- The first relayed kimi mission (01a0cfc3) bound the node relay, yet the guest
dialled api.kimi.com through egress with the proxy token: the turn runs in a
login shell that sources /etc/profile.d/00-image-env.sh (the image's ENV),
which re-exports the glm/kimi images' baked ANTHROPIC_BASE_URL over ours. The
turn command now re-exports the base URL after the profile. No key leaked —
the guest had only the token — but relayed kimi/glm missions could not run.
- deploy.sh excluded `target/`, which matches only a directory; a workstation
whose target is a symlink copied it to the build host, breaking its builds.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
A microVM guest still received its backend's real key (as ANTHROPIC_AUTH_TOKEN
or CLAUDE_CODE_OAUTH_TOKEN). Guest→provider traffic is TLS end to end through
the node's CONNECT proxy, so nothing on that path can swap a credential.
fcagent already pipes 127.0.0.1:11434 → vsock 9003 in EVERY guest (built for
the local-model backend), so no rootfs rebuild is needed:
- node 0.5.0: local_model::target_for sends that pipe to the node's own model
(local backend, unchanged) or, when vm_create carries `model_relay`, to the
server's LLM proxy — tailnet (100.64/10) ip:port only, so no message can point
a node at the internet. The guard test is restated for the new invariant: the
guest still never chooses where the pipe goes. Advertises `model_relay`.
- server: llm_proxy::microvm_relay relays only when the proxy is on,
CLAWMATES_LLM_PROXY_NODE_ADDR is set, the backend has a route, and the node
reports model_relay — an older node keeps the old path rather than a guest
whose model calls go nowhere. The guest then gets the mission token and
ANTHROPIC_BASE_URL=http://127.0.0.1:11434/<route>, nothing else.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The crate-wide guard exists so nobody hand-rolls a model call around the
provider layer. The proxy originates no calls: it relays a mission container's
own request and swaps the credential, reading the same env and auth mode. CI
caught the new module (72fb0dc); local runs had covered only touched modules.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Container-tier missions held the platform's provider keys in their environment,
readable by an agent with Bash and public egress. With CLAWMATES_LLM_PROXY=1
(and CLAWMATES_LLM_PROXY_SECRET), a container instead holds a per-mission token
where each key was, ANTHROPIC_BASE_URL points at the server's proxy on :8089
(not published, not routed by Traefik), and the GLM/Kimi hops' base URLs are
rewritten in the mission's config copy. The proxy verifies the token
(HMAC(secret, mission_id) — stateless, survives redeploys), refuses it unless
the mission is running, swaps in the real credential and streams the response.
Spiked first on gw-04: Claude Code on a subscription OAuth token, given only a
placeholder and a base URL, sent nothing but POST /v1/messages there and
answered once the placeholder was swapped. Off by default; no behaviour change
until enabled.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The live canary run (01a0cf3d) proved the push refusal — push refused, patch
redacted, delivery.secret_blocked, no branch on the forge — and found the next
leak: the judge QUOTED the canary verbatim in its verdict, which is stored,
shown in the UI and written into the repo's project memory for later missions.
- mission_events::record (the one insert path) scrubs every event's detail and
target: tool output such as a printenv, prompts, verdict events
- the verdict's reason, guidance, check outputs and plan are scrubbed before
being stored or remembered
- the evidence sent to the judge, and each check's output before the judge
model reads it, are scrubbed — the judge is another company's model
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Container-tier missions carry model-provider keys in their environment (Claude
Code needs its credential; the fallback chain needs GLM and Kimi), the agent
has Bash, and no gate rule mentioned them. Delivery is the one exit all work
passes through, so it now checks the outgoing diff and commit messages for the
EXACT values of every watched secret (verbatim or base64): on a hit the push is
refused with the key names recorded, the stored patch — served to the UI — is
redacted, and a delivery.secret_blocked event is written. Values never logged.
Exact matching, not shapes: text about keys is not flagged. A test pins the
watched list to a superset of what containers are given in both auth modes.
CLAWMATES_DELIVERY_CANARY (a random non-credential) lets the refusal be proven
live without a real key.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
GLM's weekly window ran out while the judge had spent ~0.1% of it: other
consumers of the shared key starve the judge, and ClawMates learned only from
failed phases. A poller now reads z.ai's quota API and Kimi's usages API every
10 minutes, warns once per window per reset at 80%, and the evaluator skips a
judge whose plan is at 95% in any window for the (equally independent)
fallback — only on a real reading, never on a missing one. GET
/api/judge/quota shows the readings.
Parsers pinned to the shapes both APIs returned on 2026-09-23.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
GLM's plan limit ran out for the second time in a month, and with one judge
every conditioned phase on every mission fails until it resets. When the
primary independent judge errors, CLAWMATES_VALIDATOR_FALLBACK_MODEL (prod:
kimi:kimi-for-coding) judges instead, through the same independence checks
(one shared function) plus one more: never the primary's own family.
Measured first: judge-eval 15 cases x 3, kimi-for-coding 44/45 vs glm-5.3
43/45; goodhart — the false positive that once ruled Kimi out — 3/3.
When both fail, the primary's error leads so the phase runner still reads the
z.ai plan-limit code and does not spend the pass. Prod's kimi provider moved
to the anthropic format the eval used (host config, backed up).
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The judge verifies a copy that excludes node_modules (on purpose: it must not
run agent-built binaries) in a container with no registry route, so every npm
project failed any "tests pass" condition — the frontend team's first run was
correct (10/10 re-run by hand) and failed twice on `vitest: not found`.
When the copy has package-lock.json, the harness copies the mission's npm cache
(already on the host: /zeroclaw-data is bound from <mission>/runtime-data) into
the verify root and runs `npm ci --offline` against the copy, so the judge stays
offline, every tarball is checked against the lockfile's hashes, and nothing
root-owned lands in the mission's tree. The judge is told whether the install
worked, so a missing install never reads as a failing suite.
