResumeBody { // The reconstructed post-supersession session-JSONL body (T5) — string, // consistent with TranscriptEntry.entry_json. string session_body = 1; - // Inline-image blob bytes are OUT of MVP scope (SEA-1582): no grounded + // Inline-image blob bytes are OUT of MVP scope (RIG-1582): no grounded // agent-side capture seam exists, so the carrier holds only the JSONL body. } // DispatchControl — the Server->Runner relay envelope for a control op -// (SEA-1569). Carries the full AgentControl op (for a delivery, +// (RIG-1569). Carries the full AgentControl op (for a delivery, // AgentControl{ deliver: DeliverControl{ message } }); the Runner relays op // down the addressed session's per-container socket. Payload-carrying, not // signal-only. @@ -311,7 +311,7 @@ message DispatchControl { // FetchSecrets request: which agent's secret set to resolve. Inject-all — no // name filter. The caller sets exactly one selector: a `container_name` for the // PROVISION-time initial materialize (the container→account binding exists from -// Provision, before any session is minted — SEA-1327 T5 materializes before the +// Provision, before any session is minted — RIG-1327 T5 materializes before the // agent is exec'd), or a `session_id` for the post-Start rotation re-fetch (the // SecretsVersion signal path, T6). The two are mutually exclusive by convention, // not a oneof: session_id kept tag 1 with its original flat cardinality so the @@ -416,7 +416,7 @@ enum RunnerErrorCode { // Connect Internal. RUNNER_ERROR_CODE_INTERNAL = 3; // A delivery (deliver_control) was refused because the session's retention - // buffer is full (SEA-1569) -> Connect ResourceExhausted. Distinguishes a + // buffer is full (RIG-1569) -> Connect ResourceExhausted. Distinguishes a // retention-full refusal in-band so the Server can leave the delivery cursor // unadvanced and redeliver. RUNNER_ERROR_CODE_RESOURCE_EXHAUSTED = 4; @@ -554,7 +554,7 @@ message RelayBoardCallResponse { // (resolved to an account Server-side, fail-closed — see the RPC comment). // `frame` is constrained by the agent side to a conversation_posted / // conversation_updated / transcript_entry AgentFrame variant (the durable lane -// carries the SEA-1570 transcript entry too; the same C4 constraint Publish +// carries the RIG-1570 transcript entry too; the same C4 constraint Publish // telemetry frames are held to). `idempotency_key` is the agent-minted envelope // key reused verbatim from AgentGateway.PostConversationFrameRequest. message CommitConversationFrameRequest { diff --git a/proto/moon.yml b/proto/moon.yml index 6a484d050..3f95759d5 100644 --- a/proto/moon.yml +++ b/proto/moon.yml @@ -102,7 +102,7 @@ tasks: - '/go/internal/gen/**/*' - '/devenv.lock' gen-fence: - # SEA-1267 enforcement, and distinct from drift: drift only catches a schema + # RIG-1267 enforcement, and distinct from drift: drift only catches a schema # edit that wasn't regenerated. It CANNOT catch a forgotten `exclude_paths` # entry — once an internal symbol leaks into a public tree and is committed, # regen reproduces it and drift passes green. This check is the real fence: @@ -112,8 +112,8 @@ tasks: # symbol list as internal messages are added. Current internal surfaces: # agent.proto (AgentFrame/AgentControl/SessionFrame + the AgentControl # payload messages + the ReplayCompleteAck/ControlAck AgentFrame ack - # variants + the SEA-1570 TranscriptEntry frame payload) + runner.proto - # (RunnerService/RunnerError + the SEA-1570 ResumeBody carrier + the SEA-1568 + # variants + the RIG-1570 TranscriptEntry frame payload) + runner.proto + # (RunnerService/RunnerError + the RIG-1570 ResumeBody carrier + the RIG-1568 # FetchAgentConfig* RPC messages and the ConfigVersion signal) + # agent_gateway.proto # (AgentGateway + the CommsCall* envelopes it defines: CommsCallRequest/ @@ -123,7 +123,7 @@ tasks: # RelayLifecycleCall* (like RelayCommsCall*) is a runner.proto internal # envelope. `compassv1internal` # catches any Go-package leak regardless of message name. - # forge.proto (SEA-1731 A1): the ForgeCall* carrier family + RelayForgeCall* + # forge.proto (RIG-1731 A1): the ForgeCall* carrier family + RelayForgeCall* # (the ForgeCallRequest/Result/Error envelopes, agent_gateway.proto, and the # runner.proto relay pair), the seven forge op requests + ListIssuesResponse + # Subscribe/UnsubscribeForge*, and the forge.proto leaf itself @@ -151,7 +151,7 @@ tasks: # is load-bearing for the public AgentSessionFrame (compass.proto, a frozen # contract): it contains "SessionFrame" as a substring, so an unanchored # grep false-fires the moment it generates into a public tree - # (SEA-1267/OQ-2.4). Word boundaries also future-proof the others (a public + # (RIG-1267/OQ-2.4). Word boundaries also future-proof the others (a public # "AgentControlFoo" would not trip "AgentControl"). AgentGateway and CommsCall # stay UNANCHORED (prefix-matched) on purpose: the generated identifiers are # families — AgentGatewayService and CommsCallRequest/CommsCallResult/ @@ -159,14 +159,14 @@ tasks: # symbols. Internal symbols only ever leak as whole identifiers (a generated # type name or a `compassv1internal.` package ref), never as a substring, so # this mix still catches every real leak. - script: 'if grep -rlE "\bAgentFrame\b|\bAgentControl\b|\bSessionFrame\b|\bReplayCompleteAck\b|\bControlAck\b|\bDeliveryAck\b|\bTranscriptEntry\b|\bPromptControl\b|\bReplayComplete\b|\bSteerControl\b|\bDeliverControl\b|\bDispatchControl\b|\bResumeBody\b|\bTranscriptReplay\b|\bConfigControl\b|\bConfigVersion\b|\bRunnerService\b|\bRunnerError\b|GuestControl|AgentGateway|CommsCall|LifecycleCall|SpawnPeer|DespawnPeer|RelayLifecycleCall|FetchAgentConfig|PublishFrame|PostConversationFrame|ControlSubscribe|BoardCall|SetIssueState|ForgeCall|ForgeNotification|\bForgeArtifactKind\b|SubscribeForge|UnsubscribeForge|\bCommentRef\b|\bCreateIssueRequest\b|\bCommentOnIssueRequest\b|\bGetIssueRequest\b|\bListIssuesRequest\b|\bListIssuesResponse\b|\bCreatePullRequestRequest\b|\bCommentOnPullRequestRequest\b|\bGetPullRequestRequest\b|\bcompassv1internal\b" packages/compass-client/src/gen go/gen; then echo "SEA-1267 FENCE VIOLATION: internal-only symbol found in a PUBLIC gen tree above — an internal proto leaked past buf.gen.yaml exclude_paths"; exit 1; fi; echo "gen-fence ok: no internal symbols in public gen"' + script: 'if grep -rlE "\bAgentFrame\b|\bAgentControl\b|\bSessionFrame\b|\bReplayCompleteAck\b|\bControlAck\b|\bDeliveryAck\b|\bTranscriptEntry\b|\bPromptControl\b|\bReplayComplete\b|\bSteerControl\b|\bDeliverControl\b|\bDispatchControl\b|\bResumeBody\b|\bTranscriptReplay\b|\bConfigControl\b|\bConfigVersion\b|\bRunnerService\b|\bRunnerError\b|GuestControl|AgentGateway|CommsCall|LifecycleCall|SpawnPeer|DespawnPeer|RelayLifecycleCall|FetchAgentConfig|PublishFrame|PostConversationFrame|ControlSubscribe|BoardCall|SetIssueState|ForgeCall|ForgeNotification|\bForgeArtifactKind\b|SubscribeForge|UnsubscribeForge|\bCommentRef\b|\bCreateIssueRequest\b|\bCommentOnIssueRequest\b|\bGetIssueRequest\b|\bListIssuesRequest\b|\bListIssuesResponse\b|\bCreatePullRequestRequest\b|\bCommentOnPullRequestRequest\b|\bGetPullRequestRequest\b|\bcompassv1internal\b" packages/compass-client/src/gen go/gen; then echo "RIG-1267 FENCE VIOLATION: internal-only symbol found in a PUBLIC gen tree above — an internal proto leaked past