clawmates/docs/NEXT-SESSION.md

Where this left off — 2026-09-05

MISSION-EGRESS.md has what a mission container can reach, UPSTREAM-SCAN.md the fork-vs-upstream position, SKILL-USE-BASELINE.md the delivery measurement.

Read this first — the judge is back, and the subagent path is proven

The z.ai quota reset on schedule. glm-5.3 answers again on the same key (sha256[0:12] = 616fb5076696), and it has since passed a real done_when, not just a ping. Nothing is blocked on the judge any more.

Mission 01a07498-d343-7953-9ed1-8ea9ba83b140 (2026-09-05, local, index arm) was the previous validation run plus one change — a task that EXPLICITLY instructs Agent delegation — and it closed both items the last pass left open:

judge recovered	CONFIRMED — phase completed on iteration 0, first attempt. The verdict cites the actual arXiv ids it checked and the "what could not be established" section by name. A substantive read, not a rubber stamp.
subagent attribution	OBSERVED, finally. 87 tool calls: 43 from the main turn, 44 across 4 general-purpose subagents, 4 distinct subagent_ids matching 4 Agent spawns. The field had only ever been unit-tested before this.

The delegation had to be demanded. The earlier task invited it and got none; naming the tool and saying "do not gather every approach yourself in a single turn" produced four spawns. Worth remembering when designing any run that needs to exercise the fan-out path.

The 429 that blocked the last pass was real (code 1310, reset timestamp) and the code was right to fail closed — evaluator.rs:480 still refuses a same-family fallback, and should keep refusing. If a done_when phase fails again with the artifacts present and correct, check the quota before the mission.

What shipped this pass

Seven commits on main, all deployed to gw-04 (server recreated 2026-08-29T02:07:48). Suite at the end: 108 binaries, 842 Rust tests, 92 frontend tests, tsc clean.

The gate's exfiltration rule matched a spelling production never writes

5a2ed8f. One rule stood between an agent and sending the checkout off the machine, anchored to a segment STARTING with curl -X POST. The tap held the answer: 166 curl invocations across two production missions, every one a GET, and every one beginning curl -s. The -s pushes the needle off position zero. curl -s -X POST … -d @secret, -d @file, -F, -T, --upload-file, wget --post-file — all allowed.

Match::Carries matches a segment that starts with the command and contains the needle anywhere; CarriesExact exists for flags whose CASE is their meaning (curl -F uploads, -f fails quietly, as in the ordinary curl -fsSL). Segments are lowercased individually, not up front. All 158 recorded production commands replay through the new script with 0 false positives.

A subagent's tool calls are no longer credited to its parent

fe5c7d2. Measured against the real claude binary, not reasoned about:

1. Subagent tool calls DO fire both hooks. PreToolUse blocked a subagent's denied curl. Agent is not a gate bypass.
2. They carry the PARENT's session_id — which is why attribute_sessions keeps working; a subagent never adds a session.
3. Only agent_type/agent_id tell them apart, and parse() read past both.

The tap appends the raw payload, so those fields were always on disk. Host-side fix only, no image rebuild.

The rest

• bd7fd46 — a mission that cannot attach to clawmates_edge now FAILS to launch. clawmates_core is internal: true with no default route, so a discarded attach error meant a mission running with zero egress while reporting success. Behaviour change: it can now stop a mission starting.
• 2f1a870 — skills.always_inject (migration 0083). Delivery and scoring both, because they are different mistakes.
• f26de3b — agent.last_run, the metric band's historical half.
• fde1341, 563b074 — the egress measurement and the upstream scan.

Verified live, and one honest negative

A validation mission ran locally on the index arm (01a04f74-564b-7cd3-9b55-9d8f29d3e2f4):

always_inject	CONFIRMED — same prompt, same arm: workspace-repo-commit-protocol inlined as a full body, scientific-writing-conventions offered as a uri
retrieval still works	CONFIRMED — ReadMcpResourceTool(uri="skill:global/web-search-triage"); the flag did not collapse the arm
the corrected gate	CONFIRMED installed — new rules present in the live container, node present, no inert marker, 0 denials against 23 body-free Bash calls
attribution	34/34, third perfect run
subagent column	written, all null — correct, no subagents spawned
subagent path	unexercised in THIS run; closed on 2026-09-05 by 01a07498 — see the top of this file.

Open, in the order I would take them

1. Confirm the last-run cards in the prod UI. They read HISTORICAL data, so unlike everything else this pass they should work right now against the two 2026-08-25 missions. If blank, suspect the roster join: agent_last_run reaches agents via team_members → mission_teams → missions, so an agent no longer on the mission's team will not resolve.
2. Three fork items, all behind one runtime image rebuild. Branch port/config-write-lock on the zeroclaw fork carries upstream 841f28c7f1 (cherry-picked CLEANLY despite being 331 behind; handle_prop_put — the endpoint ClawMates writes through — now takes the lock). Not merged, not deployed. Still to take: credential-fragment redaction (eadaee0b62) and /api/pair lockout hardening (47adb9863e). Tank is offline, so the rebuild has to happen on gw-04 and push to the web-01 registry.
3. Mission egress remediation — written up in MISSION-EGRESS.md, deliberately NOT applied on the operator's call. A mission container reaches the entire tailnet and host SSH.
4. The 331-commit upstream merge. 18 overlapping files; claude_cli.rs cannot conflict (zero upstream files).
5. Two silent-discard defects found by sweep, not yet fixed. container_tool_hooks::install's outcome is discarded at both call sites and recorded nowhere, so "did this mission run gated?" is unanswerable once the container is reaped — and PreToolUse is now a security control, not just telemetry. vm_tool_gate::INERT_FILE has no reader anywhere (low severity: node v22 is in the image, so it cannot currently trigger).

State you should know about

• Local DB has test state: workspace-repo-commit-protocol.always_inject = true, set by hand for the validation run. Production has none set — always_inject is deployed, defaulting off, changing nothing until someone marks a skill.
• No production mission since 2026-08-25. Everything above is deployed and, apart from the last-run cards, unexercised in prod.
• Fleet offline 17 days — architect, morpheus, tank; nodes table is empty. microVM tier stays blocked.
• Postgres is named differently on each stack. Locally it is clawmates-postgres-1 (dashes); on gw-04 it is clawmates_postgres_1 (underscores). Same for server/frontend. Using the wrong one gives "No such container", which reads like a down stack rather than a typo.
• target/ is a symlink to /Volumes/NVMeRAID. If it detaches mid-run, cargo dies with SIGKILL and then Not a directory. It is the drive, not a flaky test.

Deliberately not done

• The mission executor swap — blockers are structural (see prior handoffs).
• A tap for the direct-session tier — dormant, CLAWMATES_MISSION_EXECUTOR unset in production.
• cm-brain offline tests — 6 of 9 need live clawbrainhub.com.