Exit status is npm's own (no `| tail` laundering) — tested with a fake npm in
both directions; the real path was run by hand on the delivered branch:
offline install of 173 packages, then 10/10.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Records (never refuses) a curl/wget to a host fetched content named, when the
command expands something at run time: the GET-exfil shape the floor leaves
open. The designed rule — body-carrying calls to tainted hosts — is dominated
by curl-body/curl-upload/wget-body, which already refuse every body, so it
would have shadowed nothing and looked like a clean result.
One case table drives the Rust predicate and the generated shell; they agree on
all ten cases (attack spellings, link-following, untainted expansion, subdomain
limit, non-fetches), and every case exits 0. The gate reads the file the tap
writes on both tiers (tested).
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The container drain revisits finished phases for 30 minutes; the other drains
are idempotent because they truncate, and the taint file deliberately is not.
The first live mission (01a0cb7e) recorded the same event four times. Record
only when no event for the phase already carries at least as many hosts.
Live result otherwise as designed: curl https://example.com tainted iana.org
(the page's link), not example.com (the agent's own target), and grep -rn curl
added nothing.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The "derived from untrusted content" half of ActGov's invariant (no outbound
action whose target came from untrusted content). Observed only; no rule
reads it yet.
- the tap runs a node extractor only when a payload could be a fetch
(WebFetch, WebSearch, curl/wget in command position) and appends the
response's URL hosts, minus the agent's own target, to
untrusted-hosts.txt beside the tap — a path hook-files already protects
- capped at 500, deduplicated, and the tap still always exits 0
- both tiers drain it per finished phase into a taint.hosts event
- shell-tested against the generated hook with the real node; the test caught
`grep -r curl docs` being read as a fetch
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The first self_audit run on a planted brief/condition mismatch found the
pattern and quoted it, then diagnosed "the agent skipped the section": the
record held the condition but not the brief, and working agents never see the
condition. It also read two missions as one — a UUIDv7's first 8 chars are a
timestamp, and missions 34 s apart both rendered as 01a0cb38.
- verdict_line records the phase brief (config.task) beside the condition
- the short mission id is the uuid tail
- self_audit copies the record into the checkout (the judge cannot read
/mission/memory) and compares brief with condition
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Its first run could not do its job. The template audited "every project
agent's .brain" through per-agent APIs — fetch a brain, submit to
/api/claws/{id}/level-up, pull claw metrics — none of which a mission can
reach; agent brains live in the server's /data/brains volume and nothing
delivered them in. It spent itself searching, found a ROSTER.md in a
scratch repo, and audited that.
A delivery channel alone would not have helped: per-mission crews carry
~2 KB seed brains with no history, because missions write memory to the
REPOSITORY brain, one judge verdict per phase. That is where a project's
history actually accumulates, so that is the subject now.
mission_memory::export renders the whole repo brain as markdown — the
.brain is HDF5 and a mission container has no library to read it — and
mission_orchestrator installs it at /mission/memory/PROJECT-MEMORY.md,
outside the checkout so it is input and never lands in the diff, the same
way install_skill_files delivers skills.
The three roles are rewritten for that record: an inspector that finds
patterns (several UNMET lines on the same kind of work) and quotes them;
a proposer that ties each proposal to at least two lines or drops it; and
an evaluator that checks the cited lines exist verbatim and marks each
proposal SUPPORTED, WEAK or UNSUPPORTED. Each says outright that "no
change is warranted" is a complete result — the property that kept the
first run from inventing improvements out of empty brains.
Local: 523 passed; the two DB-backed world tests panic PoolTimedOut
because Docker Desktop is down here. CI runs them against real Postgres.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Proven by the thing it broke. Mission 01a0c9c4 was tombstoned at
16:17:39 by the old code, in the four-minute gap after the reaper deleted
its checkout and before the build that could render it started at
16:21:58. Because the sweep selected on NOT EXISTS (podcast_episodes),
that row made the mission invisible forever: the fix shipped, and
recovered nothing, on a script that was sitting on a branch the whole
time.
The sweep now reconsiders a tombstone after RETRY_TOMBSTONE_AFTER, and
record_unrenderable_because refreshes created_at on each attempt, so the
backoff restarts rather than compounding. At most ~4 attempts a day per
mission: enough to recover the same day a cause is fixed, not enough to
become the every-two-minutes churn the no-turns tombstone was added to
stop.
Verified live by clearing the stale row and letting the deployed build
re-attempt:
podcast: mission 01a0c9c4 — checkout is gone; rendering from the vault
(clawmates/mission-01a0c9c4-cf8ba78d:.../script.md)
podcast: episode ... 31 turns, 419s, 6708231 bytes
audio: HTTP 200, 6708231 bytes, audio/mpeg; feed.xml carries the item
which is the first complete pass this pipeline has made: vault fallback,
the bold-speaker parser fix, ElevenLabs render, blob, feed.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The baseline run the plan called for found a different defect than the one
it was written to find, which is the point of running it.
The worker was healthy: it found mission 01a0c9c4, found script.md in the
checkout — no reaper race — and parse_script returned ZERO turns, so it
skipped. Every two minutes. Forever. No episode, no tombstone, and the
same log line repeating, so nothing downstream could tell "not rendered
yet" from "never will be".
Cause: the skill asks the writer for `HOST:` and the writer, producing a
markdown file, wrote `**HOST:**`. split_once(':') then yields `**HOST`,
the `*` fails the all-uppercase test, every line falls to the
continuation branch with no turn to attach to, and the entire episode
parses to nothing. The skill is a prompt and models vary; the parser is
deterministic, so the parser is the half that gives. strip_emphasis
accepts `**HOST:**` and `_HOST_:` while leaving emphasis INSIDE a
sentence alone — that belongs to what is said — and a bolded non-speaker
line like `**Note:**` is still prose, not a turn.
Second defect, same symptom: "no spoken turns" now records a tombstone
(`unrenderable:no-turns`) instead of retrying a script that cannot
change. Every tombstone value keeps the `unrenderable` prefix so existing
readers still see one, and the suffix names which dead end it was — a
missing script and an unparseable one are different bugs and were
previously indistinguishable.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Two halves of one defect found while reviewing template maturity.
