clawmates/docs/NEXT-SESSION.md

Where this left off — 2026-08-21 (second pass)

Read CAPABILITY-REVIEW.md for the system picture, TOOL-CALL-ARCHITECTURE.md for how mission tools actually work, and SKILL-USE-BASELINE.md for the measurement — which now scores behaviour rather than the agent's own account of it.

State of the tree

Local suite green: 107 test binaries, 792 tests (cargo test --workspace), and the workspace builds with --all-targets. Four measurement missions ran on the local stack (scripts/skill-use-run.sh); all four are held 90 days and re-scorable with --score <id>. Seven commits on main this pass, not pushed — a push to main auto-deploys to gw-04, and the container-tier work already deployed is unexercised there (see below).

The premise of the last handoff's item 1 was wrong

It said the container-tier gate and tap were "proven locally and unproven in prod", and told you to watch for the first production mission.

Production has never run a mission.

gw-04$ select count(*) from missions;        -> 0
gw-04$ select count(*) from mission_events;  -> 0

Prod is armed correctly — server restarted with CLAWMATES_RUNTIME_IMAGE=clawmates-runtime:hooks, image present. There is simply nothing to watch. Prod auth is Clerk, so a mission cannot be launched from a terminal; someone has to click. Generalise the lesson: before debugging why a deployed thing shows no evidence, check whether anything ran.

A leaked mission container nothing can reap

cm-runtime-mission-019ff5b157ce77028f308ebd3dc92748 has been Up since 2026-08-12 on clawmates-runtime:sync, with no missions row behind it.

mission_runtime's terminal sweeper selects FROM missions WHERE status IN (…), and teardown_container(mission_id) is only ever called with an id from that query. Nothing enumerates Docker for cm-runtime-mission-* containers with no matching row, so a container whose row is gone is invisible to every reaper. Same shape as the earlier agent-container reap drift, different table.

It holds disk on the host whose disk exhaustion broke CI runs 503–506. Not fixed — your call, and the fix is small: one sweep that lists containers by name prefix and reaps those with no row.

What shipped this pass

The tool tap kept the name and discarded the argument

The container tier's first measured mission recorded Bash × 6 and not one of them said what it ran. vm_tool_tap::parse read tool_input to pull the path out of it and dropped the rest, so every behavioural question about a phase was unanswerable from a record that looked complete.

Observed.input now keeps it, bounded: file bodies become a byte count, other long strings truncate with a marker. Host-side only, no image rebuild — the arguments were always in the tap file. tool.call also gained detail.path (the World's SSE reads it and had been getting null on every container-tier call) and file.touch gained detail.abs.

Skill-Use is scored from actions

skill_use::Evidence carries tool.call rows alongside the narrative, and every check prefers them. workspace-repo-commit-protocol's boundary was a substring search for /workspace/repo in prose — an agent that wrote to the wrong root without narrating it scored a clean pass. Two verdicts changed for honesty: silence is NotObservable rather than Pass, and a test that ran after the first write is undecidable rather than a failure.

Trigger is still NotObservable, and half of its old reason is now wrong. "claude_cli cannot surface a tool call" is false. What still holds is that we inline skill bodies, so there is no retrieval to observe. The blocker moved from the transport to the delivery model, and the door (§3) closes it with no scorer change at all.

Two more skills contradicted the platform

Both found by reading the source of truth before writing a check against it — which is the only reason they were found.

• decompose-int-items taught PLAN_COMPLETE: INT-01..05. Ids are strictly INT-<digits>, so the range form is rejected and the plan pass records nothing while every item stays open.
• workspace-repo-commit-protocol claimed the task-card parser advances mission state on the INT id in your commit subject. Nothing in the platform reads commit messages — apply_for_run reads run_events, the turn output.

no_skill_shows_a_marker_the_parser_would_reject guards the class, running the real parser over every marker in every skill's fenced blocks.