buf.gen.yaml exclude_paths"; exit 1; fi; echo "gen-fence ok: no internal symbols in public gen"' options: runFromWorkspaceRoot: true cache: false inputs: - '/packages/compass-client/src/gen/**/*' - '/go/gen/**/*' - # buf breaking gate removed pre-dogfood (SEA-1922); RE-ADD AT GA / first pinned client (tracked: SEA-1951). + # buf breaking gate removed pre-dogfood (RIG-1922); RE-ADD AT GA / first pinned client (tracked: RIG-1951). ci: deps: ['lint', 'drift', 'gen-fence'] options: diff --git a/tools/design-ledger-gate/index.ts b/tools/design-ledger-gate/index.ts index b470604c3..a00c4d91c 100644 --- a/tools/design-ledger-gate/index.ts +++ b/tools/design-ledger-gate/index.ts @@ -1,4 +1,4 @@ -// design-ledger-gate — validate the Compass design-decision ledger (SEA-1187). +// design-ledger-gate — validate the Compass design-decision ledger (RIG-1187). // // The design corpus under docs/designs// freezes on merge; later // records supersede specific decisions by citation. Supersession was only diff --git a/tools/design-ledger-gate/moon.yml b/tools/design-ledger-gate/moon.yml index ba2bc56ca..6af96f2d8 100644 --- a/tools/design-ledger-gate/moon.yml +++ b/tools/design-ledger-gate/moon.yml @@ -1,6 +1,6 @@ # yaml-language-server: $schema=https://moonrepo.dev/schemas/project.json # -# design-ledger-gate (SEA-1187) — validate the Compass design-decision ledger +# design-ledger-gate (RIG-1187) — validate the Compass design-decision ledger # (docs/designs/DECISIONS.md), the per-record `Status:` headers, and # dangling supersession/Record pointers. A bun/TypeScript CLI; a hoisted # root-workspace member (`bun` tag): install is inherited via @@ -8,7 +8,7 @@ # whole-repo tasks on the root project (/moon.yml), so this leaf has no own # bun.lock and never runs its own install. # -# Migrated from the sealed repo (SEA-1794): the Compass design corpus + ledger +# Migrated from the sealed repo (RIG-1794): the Compass design corpus + ledger # now live here, so the gate that governs them lives here too. Compass CI is a # single moon-driven `CI` job (.github/workflows/ci.yml runs `moon run :ci`), # so the `ci` aggregate below is swept automatically — no separate meta.ts diff --git a/tools/design-ledger-gate/package.json b/tools/design-ledger-gate/package.json index a8e57fe27..005f82dd2 100644 --- a/tools/design-ledger-gate/package.json +++ b/tools/design-ledger-gate/package.json @@ -2,7 +2,7 @@ "name": "@compass/design-ledger-gate", "private": true, "type": "module", - "description": "CI gate (SEA-1187): validate the Compass design-decision ledger (DECISIONS.md), per-record Status: headers, and dangling supersession/Record pointers.", + "description": "CI gate (RIG-1187): validate the Compass design-decision ledger (DECISIONS.md), per-record Status: headers, and dangling supersession/Record pointers.", "module": "index.ts", "bin": { "design-ledger-gate": "./index.ts" diff --git a/tools/forge-linear-token/index.ts b/tools/forge-linear-token/index.ts index 7f26239db..93d229142 100644 --- a/tools/forge-linear-token/index.ts +++ b/tools/forge-linear-token/index.ts @@ -11,7 +11,7 @@ // // The mint is derived, never stored: the same client_credentials call the // platform's linear-auto-done job uses (design record -// linear-auto-done-auth.md / SEA-1087). client id + secret +// linear-auto-done-auth.md / RIG-1087). client id + secret // come from Actions secrets, cross TLS once to Linear's token endpoint, and the // minted token is masked out of the logs before it is exported. // @@ -49,7 +49,7 @@ export const OUTPUT_ENV_NAME = "LINEAR_FORGE"; * the injected `fetchFn`, so tests drive it without a network. Fails closed * fast: a hung token request would otherwise