THE DIGEST NEVER LANDED. Paper notes auto-merge into the vault from the
day the library shipped — library.rs calls auto_merge::try_merge. The
digest that analyses them did not, because nothing on the mission path
ever called it: a mission branch waits for an operator merge
(routes::missions::merge_branch) which, measured on 2026-09-22, had not
happened since 2026-08-18. Every continuous_research run in that month
produced analysis.md, script.md and episode.json onto a branch nobody
merged. Papers flowed; the thinking about them did not.
mission_delivery now accrues such a branch into the repo's default
branch after a successful push, behind three independent limits, none of
which trusts the mission type alone: AdditiveOnly (try_merge re-reads the
diff against the REMOTE base and refuses any modify/delete/rename — a
digest is a new dated folder, so all adds); the phase's own judge verdict
read from mission_phase_evaluations rather than inferred from its status,
because a phase with no condition completes unjudged; and
accrues_automatically(), a pure predicate listing exactly one recipe so
adding another is a reviewed edit rather than a condition buried in a
query. The outcome — including a refusal, which is the interesting half —
lands on the artifact as merged/merge_reason.
Placement checked rather than assumed: capture selects on phase status
'completed', and a phase reaches that only after the judge rules, so the
verdict exists by delivery time.
THE RENDERER RACED A REAPER. podcast::render_pending read script.md from
the mission checkout, deleted 30 minutes after a terminal state; the
2-minute sweep was a mitigation and record_unrenderable the loss, whose
own message pointed at the vault as manual recovery. It now takes the
vault instead of mentioning it: default branch first, the delivery branch
second, shallow and cleaned up. A script on the vault is re-renderable
next week; a script in a reaped checkout is gone.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
ActGov's second layer (arXiv 2609.24446), in the honest form our evidence
supports. The paper binds each task to its minimum tools; 171 recorded
tool calls cannot justify a per-task minimum, but they do justify the line
this draws: files, commands, search, web, delegation and skills are the
work surface and pass; ListAgents, ScheduleWakeup, CronCreate,
SendMessage and the rest reach the platform itself and do not.
That line is not theoretical. ListAgents and ScheduleWakeup were both
called by microVM missions whose --allowedTools is Read Edit Write Bash
Agent. Neither is on that list; both ran, because the flag governs
permission prompting and not availability. Our gate is the only place
this can be enforced.
TaskPolicy is rendered into the same guest script as the floor and the
role policies. A phase names its own set with "agent_tools" — NOT
"tools", which security_scan already owns for its scanner list; both are
now in phase_config::KNOWN_KEYS, adjacent, each saying what the other is.
SHADOW BY DEFAULT. The gate records what it would have refused to
would-deny.jsonl and allows the call; the host drains it into
gate.would_deny on both tiers. CLAWMATES_TASK_PERMISSION=enforce flips
it. A policy tightened on a guess and enforced on day one is how an agent
learns to work around the gate, and a shadow mode nobody can read is an
off switch with extra steps.
The VM probe needed a sentinel: a refusal and a call that merely would
have been refused are both JSON objects with the same keys, and telling
them apart by content would confuse the one distinction shadow mode
exists to make.
Asymmetry, stated rather than hidden: a VM is per-phase and honours the
phase's own agent_tools; a container serves every phase of its mission
and gets the mission-wide default. Narrowing per phase there needs a
re-install between phases and is not done.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The gate's rules were global: what no mission may do. This adds the
task-scoped half ActGov (arXiv 2609.24446) argues for — per-action
validation against the authorization boundary of the role making the
call — starting with the one role whose limit is structural: a verifier
that edits the thing it is verifying turns a failed check into a passing
one and reports success.
The enabling fact was measured before anything was built on it: Claude
Code 2.1.278 puts agent_type on a SUBAGENT's PreToolUse payload and
leaves it absent on the lead's (local probe: agent_type: prober,
agent_id: aacf093a). A policy keyed on a field that is not there is a
policy that never fires and looks installed — the failure this codebase
keeps paying for.
ROLE_POLICIES renders into the same guest script as the floor, so the
shell and the Rust predicate cannot disagree (the property
the_script_carries_every_rule already pins for the floor, now pinned for
roles too). Shell tests run the real generated script: the verifier's
Write is refused with rule=role-verifier-readonly and agent_type on the
record, the lead's identical Write is allowed, explorer is untouched, and
the verifier still reads and runs cargo test.
This is deliberately a second enforcer, not a replacement: the CLI's own
--agents tool list is the harness policing itself, and it silently did
nothing until 2.1.243 rejected the string form we were sending (cbc9c2d).
The harness now distinguishes 'never reached for a write' from 'the gate
refused one', which the tap alone could not say.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Mission 01a0c940 ran the paper triage live for the first time: 10 papers,
10 tagged, 10 scored — and the relevance scores were 2.93, 2.94, 2.97,
2.97, 2.98, 2.99, 2.99, 2.99, 3.00, 3.00. A spread of 0.07 across a
4-level scale, every answer confident, no ranking information at all. Of
course: the harvest runs the operator's own arXiv topic queries, so every
paper in the file is about agents by construction. Asked on the same ten
abstracts, 'how actionable is it' saturated the same way (spread 0.20).
What separated them was the strength of the evidence behind the claims:
1.36 (a benchmark paper) to 3.00 (measured on real systems with
ablations), spread 1.64 — and what KIND of paper it is (method /
benchmark / measurement / survey / position), with the confidence of that
call beside it so an unplaceable paper reads as unplaceable. The manifest
now carries those two and no relevance number, and arxiv-daily.md tells
the reading agents what each means and why there is no relevance.
