clawmates/docs/NEXT-SESSION.md

# Where this left off — 2026-09-05

`MISSION-EGRESS.md` has what a mission container can reach, `UPSTREAM-SCAN.md`
the fork-vs-upstream position, `SKILL-USE-BASELINE.md` the delivery measurement.

## Read this first — the judge is back, and the subagent path is proven

The z.ai quota reset on schedule. `glm-5.3` answers again on the same key
(`sha256[0:12] = 616fb5076696`), and it has since passed a real `done_when`, not
just a ping. **Nothing is blocked on the judge any more.**

Mission `01a07498-d343-7953-9ed1-8ea9ba83b140` (2026-09-05, local, `index` arm)
was the previous validation run plus one change — a task that EXPLICITLY
instructs `Agent` delegation — and it closed both items the last pass left open:

| | |
|---|---|
| judge recovered | **CONFIRMED** — phase `completed` on iteration 0, first attempt. The verdict cites the actual arXiv ids it checked and the "what could not be established" section by name. A substantive read, not a rubber stamp. |
| **subagent attribution** | **OBSERVED, finally.** 87 tool calls: 43 from the main turn, **44 across 4 `general-purpose` subagents**, 4 distinct `subagent_id`s matching 4 `Agent` spawns. The field had only ever been unit-tested before this. |

The delegation had to be *demanded*. The earlier task invited it and got none;
naming the tool and saying "do not gather every approach yourself in a single
turn" produced four spawns. Worth remembering when designing any run that needs
to exercise the fan-out path.

The 429 that blocked the last pass was real (code `1310`, reset timestamp) and
the code was right to fail closed — `evaluator.rs:480` still refuses a
same-family fallback, and should keep refusing. If a `done_when` phase fails
again with the artifacts present and correct, check the quota before the mission.
## What shipped this pass

Seven commits on `main`, all deployed to gw-04 (server recreated
2026-08-29T02:07:48). Suite at the end: **108 binaries, 842 Rust tests, 92
frontend tests, tsc clean.**

### The gate's exfiltration rule matched a spelling production never writes

`5a2ed8f`. One rule stood between an agent and sending the checkout off the
machine, anchored to a segment STARTING with `curl -X POST`. The tap held the
answer: 166 curl invocations across two production missions, every one a GET,
and every one beginning `curl -s`. The `-s` pushes the needle off position zero.
`curl -s -X POST … -d @secret`, `-d @file`, `-F`, `-T`, `--upload-file`,
`wget --post-file` — all allowed.

`Match::Carries` matches a segment that starts with the command and contains the
needle anywhere; `CarriesExact` exists for flags whose CASE is their meaning
(curl `-F` uploads, `-f` fails quietly, as in the ordinary `curl -fsSL`).
Segments are lowercased individually, not up front. All 158 recorded production
commands replay through the new script with **0 false positives**.

### A subagent's tool calls are no longer credited to its parent

`fe5c7d2`. Measured against the real claude binary, not reasoned about:

1. Subagent tool calls DO fire both hooks. `PreToolUse` blocked a subagent's
   denied curl. **`Agent` is not a gate bypass.**
2. They carry the PARENT's `session_id` — which is why `attribute_sessions`
   keeps working; a subagent never adds a session.
3. Only `agent_type`/`agent_id` tell them apart, and `parse()` read past both.

The tap appends the raw payload, so those fields were always on disk. Host-side
fix only, no image rebuild.

### The rest

- `bd7fd46` — a mission that cannot attach to `clawmates_edge` now FAILS to
  launch. `clawmates_core` is `internal: true` with no default route, so a
  discarded attach error meant a mission running with zero egress while
  reporting success. **Behaviour change: it can now stop a mission starting.**
- `2f1a870` — `skills.always_inject` (migration 0083). Delivery and scoring
  both, because they are different mistakes.
- `f26de3b` — `agent.last_run`, the metric band's historical half.
- `fde1341`, `563b074` — the egress measurement and the upstream scan.