Next, in order

1. research_only staffs a Rust SDLC crew, and it is your decision. The recipe declares requires_repo = false, one research phase, and default_team_template = "rust_sdlc" — so a repo-less markdown mission gets planner, coder, tester, reviewer and committer, four of whom have nothing to do, at ~50KB of prompt. This is why most skills score not_applicable: the skills are correctly bound to the roles, and the roles are wrong for the workflow. No existing template fits — papers_research is arXiv-shaped, insight_research vault-shaped, codebase_research needs a repo — so this is a new template or a recipe change, not a one-liner. benchmark, refactor, research_and_code and security_hardening all default to rust_sdlc too; check whether each is right.

2. The TDD check cannot confirm red-first, and that is structural. Run 4 (research_and_code, real repo) edited src/lib.rs once — implementation and #[cfg(test)] mod tests in the same write — then ran cargo test five times. In Rust the unit test lives in the file under test, so that ordering is what following the skill precisely looks like from outside. The check detects "wrote source, never ran a test" and nothing more. If you want red-first, it needs the diff (did the test exist before the impl?), not the tool order.

3. Attribute tool calls to agents. record_vm_tools writes agent_id: None, because the container tap is per-container and all roles share one. Every Skill-Use score is therefore per-mission, not per-role, and the World's per-agent view gets nothing from the container tier. The hook payload carries session_id; mapping it back to a turn is the fix.

4. Deploy the door (TOOL-CALL-ARCHITECTURE.md §3). Config, not code: /zeroclaw-data/clawmates-mcp.json plus a door-shaped provider alias. It is now the single change that makes Trigger a real measurement, and the precondition for skills moving from inlined bodies to progressive disclosure — which would also cut the prompt cost in item 1.

5. Fold the microVM tier onto container_tool_hooks. It has a gate and a tap by a different route (vm_tool_tap installs into the guest, microvm_executor drains inside the turn). Two mechanisms for one job is how they drift — and the argument-discarding bug above lived in the shared parser precisely because nobody looked at it from the container side. The fleet has been offline for over a week, so this cannot be tested today.

6. Pull upstream's egress policy — 0db7d999a feat(plugins): add shared egress policy foundation (#9137). We are ~220 commits behind; this is the one item worth taking, and it is defence for a problem we have not solved.

Open decisions that are yours

• Push. Seven commits are local. Pushing main triggers CI → auto-deploy to gw-04.
• The orphan container above.
• Self-authoring scope. Agents apply their own skill_candidate items with no human click (CLAWMATES_SKILL_SELF_AUTHORING=0 restores the gate). identity_refinement and brain_consolidation still wait for a human, because they change what an agent IS rather than adding a procedure it can consult.

Deliberately not done

• The mission executor swap. Blockers are structural: cm-runtime's files tool rejects absolute paths by construction, shell runs in a per-agent sandbox with no mission mount, ToolContext carries no path or VM handle, and approvals key on (session_id, message_id).
• A tap for the direct-session tier. Dormant — CLAWMATES_MISSION_EXECUTOR is unset in production, so it never runs.
• cm-brain offline tests — 6 of 9 need live clawbrainhub.com.
• Graph memory / clawhdf5-agent — in the workspace manifest, used by no crate.

Operational facts that cost time to learn

• The Gitea actions-log API returns 403 for the token in deploy/compose/.env. A token with the actions scope remains the highest-value thing to obtain.
• gw-04 uses legacy docker-compose, not the v2 plugin.
• Do not build images by hand on gw-04 while CI may run — same 150G volume, and the frontend image build is what loses.
• The server reaches Docker through a socket proxy (DOCKER_HOST). Use container_exec::connect(), never connect_with_local_defaults().
• Prod auth is Clerk; the bootstrap password in deploy/compose/.env works only against the local stack.
• Rebuilding the local server image is a full Rust compile inside Docker (~8 min); the layer cache does not preserve target/. Budget for it before any measurement that needs new server code.
• macOS has no timeout(1).

The recurring shape, now seven times over

A claim in a comment or a doc, believed and never checked. Every significant finding this pass came from reading the source of truth — the parser, the recipe, the production table — rather than the text describing it. The two new skill contradictions were found while writing checks against those skills, which is the cheapest place to catch them and the reason to always read first.

The corollary the measurement itself demonstrated: its own first verdict was wrong, and scoring a research phase as a TDD failure would have buried the real finding (item 1). A check that reports a system defect as an agent defect is worse than no check.