The general rule, since this class of mistake is invisible — a saturated
score looks exactly like a working feature: patterns::spread() with
SATURATED_BELOW, and triage_papers warns when a live harvest's scores
span less than that. A question that returns the same number for
everything is a defect in the question, not a fact about the population.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
mission_memory::recall is two stages when a key is set: BM25 proposes 8
candidates, one Noul per candidate ('this earlier verdict is relevant to
the task') reorders them and drops those under 0.3, three are kept. BM25
measures keyword overlap, and a verdict about MICROVM.md shares words
with every task that names a file. Without a key the BM25 order stands.
continuous_research: topic_tags was written as [] on every manifest line
since the manifest existed. triage_papers asks, per harvested paper, a
Choice over the mission's topics (readable names, the arXiv query as the
description, 'none' offered) and a four-level relevance Score; the tags
(every topic ≥ 0.3) and {score, confidence} land on the line the agents
already read. Probe on PORTICO's abstract: relevance 3.0 at 1.0; topic
'none' 0.59 / verification 0.41 — true, the topic list has no
authority/sandboxing entry. Untriaged papers write the old empty line.
Co-Authored-By: Claude Opus 5 <[email protected]>
cm_decide:🚪 three Nouls per outbound action (data leaving the
organisation, a credential in the content, unsolicited/abusive), the max
is the deny probability. Measured on 24 hand-labelled door actions
(eval/door-actions.json): AUROC 1.000, [email protected] 0.96, no false denies, no
misses, 4 of 24 in the review band — three deny-labelled actions it would
not refuse alone (db dump 0.71, delegate-exfil 0.74, threat 0.77) and the
one genuinely borderline allow (repo name to a contractor 0.56). 168 ms,
~600 tokens per action, off the z.ai quota.
mcp_door: PolicyOutcome::Hold. With TYPESAFE_API_KEY set, above DENY_AT
(0.8) refused, below ALLOW_BELOW (0.2) executed, between them the action
gets a pending approval (session_key door:<id>) and the agent is told it
is queued and not to retry. The approvals route recognises a held door
action and executes it on approve — the grant decide mints, the tool
consumes — rather than resuming a chat run. The chat-model governor
stays as the fallback without a key; it has no middle band. Fail-closed
on an unreachable or malformed answer. Thresholds overridable per
deployment (CLAWMATES_DOOR_DENY_AT / _ALLOW_BELOW).
decide-eval --kind door reports the band outcome, not only a threshold.
Harness: a door scenario exercising all three bands directly against /mcp
with email_send (its effect is an outbox row), then approving the held
one and checking it executes then and not before.
Co-Authored-By: Claude Opus 5 <[email protected]>
RunSuspended is journaled before the run row is checkpointed, so the
event can arrive milliseconds before the state; CI run 6485 read Running
in that window. Poll up to 2 s.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
A recipe's completion condition is a condition on the recipe's own task.
phases_for_create merged the recipe config under the caller's, so a phase
that supplied a different task and no condition inherited a condition
about work it was never given: research_and_code's coding phase carries
"an implementation for each INT-XX item in IMPLEMENTATION_BRIEF", and a
phase asked to write CHAIN.md failed on it, honestly, every time
(01a0c20d, 01a0c493). Decided from the caller's config before the merge
(afterwards a recipe task and a caller task look the same): caller task
+ no caller condition → the recipe's done_when/done_when_check are not
inherited. A caller condition is kept; a phase with neither keeps the
recipe's pair. Test fixture now carries a recipe task+condition.
Harness: the triage agreement line dedupes per skill and excludes skills
whose Trigger is not observable (always_inject is inlined). First live
datapoint, 01a0c493: for 'create CHAIN.md and commit' Jev's top picks
were workspace-repo-commit-protocol 0.63 / small-focused-commits 0.57;
the agent read code-review-checklist (~0) and nothing else.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The no-node test runs the hook with an empty PATH, so cat is missing too
and the script exits before reading stdin; on Linux the test's write can
lose that race (CI run 6483). The child exiting unread is the no-node
path working. Harness: assert_skill_triage on chain and microvm — the
event must exist; agreement with what the agent read is reported.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
A third kind of decision-maker between deterministic code and a full LLM
call: Choice / Score / Noul questions answered as probability
distributions with a confidence, behind one Decider trait, with the
composition patterns (confidence gating, composite scoring, rerank) as
code. Two backends: TypeSafe's Jev over HTTP, and a DeBERTa-v3 MNLI
cross-encoder run in-process with candle (feature nli; metal/cuda).
decide-eval measures a backend on labelled cases the way judge-eval
measures the judge. eval/skill-triage.json: 20 mission tasks × 53 skills,
75 positives, hand-labelled. Measured 2026-09-21:
lexical overlap AUROC 0.851 [email protected] 0.47 top-k 48/75 ECE 0.095
jev (named wording) AUROC 0.989 [email protected] 0.84 top-k 63/75 ECE 0.064 213 ms
jev (plain wording) AUROC 0.970 [email protected] 0.66 top-k 52/75
nli mnli-base AUROC 0.790 [email protected] 0.28 top-k 38/75 ECE 0.263 1.5 s
nli zeroshot-v2 AUROC 0.782 [email protected] 0.43 top-k 39/75 ECE 0.054 1.2 s
The vendor's calibration claim survives our data; the local cross-encoder
ranks below keyword overlap on either checkpoint or wording and is kept
as the measured negative, not shipped. A local backend would need the
logit-readout route over the fleet's 9B model — a separate spike.
Shadow: one Jev call per phase launch (spawned, 10 s cap, silent without
TYPESAFE_API_KEY) records a skill.triage event; the Skill-Use report
carries triage_p beside each skill's Trigger verdict. It selects nothing.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The skills-door token was minted with a 24 h TTL and nothing revoked it
sooner, so a mission that finished in twenty minutes left a live
credential in its container for the rest of the day. auth_sessions gains
mission_id (ON DELETE CASCADE, so a purge revokes too);
mint_scoped_for_mission records it; revoke_mission_sessions deletes it.
Revocation runs on both terminal paths — the runner's close (RETURNING
the closed ids) and the operator's stop — and says how many it cleared.