## Verified live, and one honest negative

A validation mission ran locally on the `index` arm
(`01a04f74-564b-7cd3-9b55-9d8f29d3e2f4`):

| | |
|---|---|
| `always_inject` | **CONFIRMED** — same prompt, same arm: `workspace-repo-commit-protocol` inlined as a full body, `scientific-writing-conventions` offered as a uri |
| retrieval still works | **CONFIRMED** — `ReadMcpResourceTool(uri="skill:global/web-search-triage")`; the flag did not collapse the arm |
| the corrected gate | **CONFIRMED installed** — new rules present in the live container, node present, no inert marker, 0 denials against 23 body-free `Bash` calls |
| attribution | 34/34, third perfect run |
| `subagent` column | written, all null — **correct**, no subagents spawned |
| **subagent path** | unexercised in THIS run; **closed on 2026-09-05** by `01a07498` — see the top of this file. |

## Open, in the order I would take them

1. **Confirm the last-run cards in the prod UI.** They read HISTORICAL data, so
   unlike everything else this pass they should work right now against the two
   2026-08-25 missions. If blank, suspect the roster join: `agent_last_run`
   reaches agents via `team_members → mission_teams → missions`, so an agent no
   longer on the mission's team will not resolve.
2. **Three fork items, all behind one runtime image rebuild.** Branch
   `port/config-write-lock` on the zeroclaw fork carries upstream `841f28c7f1`
   (cherry-picked CLEANLY despite being 331 behind; `handle_prop_put` — the
   endpoint ClawMates writes through — now takes the lock). Not merged, not
   deployed. Still to take: credential-fragment redaction (`eadaee0b62`) and
   `/api/pair` lockout hardening (`47adb9863e`). Tank is offline, so the rebuild
   has to happen on gw-04 and push to the web-01 registry.
3. **Mission egress remediation** — written up in `MISSION-EGRESS.md`,
   deliberately NOT applied on the operator's call. A mission container reaches
   the entire tailnet and host SSH.
4. **The 331-commit upstream merge.** 18 overlapping files; `claude_cli.rs`
   cannot conflict (zero upstream files).
5. **Two silent-discard defects found by sweep, not yet fixed.**
   `container_tool_hooks::install`'s outcome is discarded at both call sites and
   recorded nowhere, so "did this mission run gated?" is unanswerable once the
   container is reaped — and `PreToolUse` is now a security control, not just
   telemetry. `vm_tool_gate::INERT_FILE` has no reader anywhere (low severity:
   node v22 is in the image, so it cannot currently trigger).

## State you should know about

- **Local DB has test state**: `workspace-repo-commit-protocol.always_inject =
  true`, set by hand for the validation run. **Production has none set** —
  `always_inject` is deployed, defaulting off, changing nothing until someone
  marks a skill.
- **No production mission since 2026-08-25.** Everything above is deployed and,
  apart from the last-run cards, unexercised in prod.
- **Fleet offline 17 days** — `architect`, `morpheus`, `tank`; `nodes` table is
  empty. microVM tier stays blocked.
- **Postgres is named differently on each stack.** Locally it is
  `clawmates-postgres-1` (dashes); on gw-04 it is `clawmates_postgres_1`
  (underscores). Same for `server`/`frontend`. Using the wrong one gives
  "No such container", which reads like a down stack rather than a typo.
- **`target/` is a symlink to `/Volumes/NVMeRAID`.** If it detaches mid-run,
  cargo dies with SIGKILL and then `Not a directory`. It is the drive, not a
  flaky test.

## Deliberately not done

- The mission executor swap — blockers are structural (see prior handoffs).
- A tap for the direct-session tier — dormant, `CLAWMATES_MISSION_EXECUTOR`
  unset in production.
- `cm-brain` offline tests — 6 of 9 need live `clawbrainhub.com`.