block the job until the runner's * timeout. Mirrors the platform linear-auto-done job's mintAppToken (design - * record linear-auto-done-auth.md / SEA-1087). + * record linear-auto-done-auth.md / RIG-1087). */ export async function mintAppToken( creds: AppTokenCredentials, diff --git a/tools/renovate/config.json5 b/tools/renovate/config.json5 index b59ac0bd0..2b784312b 100644 --- a/tools/renovate/config.json5 +++ b/tools/renovate/config.json5 @@ -21,7 +21,7 @@ // before-4am-ET window with 2-3h of margin in both DST phases. GHA scheduled // runs are best-effort and routinely start 5-30+ min late, so this margin keeps // a delayed start from sliding past 04:00 ET — which would silently open zero - // PRs forever (SEA-1220). + // PRs forever (RIG-1220). timezone: "America/New_York", dependencyDashboard: true, @@ -431,7 +431,7 @@ // branch HEAD carries no release-age metadata, so a strict cooldown treats it // as permanently `pending`: on a near-daily `rolling` branch the HEAD is // always younger than any window, so the digest would sit on the dashboard - // forever with zero PRs cut (the SEA-1220 silent-no-updates shape). Disable + // forever with zero PRs cut (the RIG-1220 silent-no-updates shape). Disable // the cooldown for THIS rule only — the window exists for the compromised-npm- // release risk, which applies weakly to a cachix-curated channel repo. minimumReleaseAge: null, diff --git a/tools/stamp-gate/moon.yml b/tools/stamp-gate/moon.yml index 381e77fe8..5fb2a4295 100644 --- a/tools/stamp-gate/moon.yml +++ b/tools/stamp-gate/moon.yml @@ -1,6 +1,6 @@ # yaml-language-server: $schema=https://moonrepo.dev/schemas/project.json # -# The generator-stamp gate (SEA-1405). See stamp-gate.ts for why it exists; +# The generator-stamp gate (RIG-1405). See stamp-gate.ts for why it exists; # in short, protoc-gen-es is a nixpkgs store path with no lockfile pin, so the # `@generated by` header in each gen tree is the only record of which plugin # produced the checked-in code. diff --git a/tools/stamp-gate/package.json b/tools/stamp-gate/package.json index 7d5a51306..563c15d27 100644 --- a/tools/stamp-gate/package.json +++ b/tools/stamp-gate/package.json @@ -2,7 +2,7 @@ "name": "@compass/stamp-gate", "private": true, "type": "module", - "description": "The generator-stamp gate (SEA-1405). protoc-gen-es comes from the pinned nixpkgs with no lockfile pin, so the `@generated by` header on each checked-in file is the only record of which plugin produced it. This asserts those stamps agree with each other and with the plugin on PATH, so a nixpkgs bump reads as a named skew and a partial regeneration reads as a named intra-tree disagreement rather than as a mystery comment-only drift.", + "description": "The generator-stamp gate (RIG-1405). protoc-gen-es comes from the pinned nixpkgs with no lockfile pin, so the `@generated by` header on each checked-in file is the only record of which plugin produced it. This asserts those stamps agree with each other and with the plugin on PATH, so a nixpkgs bump reads as a named skew and a partial regeneration reads as a named intra-tree disagreement rather than as a mystery comment-only drift.", "devDependencies": { "@types/bun": "catalog:", "typescript": "catalog:" diff --git a/tools/stamp-gate/stamp-gate.ts b/tools/stamp-gate/stamp-gate.ts index 57703d9ac..833f4b287 100644 --- a/tools/stamp-gate/stamp-gate.ts +++ b/tools/stamp-gate/stamp-gate.ts @@ -1,5 +1,5 @@ /** - * The generator-stamp gate (SEA-1405). + * The generator-stamp gate (RIG-1405). * * `protoc-gen-es` comes from the pinned nixpkgs (devenv.nix), so its version is * the nixpkgs's to choose and there is no lockfile pin to compare against. What