Granularity is the mission, not the phase: the container and its door
are installed once per mission and serve every phase. Lingering
Authority (arXiv 2606.22504) is the reference. Tests: a minted token
authenticates for its scope and not as a full session, is dead after
revoke, and another mission's token is untouched; the harness gatepolicy
scenario now runs on the index arm and asserts the server revoked ≥1,
no row carries the mission, and the door answers 401 to the token.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Rule ids on the gate's rules, recorded on every denial as
{"rule":"<id>","payload":<hook event>} and read back by
vm_tool_gate::denial_detail into gate.denied events, so 'which rule fires
and how often' is a query on detail->>'rule'. Older bare-payload lines
still parse, with no rule.
A write-path policy: Write/Edit/MultiEdit/NotebookEdit are refused when
aimed at the hooks, their records, or the settings that install them, on
either tier (/root/toolgate, /root/toolhooks, /root/tap, the guest and
.claude settings, and .git/hooks/ — a hook in the checkout runs with the
agent's authority unseen). An agent could Write over denied.jsonl and erase
its own denials; now it cannot, and the same paths are refused to Bash
whatever the tool in front of them (sed -i is a text tool that writes).
The extractor prints file_path as a third line; the predicate and the
generated shell are tested against the same payloads, and the shell test
now reads the record back.
The container tier drained the tap and the inert marker and never the
denials: gate.denied existed only for microVM phases. drain_denied fixes
that. Harness: a gatepolicy scenario with two negative controls on the
container tier, asserting the two rule ids in the record.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Until now missions wrote no memory. The chat path records every turn into
the claw's .brain, but a mission's crew is minted per mission, so a brain
keyed by agent would be written once and never read. What persists across
missions is the repository: mission_memory keeps one .brain per repo_id,
writes each judge verdict into it (reason when met, sanitized guidance when
not — the operator reason may quote the acceptance text), and recalls
against the next phase's task text into the brief, under a heading all
three executors carry because it rides on the task.
Recall is BM25 over the keyword index, no embedder; the harness asserts the
brief carries the section once the repo has one judged mission behind it,
and says 'first mission' rather than failing before that. OpenClaw's
flush-before-compaction was the other half of this item and is moot here:
the chat loop has no compaction and already remembers both halves of
every turn.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Three fail-open paths on the §15 door: no env at all meant allow-all; a
governor that could not be reached approved with a WARNING; and a reply
that never said DENY — empty, truncated, a refusal — approved, because the
rule was !contains("DENY"). On the two days the judge plan emptied every
outbound action was approved by nobody.
Now: governor_allows() needs an explicit ALLOW and no DENY; both judge()
implementations return false when unreachable; with no governor the door
opens only on CLAWMATES_DOOR_POLICY=allow. Open Agent Passport (arXiv
2603.20953): 74.6% social-engineering success under a permissive policy,
0 of 879 under a restrictive one. Local override gains the governor prod
already runs.
skill_self_authoring: default flipped to OFF. No agent-authored skill has
ever been delivered to a mission or scored; prod held zero proposals.
Enable with CLAWMATES_SKILL_SELF_AUTHORING=1 once promoted skills go
through the files arm and get a Skill-Use score.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
One tool-free round on the condition alone: which files, strings and tests
would show MET, and which commands would settle it. The plan is placed
between the condition and the evidence in the verifying prompt and stored
as mission_phase_evaluations.expectation beside the verdict, so an operator
can see whether the checks the judge ran are the ones it said it would run.
Self-Play Reward Hacking of Reference-Free Judges (arXiv 2607.05904): a
judge's pass rate climbed 0.72 -> 0.94 across rounds while accuracy stayed
0.20; cross-family judges and ensembles did not help; the judge committing
its own answer first cut the false-positive rate 0.719 -> 0.012. Ours
commits to a plan, not a value — re-deriving values is the failure
done-when-wording measured, and the commit prompt forbids it.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The 64 KB window did its part: mission 01a0b803's judge read REPORT.md in
full, 18,698 B untruncated, in one command. It then ran wc, head -120,
tail -116, sed 1,120p and two greps against the same file — six commands
re-reading content it had been given. Two causes, one of them mine.
compact_earlier_results shrank that read to 800 bytes as soon as the next
round's results arrived, so by the time the judge went to check a claim
against the report, the report was gone from its context. The most recent
round's results now stay whole, so a read survives the call that receives
it and the one after; only older rounds compact. The quadratic term stays
bounded — it was the SUM over rounds, and one extra whole round is linear.
The system prompt never mentioned the budget. It now says a cat comes back
complete unless the output says otherwise, not to re-read with head/tail/
sed/grep, to decide what to verify before reading, and that earlier rounds
are shortened — so read in the round you intend to check.
Still 13 checks / 9 requests on that mission; the measurement is the next one.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
`cargo test --workspace` fails on any fresh machine: hub.docker.com's
minio/minio returned 404 for the whole repository on 2026-09-19, and
testcontainers cannot pull it. CI on gw-04 kept passing because a year-old
copy is cached there and testcontainers pulls only when the local create
returns 404 — one image prune away from failing forever, and already failing
here. MinIO publishes the same image on quay.io; the manifest answers 200.
Found while reproducing a red CI run that turned out to be environmental.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
vm_tool_gate writes denied.jsonl for every call it refuses and an `inert`
marker each time it cannot parse its input and lets the call through. The
guest has written both since the gate existed; nothing read them out of a VM.
A denial, or a gate that had quietly stopped checking, left no trace — the
same shape the container tier closed with drain_inert on 09-14.
The executor probes both files (one exec, while /root still exists) into
VmOutcome.tool_gate; launch_microvm_phase records them on the mission as the
container tier's `gate.inert` (with the count) and `gate.denied` (one event
per refused call, the gate's own JSON as the detail). Absent gate is None,
not zero — "no gate" and "a gate that refused nothing" are different facts.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Surveyed the catalogue against the module's own rule: only a procedure with a
consequence visible in recorded tool arguments or delivered files gets a
check; a heuristic over prose is a number that looks like a measurement and
is not one. Four qualify beyond the seven that had checks.
postgres-migrations-forward-only — "applied once and never rolled back; undo
with a NEW migration" and "renaming a column: don't". An Edit to a path under
migrations/ is by construction a change to a file that already existed; a
written migration containing RENAME COLUMN is the forbidden rename.
criterion-benchmarking — "a missing black_box lets the optimiser delete the
work". A written benches/*.rs that mentions criterion and never black_box.
secret-scanning-gitleaks and cargo-audit-workflow — the procedure IS running
the tool, so a recorded `gitleaks` / `cargo audit` command is the compliance
(PassWith, naming the count) and its absence is NotApplicable, never a
violation: the stream is capped and the mission may not have reached the step.
The written text comes from the tool arguments (Write.content, Edit's
new_string), not from reading files back.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
`compose_turn_prompt` appended `# Your skills` after the task, the tool list,
the workspace rules and the marker contract — 87–90% of the way into a 6 KB
prompt. It is the one section that asks the agent to do something BEFORE it
starts (read a procedure), and on the three `index`-arm runs the agents'
narratives never mentioned it. Position was the untested lever in the
retrieval work; this puts the section second, after "You are the … agent"
and before "Task:", and measures it on the next mission.
The readers (`mode_in_prompt`, `skill_was_indexed`, `skill_names_in`) match
lines, not offsets, so every stored prompt still scores. Two tests pin the
order.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
7 of 9 verdicts ran to the 12-check cap. The checks say why: on a research
mission, 8 of 12 commands read research/REPORT.md — cat, then head -119,
tail -120, sed -n 80,200p and three greps. `cat` had come back truncated at
11,983 bytes because the per-command cap was 12 KB and the report was ~18 KB,
so the judge reassembled the file in slices. Five extra rounds, each
resending the whole conversation, to read one deliverable. The microVM
verdicts used 5–7 checks because MICROVM.md is two lines.
The cap was sized for test-suite output and applied to deliverables. 64 KB
now. With compact_earlier_results shrinking a result to 800 bytes after its
round, one 64 KB read costs one round; the slicing it replaces cost five.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The 2.1.276 canary (mission 01a0b747) exited before its first API call:
Error: Invalid --agents configuration:
explorer.tools: Invalid input
verifier.tools: Invalid input
We sent `"tools": "Read, Grep, Glob, Bash"` — frontmatter syntax, where the
`--agents` JSON schema takes an array. Claude Code 2.1.243 changed invalid
agent definitions from silently ignored to a hard error, which is how the
canary caught it. The uncomfortable half of that: every CLI before 2.1.243
DROPPED the definition, so the verifier's whole guarantee — a tool allowlist
with no Edit and no Write — has plausibly never been in force on any VM run;
the lead's `Agent` calls would have fallen through to a general-purpose
subagent. The test that guarded it read the field with `as_str` and would
have kept passing on the exact string the CLI was discarding.
Both roles now send arrays; the test reads an array; a new test asserts the
shape for every role. Server-side only — no rootfs changes.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Every rootfs on the fleet had sat on Claude Code 2.1.223–2.1.226 since August
while the container tier moved to 2.1.276, and nothing recorded either. GLM
and Kimi exist only as microVM backends, so "have we upgraded GLM and Kimi"
is this change and the rebuild it drives.
Pins. All four agent-* images pin 2.1.276 — as separate ARGs, since Docker has
no include and each file has to stay reproducible alone — and
scripts/fc-build-rootfs.sh refuses to build if they disagree, naming the odd
one out. They had already drifted (claude 226, the rest 223) under comments
saying "same version on purpose". Between 2.1.226 and 2.1.276, 2.1.265 and
2.1.275 each broke every turn on ANTHROPIC_BASE_URL endpoints, which is how
glm and kimi reach `claude` inside a VM; the container-tier verification never
exercised that path, so the VM runs on those backends are the real test.
Provenance. `VmOutcome` carries the rootfs the node reported booting and the
guest's own `claude --version`; `launch_microvm_phase` persists both as
`checkpoint.vm` beside `records` (the two readers parse only `records`) and
names them in its log line. "Which image and CLI did this mission run on" is
a query now.
Independence. `evaluator` derived the implementer family from a constant
`"anthropic"`, true while every backend was Claude on Anthropic. With glm and
kimi rootfs it made a glm mission judged by glm:glm-5.3 read as
`independent = true` — the one claim that path exists to make honestly.
`implementer_family(missions.backend)` mirrors `microvm_credential_for`; the
subscription judge is now independent exactly when the agent did NOT run on
Anthropic.
Harness. `verify-mission-delivery.sh glm|kimi` run the microvm scenario on
each backend and add the proof the mission itself cannot give: the placed
node's journal must show the VM dialling that provider's host, never being
denied it, and dialling nothing else but the forge — a model's self-report is
measured worthless here. `assert_cli_version` reads checkpoint.vm. The stale
scratch-repo default (dead since the 09-14 wipe) is the re-synced id.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
docs/MISSION-EGRESS.md measured that a mission container reaches the entire
tailnet and SSH on its own host, and left the remediation unapplied. Applying
it on 2026-09-18 found why five iptables lines were never going to be enough:
missions egressed from clawmates_edge, the SERVER's network, and the server
needs the tailnet — Beszel on architect, Ollama for the local backend, the
node daemons for exec-test and node-placed terminals. A tailnet drop scoped to
172.23/16 cut the server off from architect:8090 inside a minute.
Missions now egress from clawmates_missions, 172.25.0.0/16, pinned so the
firewall can name it and declared in both compose files with the same shape
edge has. Compose v1 does not create a network no service uses, so on gw-04
it was created by hand with compose's own labels; the server's attach failure
message now says to check for it. core is unchanged: the door and API are
still reached over 172.20.
The policy itself (/usr/local/sbin/clawmates-egress.sh on gw-04, systemd unit
+ drop-ins on docker and tailscaled) lives in mangle/PREROUTING with
--ctstate NEW. Two earlier placements failed measurably: filter/FORWARD loses
to tailscaled re-inserting ts-forward above it on every restart, and
raw/PREROUTING runs before conntrack, so it dropped the server's replies to
tailnet clients and took the API off 100.102.112.85:8088. Verified from the
mission subnet (tailnet, host ssh, link-local blocked; public and core open),
from edge (tailnet open, ssh blocked), and inbound from tank; and proved to
survive restarting both daemons.
Also: deploy/compose/docker-compose.override.yml is tracked now. It holds the
fixes for the five local bring-up gaps and every credential in it is a
${VAR:?} reference, and it had lived on one laptop that lost a volume this
week.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
`mission_gc` keeps `_outputs/<id>` for 90 days because they are artifacts a
user can still open. After `DELETE /api/missions/{id}` nothing can: the
`mission_artifacts` rows went with the mission. Wiping prod on 2026-09-14
found 163 such directories, the newest from a mission deleted twenty minutes
earlier — every mission ever deleted had left its outputs to wait out a
retention window that no longer meant anything.
The delete path removes the directory now, after the container teardown and
before the row goes. A failure logs and continues, and says the gc will get
it in 90 days, which is what happened before on every delete.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Measured on prod: 7 of 9 verdicts ran to the 12-check cap. Every round
resends the whole history, and each check's output is bounded at 12 KB — so
by the last round the judge was paying for ~144 KB of outputs it had already
read, on top of up to 120 KB of evidence, and it paid that on every round.
That is the quadratic term in a verdict's cost, and the reason a single
blocked phase could empty a weekly plan.
Before this round's results go in, every earlier tool result compacts to an
800-byte head plus a marker saying the rest was shown when the check ran.
The round that just ran stays whole; a result already carrying the marker is
left alone. The budget of checks is unchanged — each one is cheaper to
remember, not fewer to run.
Also: docs/NEXT-SESSION.md rewritten for the state as of today.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
Judge spend gained provider, model and mission on 2026-09-14; agent spend —
the larger half — did not. The runtime's `done` frame has always carried
`model` and `provider` beside the two token counts, and `topology_exec` read
only the counts, summed them, and charged the sum as output with no record of
which provider served the turn.
`TurnOutcome` and `StepRecord` carry a `Spend` now (input/output split,
provider, model), the worker passes it through `cm_billing::charge` along with
the mission id, and the chat runtime records the model it requested — that
loop drives one provider with no chain, so requested is answered. A bare
model name is recorded without a guessed family. `StepRecord.spend` is
`serde(default)` so journaled checkpoints from before this field still load,
and `tokens` stays as the total every reader keys on.
`charge` moved from `query!` to `query`: the macro pins the statement to
offline metadata that a schema change then has to regenerate against a live
database, for columns that are nullable text and uuid.
The done-frame test now asserts the split and the provider survive, not just
the sum.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The first judge-spend rows recorded by 248948c came back with input_tokens = 0
on both passes of mission 01a09dfc — 7 and 9 requests, 5940 and 2109 output
tokens, and nothing on the side that actually empties the plan. Probed z.ai's
Anthropic-compatible stream directly: `message_start` carries
`"input_tokens": 0`, and the real figure arrives in `message_delta.usage`
beside output_tokens. Anthropic proper does it the other way round, which is
the shape the parser was written for.
A nonzero figure in the delta now wins; otherwise the start's figure stands,
so the Anthropic path is byte-for-byte unchanged. The decision is a pure
function with the three shapes as its test — including a delta that says 0,
which must not erase what the start said.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
All three have the same shape — the system learns something and only stderr
hears it — and each was flagged in the handoff as a silent-discard defect.
The gate's install outcome. `container_tool_hooks::install` returned Some or
None and both call sites wrote `let _ =`. A mission whose gate never installed
left a record indistinguishable from one whose gate stood there and matched
nothing. `EnsuredContainer` now carries the outcome to the callers that have a
pool, and they record `gate.installed` (with the settings path) or
`gate.absent` on the mission, so "was this mission gated?" is answerable from
the mission.
The inert marker. `vm_tool_gate` writes an `inert` file when it cannot parse
its input and allows everything, precisely so an inert gate does not look like
a permissive one. The only reader was a unit test. `drain_inert` now reads and
clears it at every tap drain, and a `gate.inert` event with the occurrence count
lands beside the calls that ran unchecked.
The judge's spend. `LlmEvent::Usage` arrived on every judge call and was
matched by `Ok(_) => {}`. Two plan exhaustions (2026-08-29, 2026-09-09) with
no row anywhere saying a judge token had been spent; `usage_events` had no
provider or model column. The loop now accumulates requests and tokens onto the
Verdict — counting a request BEFORE the stream opens, so a 429 the provider
refused still counts, because the retry storm was made of those — and
`record` writes a `kind = 'judge'` row with provider, model, mission and
request count. Migration 0085 adds the columns, all nullable, so the two
existing writers are untouched.
Tests: a scripted-provider verdict records one request and nonzero tokens; a
provider that refuses still records the request and zero tokens.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The scorer could see that agents OPENED web-search-triage (trigger=pass on both
files-arm runs) and nothing about whether they followed it — compliance was
not_applicable because no mechanical check existed. The evidence was in the
recorded arguments the whole time. On the runs that read the skill, the parent
decomposed the sweep into per-source fetches and sent each to a subagent; on
01a09b42 two of those spawn prompts read "Return the URL, date if visible, and
the key content". The task never asked for a date. The skill's "undated is a
finding" did. On the runs that did not read it: inline curls, no subagents, no
date.
Two of the skill's rules leave a mark in arguments, and the check scores
exactly those two. The ranking rule: every URL a fetch was sent to is classified
against a short allow-list of primary hosts (rank 0) and a short skip-list of
aggregators (rank 3+); fetching an aggregator is the visible violation, fetching
primary sources the visible compliance, and anything unrecognised is unranked
and decides nothing. The date rule: reported as extra evidence on a pass, never
required for one, because a curl to an abstract page has no prompt to ask in.
`Agent` is a fetching tool here on purpose. The URLs on the files-arm runs live
in the spawn PROMPT; a check that only read curl lines would have scored those
runs as fetching nothing.
`Verdict::PassWith(String)` carries the evidence and serialises under the same
"pass" tag, so no reader grows a fourth branch and the one that looks finds
the date fingerprint in `why`.
One-sided like every check in this module: no tools is not observable, no fetch
is not applicable, an unrankable fetch is not a violation.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The A/B has its answer. Across four matched production runs — same recipe,
same task, same three offered skills — the MCP-door arm retrieved 1 in 9 and
the file arm retrieved 3 of 3, with the judge loop closing on the same run
(01a098dd). A signal, not a rate; but 0, 1, 0 → 3 on an otherwise identical
task is not noise, and the mechanism is explained rather than guessed: the
door is a deferred tool the agents never load, and Read is not.
A code default and not CLAWMATES_SKILL_DELIVERY on one server, for the reason
always_inject moved into the skill files: a setting that exists only in one
deployment is a setting nobody can find. The env var still overrides, and
`index` and `inline` stay selectable per mission so the comparison remains
runnable against one binary.
Garbage in the env var still falls to `inline`, not to the default — an
unreadable value must not silently select an arm that needs something
installed. A test pins the default so the next change to it is a decision
made with the numbers in front of you, not a slip.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The `index` arm retrieves through `ReadMcpResourceTool`, which is DEFERRED:
absent from the agent's default tool list until `ToolSearch` loads it. Across
three matched production runs (same recipe, same task, same three offered
uris) it retrieved 1 skill in 9 chances:
01a07812 delegation forced no instruction 0/3
01a0842e no delegation no instruction 1/3
01a09877 no delegation told to load it 0/3
The third run is the decisive one. The preamble said in plain words to run
ToolSearch first; all three prompts carried it; zero ToolSearch calls, and the
three reasoning narratives never mention skills at all. The section was not
declined, it was never engaged with. Instruction is not the lever.
`Read` is a core tool. Never deferred, and every one of those agents used it.
So this arm keeps progressive disclosure exactly as `index` has it — a name, a
`when_to_use`, and a pointer the agent has to follow — and changes only what
the pointer is: a path under /mission/skills instead of an MCP uri. The bodies
are written into the container at launch (every visible skill, one tar upload;
bindings resolve per agent at turn time so a per-mission subset is not knowable
here) and a `Read` of that path is a tapped tool call, so Trigger is exactly as
observable as before.
A third arm and not a replacement, selected per mission like the others, so
the comparison runs against one binary. `resolve` falls back to `inline` when
the files were not written, for the reason `index` does: a pointer to nothing
reads as an agent ignoring its skills.
The writer and reader of a path are one pair of functions
(`skill_file_path` / `skill_from_file_path`), matched by the scorer through
the same seam `parse_uri` uses, and the end-to-end test fails when the matcher
is broken. `Mode::is_retrieval` exists so the next arm cannot silently inherit
`inline`'s "not observable" for what is a miss.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
The retry ran on the sweep's own 10s tick for a 30-minute window, so a phase
whose judge was unreachable re-judged up to 180 times. A verdict is not one
request either: `evaluator` is agentic and loops up to `MAX_TOOL_CALLS + 1`
rounds, resending the whole growing history each time, against evidence the
code's own comment sizes at ~120 KB. One unjudgeable phase could therefore
issue on the order of 2,000 model requests.
That is most of why the z.ai weekly plan kept emptying with no mission having
visibly done anything expensive — twice now, 2026-08-29 and 2026-09-09. Nothing
recorded it, because `usage_events` carries no provider or model column.
Two changes:
Read the error before retrying. z.ai answers an exhausted plan with a 429
carrying code 1310 and its own reset timestamp. Retrying that is arithmetic,
not optimism: the reset was two days out and the phase spent its whole window
asking anyway. It now fails immediately and says which problem this is —
"the judge provider's plan limit is exhausted until 2026-09-11 10:01:33" sends
you to the plan, where "the independent validator could not be reached" sent
you into the mission. The classifier is deliberately conservative; anything
that does not positively identify itself as an exhausted plan stays retryable,
because giving up on a transport blip costs a phase that did nothing wrong —
which is how mission 01a011bf lost its script phase.
Back off. Waiting as long as we have already waited doubles total elapsed per
attempt, so the schedule is exponential with no attempt counter to store:
10, 20, 40, 80, 160, 300, 300 … — about ten attempts in the same window instead
of a hundred and eighty. `judge_retry_after` holds the clock and the sweep's
SELECT honours it; a landed verdict clears it alongside `judge_blocked_since`.
Verified rather than asserted: the migration applies and rolls back against a
real postgres, and replacing the backoff with the old fixed tick makes
`the_backoff_is_exponential_and_capped` fail (181 attempts, not ~10).
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
`READ_IT` has always named `ReadMcpResourceTool` in every index entry. That is
not enough, because the tool is DEFERRED — not on the agent's default list, and
uncallable until `ToolSearch` loads its schema. Naming a tool the agent cannot
call reads, from the outside, exactly like an agent ignoring its skills.
Measured on a matched pair in production. Same recipe, same `index` arm, same
three offered uris, one variable:
01a07812 76 tool calls, ToolSearch x4 (web_fetch, RemoteTrigger),
never searched for the door -> 0 skills retrieved
01a0842e ToolSearch(select:ReadMcpResourceTool), then the fetch
-> 1 skill retrieved, trigger=pass
One agent worked the extra step out unprompted; the other did not. A capability
that depends on the model guessing a tool is loadable is not delivered, so the
preamble now says the step out loud.
The reader keeps both spellings. `mode_in_prompt` scores the arm off a RECORDED
prompt and `retain_events_until` holds those for 90 days, so editing the writer
alone would have re-labelled every stored `index` run as `inline` — including
the pair above, whose whole value is that they are comparable. `INDEX_PREAMBLE_V1`
is kept as a reader-only constant and matched alongside the current text.
Verified rather than assumed: the real stored prompt from `01a07812` still
matches V1 as an exact line, the compatibility test fails when the fallback is
removed, and a second test asserts V1 stays a prefix of the current preamble
since `concat!` cannot take a const.
Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz
