The frame pump counted the live seqs from the last replayed event, which
is right only when the replay carried something. A client whose cursor
already sat at the record's head replays nothing, so the pump restarted
at zero: the client's next resume then named seq 0 and replayed the
whole record, and every event it printed in between carried a number
that named something else.
Base the count on the cursor when the gap is empty. The test resumes at
the head of a finished turn and asserts the next live frame names the
record's next seq.
A session that runs for weeks made every reconnect cost the whole
record: the events route replayed all of it, and the only cursor was a
count of events held, which cannot survive a gap. The replay is now
addressed by seq.
Every frame carries the record's seq as its SSE id, and since is that
seq, so a reconnecting client reads exactly the events it missed. With
no cursor the stream opens on the tail (the newest 400 events, cut back
to the first turn boundary in them) and goes live; the turns above it
come from a new history route, one whole turn per page, each ending
where the previous page began, with a more flag to stop the walk. A
cursor the record can no longer serve comes back stale with a reset
comment and the tail, read under the same lock as the live receiver so
the reset has no hole either.
The transcription fold in the store already had the seq column dense
per key; this exposes it as three range reads (after a cursor, the
newest window, the window below a point) instead of one whole-record
read, and keeps the in-memory record's seqs dense the same way, so a
store-less assembly answers the same protocol.
The resident dispatch's turn now runs under a steer select: the
messages route, after its ingest, signals a per-key interrupt registry,
the drop lands at the turn's current await (an in-flight shell command
dies with it), the dangling calls close, and the dispatch loops on the
same lease — the steered message runs as the next round, same session,
same stream. The interrupted turn closes on the stream with turn_done
carrying outcome "steered", and the shim's whole and streamed
answers both wait through steered end markers for the round that
actually replies.
The messages route answers 202 the moment the message is accepted; the
drain pass runs detached, so a turn's minutes never hold the request
open. The web composer leans on that: it never closes for a running
turn, the placeholder and the send button say that sending steers, a
steered outcome gets its own tone, and the sent-row echo dedup pops a
pending list instead of comparing the last item — a steered chain's
extra end marker can no longer double the row.
The test fabricated `acct-1` as the watch's account id, but `put`
assigns its own, so the dispatch refused with "names account acct-1,
which is gone" — the test proved nothing about the path it covered.
Capture the assigned id instead.
`(secret.kind == SecretKind::Token).then(|| WatchCredential { .. })`
constructs a value with no work, so clippy's unnecessary_lazy_evaluations
failed `checks`; `then_some` says the same thing.
`watch_forge` looked the dispatch key up in the `watches` table and
nothing else, so a thread that arrived through an *account* watch — the
daemon's own account notifications, which cover the whole instance, not
one repo — failed with "no watch configured" unless the same repo also
had a repo watch row. The dispatch is created by the account poll; the
client it needs is the account's. Nothing could hand it over, because the
payload did not name the account either.
The triaged payload now carries `account_id`, the dispatch drains the
inbox *before* resolving the client (the inbox is where that id lands),
and `watch_forge_as` falls back to the account watch that delivered the
news: its host, its credential, its login. A repo watch row still wins
when there is one — a thread with its own watch keeps its own identity —
and `watch_forge` keeps its signature for callers that know nothing about
accounts, falling back to the kind's first account watch.
The client cache is now one helper over `(forge, host, credential)`, so
the dispatch's replies ride the same pool the poll built.
A watch whose poll fails was invisible: `detect` turned the failure into
one `eprintln!` per tick and nothing else. A watch that had 401'd every
sixty seconds since the day it was created was indistinguishable — on
`/v1/watches`, in the agent's own `list_watches`, everywhere — from a
repository that had simply been quiet. That is how a dead credential
survives for weeks: the log line scrolls, and nothing else remembers.
`watch_health` is a third table beside `watches` and `account_watches`,
keyed by `(scope, forge, subject)`, holding `last_ok_at`, `last_error`,
`last_error_at` and `consecutive_failures`. Every detect pass records
each poll's outcome — repo watches as `repo`, account watches as
`account` — and the pass that *starts* a streak (the first failure after
a success, or after never having succeeded) pushes one device
notification, naming the watch and quoting the forge's error. The rest of
the streak stays quiet: the row carries the count, so the tick's log line
no longer has to.
Readable where the question gets asked: `/v1/watches` answers a `health`
array alongside the two watch lists, and the `list_watches` tool reports
`last_ok_at`, `last_error` and `consecutive_failures` per repo, so "is
this watch working?" is answerable without the daemon's stderr. A watch
that has never polled has no row and reports empty health, which is what
it is.
`resolve_watch_token` handed the adapter a bare string, so the client
could only ever try it as a token — and a `secret_kind` is a label the
human typed at `identity_save`, not a fact: a login password saved as a
token resolved as one, 401'd on every poll, and the watch stayed dead
with nothing said.
`resolve_watch_credential` returns the value *and* the login of the
account it came from (`WatchCredential`), the client cache keys on both
(one value sent two ways is two credentials), and the gitea client is
built with `with_login`, so the adapter's 401 retry can reach the
instance's own Basic-auth form.
A row token or the forge's environment variable names no login, so those
tiers resolve exactly as before: `WatchCredential::bare`, `login: None`.
`resolve_watch_token` stays as the token half, for callers with no use
for the login.
Every frontend spelled the same recipes in its own backend assembly,
and rhema-code spelled them three times: deepseek is the generic
adapter at DeepSeek's endpoint, zai is the Anthropic adapter at Z.ai's
route under bearer auth, each keyed kind takes its own adapter — with
the DeepSeek endpoint a string literal in three crates and the zai
recipe hand-rolled in each. The construction could not centralize
while the model catalog lived on inherent adapter methods: claw's
AnyProvider enum existed to box listings a trait object could not
reach, and code holding only a provider name had to construct
concrete types to list models at all.
rhema-provider gains the ModelListing seam, implemented by every
adapter, so the catalog is reachable through a trait object. A new
rhema-provider-registry owns the wiring: build() takes a
rhema-config PROVIDERS spelling plus whatever the caller resolved —
a key, the llama.cpp server address, a stored route override, blank
reading as unset — and returns the turn provider and the catalog
listing. What stays with the frontend is policy: credential
resolution, the retry wrapper, the default model. The base constants
and the named zai route constructor stay on the adapters they
describe. claw's AnyProvider died with its last reason to exist, ACP
no longer defaults an unknown catalog kind to google's, and adding a
provider is now adapter plus one registry row instead of three
frontend edits that had already drifted apart.
Two hand-rolled XDG resolutions survived the settings refactor: claw's
state_dir matched on XDG_STATE_HOME and HOME itself, and the ACP
adapter's session cache matched on XDG_CACHE_HOME itself — same class
as the global dir helpers this crate already buried. And the family
rule they implement was nowhere written down: the claw has its own
keychain namespace since the last refactor, yet its config, state, and
cache live under rhema's, with nothing saying that is deliberate.
Home carries the state and cache roots now, resolved with the config
base in discover and stated as the family rule in its doc: the
family's products share the XDG bases and nest below `rhema/` — claw
at `rhema/claw.yaml` and `rhema/claw`, the ACP session cache at
`rhema/acp-sessions`. A frontend from outside the family relocates
the whole set instead: relocated derives the frontend's name from its
config base's final component, dot stripped, and puts its state and
cache under that name, so godcode's artifacts never land under
`rhema/`. claw and the ACP adapter ask Home now; claw's NoStateHome
error variant died with its last user, and the ACP store's embedder
seam (AcpOptions::session_dir) was already there. SPEC records the
decision beside the keychain one it mirrors: the namespace is per
frontend, the nesting is per family.
The per-provider fallback ids were spelled in three crates that had
already drifted. claw's resolved_model carried a stale match that
answered deepseek, copilot, and zai with google's fallback while its
own backends.rs knew better; acp and the headless one-shot still used
the copy-pasted google default for openrouter, which claw's module doc
records as deliberately replaced by openrouter/auto — a router
deserves its own router id. Keeping three tables honest was a
comment-level contract ("the same defaults the headless one-shot
uses"), and the comments lied.
ProviderInfo gains default_model, every row fills it, and
rhema_config::default_model(name) answers with google's default for
an unknown spelling, the same fallback every caller hand-rolled. The
acp resolve, claw's backends and resolved_model, and the headless
one-shot read the registry now; the three copies are gone. claw's
resolved_model test pins the arms that had silently dropped off.
Behavior changes, both toward the recorded decisions: the headless
openrouter fallback becomes openrouter/auto, and claw's deepseek,
copilot, and zai fallbacks become their real ids instead of google's.
rhema-config held both vocabularies: the stored settings and the
terminal UI's theme, palette, and onboarding state, under one Config
type with a global directory. A second frontend had to take the UI
settings to get the profiles, and every path helper resolved
$XDG_CONFIG_HOME/rhema no matter who called.
The crate now ships only the framework's contract. Settings is the
stored section, flattenable as one serde field. Home carries the
directory conventions as a value, so a frontend keeps its settings,
skills, subagents, and SYSTEM.md under its own base while
.agents/skills stays machine-global. Store is the seam a foreign
frontend implements over its own file and format, YamlStore is the
reference impl, and Platform collects home, store, and keychain
namespace at one construction site. KeyringSecretStore::named gives
each frontend its own OS keychain service, so two frontends never
share credentials by accident. examples/godcode.rs builds the whole
shape runnable: its own directory, its own JSON document, its own
namespace.
rhema-code's store::Document flattens the section beside its UI
fields, the layout on disk unchanged. serde's flatten silently drops
unknown keys, so the load path re-checks every leftover key against
the section: a typo'd profiles: stays loud inside the bigger
document. CodingAgentConfig gains home: Option<Home>, so a frontend
redirects skill discovery without calling the framework. claw and
acp name their keychain namespaces, and the mcp, coding-agent, and
subagents crates read conventions from the Home they are handed.
The crate binds the claw to its client tools, not tools at large,
so it carries the claw's name: package, lib and dep names, the
mock's binary, and the conformance suite's use paths. Specs and
README follow. The tools/contract directory keeps its name, and
no reference to the old name remains.
The phone's notification poll sent `since` unconditionally, and before
the first ack there is no cursor at all, so it went out as `?since=`.
Axum's `Query` hands a present-but-empty parameter through as an empty
string, and `Option<i64>` only forgives a *missing* key, so the whole
poll answered `400 Failed to deserialize query string: since: cannot
parse integer from empty string` and the phone showed an error instead
of an empty queue.
Both ends: the client omits `since` unless it has a positive id to send,
and a `blank_as_none` deserializer makes a blank value mean "not set"
for `NotificationQuery` and `EventStreamQuery` alike — an empty `since`
reads as "from the start" however it got there.
The claw README claimed the phone ingest dispatches battery, network,
and DND flips to the agent; the ingest door stores topic-keyed
payloads and answers "observed", and the Android worker posts nothing
but topic keys. The README now says state-only with the bare
phone:<device> key as the dispatch path, and the worker's comment
matches what it actually posts.
The watch key encoded source, repo, and number but not the thread
kind, and on GitLab an issue and a merge request share one number
space: iid 7 twice produced one key, one snapshot, and comments on
the merge request landing in the issue (or a 404 fallback that
misrouted the other way). The key carries the kind now —
{source}:{kind}:{owner}/{name}#{number}, with GitLab spelling the
pull variant mr — comment and snapshot route outright by kind, and a
kind-less payload parses to the unparsable key instead of guessing
issue. The claw's callers thread the kind from the payload and strip
the segment where the bare repo is wanted; pre-kind stored keys parse
as None rather than misroute. Four route-pinning wiremock tests cover
the GitLab split, and the GitHub/Gitea clients take the kind without
using it (their issues and PRs share the same REST space).
There is no native tool for this, and images are shell data like any
other, so the surface is a bash function the model pipes into:
curl -sL https://example.com/photo.png | see, or see path.png. The
name reads as a sentence in the pipe position, keeps working as a
plain argument for local files, and is one const in vision.rs if it
ever needs to change.
Two halves, joined by a staging directory. Provision writes the
BASH_ENV init file one non-interactive bash sources; see() execs the
rhema binary's hidden __vision mode, which sniffs magic bytes, stages
them under a 0700 per-process dir, and says so on stdout. 5 MB per
image (the strictest API ceiling), png/jpeg/gif/webp only, and a
refusal exits 2 with the reason on stderr so the model reads the
limit in-band rather than losing the bytes to a silent drop. Attach
runs after every bash command that reaches an exit: ShellTools drains
the staging dir into ToolResult.images, a new core field. Bytes never
ride stdout, so output caps and truncation cannot eat them, and a
staged image attaches even when the command failed. The model staged
it, so it belongs in the context. The caps: 5 MB staged, 8 images per
result, the rest named in the result's text, because a for loop
staging 30 screenshots must not cost a context window.
serde keeps the field default, so old checkpoints load unchanged.
Anthropic carries native image blocks in the tool_result content
array, text first. OpenAI-dialect tool messages (llama.cpp, Copilot,
OpenRouter, DeepSeek) and Gemini carry text only, so each withheld
image is named in a trailing note the model can act on. The
transcript's byte accounting and summaries count the images; the
coding-agent config carries the prompt section, and the render adds
the section only when wired.
Frontends provision only where their bash runs locally: the TUI's
session_agent_config, the headless one-shot, the ACP adapter, the
claw's daemon, the same gate the MCP wire applies, because a session
whose bash runs elsewhere cannot write where the drain reads. The
vision wiring lands before the MCP wire so BASH_ENV names the MCP
file last and its baked predecessor line reaches the vision init;
both functions end up defined. Subagent inner shells inherit the
parent's wiring, so a spawned agent keeps the macro in its own
commands. SPEC's decision bullet, AGENTS.md's scope line, and the
README row land with the feature.
The claw's side of §10: one bridge per process, established at first
agent build and never re-read — the claw is single-instance and its
servers are stateful across calls, so a mid-process rewire would
orphan running sessions' socket paths. The global `mcp.yaml` is the
claw's config scope (no profiles here); the off switch is
`disabled_mcp_servers` beside the rest of claw.yaml, and both agent
construction sites — chat turns and `coding_agent` jobs — layer the
wiring on: the init file and socket and token into `shell_env`, the
post-filter lines into the prompt's `mcp` section, the persisted set
into the config. A frontend without wiring changes nothing, so the
daemon without `mcp.yaml` behaves exactly as before.
The test configs gain the new field; the fd-limit discoveries from
the workspace run are already handled by the harness runs above.
The spec's §10 consumer steps land. The rhema binary routes `mcp`
and everything unrecognized (the external subcommand, which is the
road the init file's stubs take: `rhema __server <name> ...`) to
rhema_mcp::cli::run, whose exit code owns the process; outside a
wired shell it exits 4 silently, exactly the spec's contract. The
claw gains its first subcommand the same way (`claw mcp ...`).
The frontends wire: session_agent_config (the TUI's three call
sites) and the headless one-shot merge the wiring's shell_env into
the agent config and the lines into the prompt's mcp section --
always behind the sandbox gate, so a session whose bash runs
elsewhere advertises nothing it cannot run. The registry keys by
profile name: a profile switch rewires, staying put reuses the
bridge and its already-spawned servers. The bridge itself moved to
a dedicated thread with its own runtime in this pass, which is what
makes wire() synchronous -- a dedicated runtime dropped at return
took the accept loop with it the first time, and a blocking CLI read
starving a current-thread runtime taught the same lesson from the
other side.
Muting persists: disabled_mcp_servers lands beside skills_disabled
in the config file, the settings toggle writes both the live set and
the config through save_config, and the running agent rebuilds so
the very next turn sees the change -- the MCP twin of the skill
toggle, with the round-trip test extended to assert the config.
The process-level pin the spec's §9 asked for: a bash child sources
the provisioned init file from BASH_ENV, calls the generated
function, the stub execs the CLI bin (the same dispatch the rhema
binary routes to), and the envelope prints -- plus the unknown-tool
path exiting 2 through clap's own text. provision and wire grow
provision_with_bin/wire_with_bin test seams so the exec chain can
run without building the frontend; the standalone rhema-mcp-cli
bin target is the seam's exec side.
The old ladder doubled from one second and capped at two: three
attempts, three seconds — enough for a hiccup, nothing for a
reassociation or a real outage. The policy now takes two explicit
ladders and picks by error class. A dead link (Network) is the local
machine's problem and waiting can fix it, so it walks 1s, 3s, 30s,
60s, 300s — six attempts, six and a half minutes all told. A
struggling server (Timeout, 408, 5xx, an exchange that closed before
any content) fixes itself in seconds or not at all inside a turn,
and every timeout attempt also burns the request's own timeout, so
its ladder stays at 1s and 2s. Each ladder's length sets its attempt
count, so the policy can no longer disagree with itself.
Each wait is announced as an Event::RetryWait (error, delay,
attempt, total) before it runs. rhema-code carries it as a deadline
and the status strip counts it down — the error in the alarm color,
the attempt, the seconds left — while any event from the next
attempt clears it. Esc still cancels mid-wait: the executor drops
the future at the sleep. ACP, claw, subagents, and the cloud wire
ignore the event; from_event returns Option now, so a frameless
event sends no frame. The hosted frontends keep the short ladder on
both classes: their invocation outlives no five-minute wait.
The pinned toolchain's clippy grew opinions the older lint let stand:
nested if/if-let pairs it wants as let-chains, and a modulo test it
wants as is_multiple_of. Machine-applied collapses, fmt-settled, no
behavior change — the gauntlet runs clean again.
The models route's cards serialize as rhema-provider's ModelCard
spells them, so supports_vision rides exactly when the adapter knows
it and is absent when it does not — unknown stays absent, never
false. The route's doc now pins that contract, and a listing builder
on Backend lets the surface tests mount one offline.
The shim's last user message now cuts the image_url parts along with
the text: an inline data URI with a parseable mime rides to the turn
as an image block, a remote http(s) url and an unknown mime are
skipped, and the messages route's image budget applies. Text-only
requests are unchanged.
A chat message may carry inline images: the messages route checks the
budget (5 MiB decoded per image, eight a message) and the dispatch
copies the bytes into the attachment store, so the replay streams ids
and media types over SSE, never megabytes. The turn's input carries
the inline image blocks the providers take, base64 verbatim — the
session checkpoint holds what the model saw.
Providers map images to per-backend content blocks, so the block rides
the message seam beside the tool blocks and round-trips through session
checkpoints. Untagged serde keeps old payloads loading; the new variant
sits last so the field sets disambiguate. Exhaustive matches on Content
across the adapters and views gained a mechanical Image arm; sending
images is a later effort.
BackendError and WatchShapeError replace the String registry and
watch seams, the tool operations report ToolError, the accessors
drop the get_ prefix, the too-many-arguments allows become
expects, and the llama catalog passes through unchanged.
The last forge content in config.rs was vocabulary, not data:
`ForgeKind` (name/parse/token_env/default_base) and the pure
`resolve_token` helper. By the same rule that moved `Watch` to the
watch table and left `CalendarWatch` in the calendar integration,
the kind belongs to the crate that speaks the forges.
- `rhema-forge-integration` gains `kind::ForgeKind` and
`resolve_token`, with the parse and token-fallback tests moved
alongside — the claw's config tests were testing the integration's
type through a re-export.
- The claw's surfaces import the type from the integration directly;
the crate root re-exports it, so `rhema_claw::ForgeKind` keeps
resolving for everything downstream.
config.rs is now config: credentials, the surface, paths, cadence,
and nothing that knows what a forge or a calendar is.
The streaming progress seam grows from a bare output callback to
ToolProgress: output chunks as before, plus an optional ToolStatus —
the phase a tool's inner work is in and, when the tool runs model
calls of its own, their cumulative spend and the model they ran on.
The engine stamps the call's id on it and the sink receives it as an
ephemeral ToolStatus event, replacing any earlier one for the call;
status is screen-facing, never history.
The subagent tool is the first emitter: its inner turn's lifecycle
becomes phase transitions (thinking, running, writing output) and a
running token total. Every sink decides what a status is worth: the
cloud wire forwards it, ACP and the claw have no slot and drop it.
The calendar table gets the same contract treatment as every other
data domain: a named route constant, three allowlist rows (GET, POST,
DELETE /v1/calendars/{name}), mock-router arms that enforce the
door's loudest rules — a named calendar, an ics with a URL — and
conformance cases (add, the invalid refused, listed, removed) that
run against the mock and the real daemon alike, so the two cannot
drift. The claw's auth middleware reads the same list, which is how
the rows land there with no claw-side code.
The spec names the doors and the pattern they establish: domains the
daemon reconfigures at runtime live in tables behind their routes,
validation runs at the door, and claw.yaml carries only what boot
needs.
Same move as the watches, and the config's last piece of integration
state goes with it:
- `rhema-calendar-integration` owns the calendar table now
(`store.rs`): SQLite in the shared dispatch database, the pattern
the claw's watch table established. `CalendarWatch` gains the
`validate` the config's boot check used to run — per-kind URL and
credential rules, plus the lead-under-horizon check — so an invalid
calendar is loud at the one door every writer shares.
- `CalendarSource::from_store` reads the table fresh on every detect
pass (the forge source's pattern): a calendar added over the route
is live next tick, a removed one stops polling, no restart in the
story. The static constructor stays for tests.
- `POST/DELETE/GET /v1/calendars` on the daemon: the POST body is the
integration's `CalendarWatch` shape, validated at the table; DELETE
takes `?name=`; the api listing names the door.
- `ClawConfig.calendars` is gone. A config still carrying it is
refused at parse time, like the retired `watches:` seed. The
config-side validation and its tests moved with the type.
The config file now carries only what boot needs: credentials, the
surface, paths, the poll cadence. Everything the daemon reconfigures
at runtime lives in its tables, behind its HTTP doors.
The YAML `watches:` seed was the last piece of forge state the config
file carried. Everything else about watches already lived in the
extension: the table (SQLite, runtime-managed), the HTTP routes
(`GET/POST/DELETE /v1/watches`), the chat tools, the poller that reads
the table fresh every pass. A static seed list on top meant two homes
for one fact — and the seed's own semantics (import-once, ignored
once the table has rows) had to be explained to every reader.
Now the config carries none of it:
- `ClawConfig.watches` is gone, with the `Watch` seed type and the
boot-time validation loop that guarded it. A config still carrying
`watches:` is refused at parse time — `deny_unknown_fields` turns
the retirement into a loud migration, not a silent no-op.
- `Watch` moved to `watch_store` (re-exported from the crate root),
where the row's vocabulary belongs; `validate_watch` keeps guarding
the one door every writer shares — the routes and the tools both
call it, so the moved validation tests test it there.
- `seed_from_config` and the daemon's seeding are gone; the operator
seeds once over HTTP or `watches add`, and the table stays true.
The one guarantee the seed carried that nothing else did — boot
refuses a tokenless watch — goes with it, deliberately: a tokenless
watch now fails at its first poll, loudly, like any other watch the
agent adds at runtime. Boot-time certainty was paying for config
state the daemon no longer owns.
The agent token is deliberately barred from /v1/ingest: the events
are the inbound channel, and the model must not feed it itself. But
the same bar closes the door on every honest integration too — a
sidecar poller with events to hand in had to hold the human token,
which is wider than its job. This adds the missing class: a third
bearer, the ingest token, answering the event door and nothing else.
`ingest_allowed` is the whole credential in one function — one
route row, `POST /v1/ingest` — symmetric with `agent_allowed` and
suite-covered the same way: the mock and the daemon's real router
both answer the new checks (a push succeeds with the contract header;
a watch read and a consent answer are 403). The middleware classifier
gains the third arm, boot refuses an ingest token equal to either
other credential — one value playing two roles silently widens the
scoped one — and the daemon provisions it to tool shells as
`RHEMA_INGEST_TOKEN`, so a tool that only pushes events never sees
the wider agent token at all.
The door is the first half of the extensions story (rhema-tools spec
§8): a self-timed sidecar is now a tier-1 tool with a credential
narrow enough to hold.
The claw is the server half of the client tools. The middleware now
knows two bearer classes: the human token answers every /v1 route as
before; the agent token answers only the routes the contract
allowlists, and only with the contract header at the matching version
— consents, sessions, ingest, and the phones answer it 403, so a
model holding the token cannot prompt-inject its way past the scoping
to answer its own secret asks. Boot refuses the configuration where
agent_token is the human token: the scoping is the safety, and one
value playing both roles silently unscopes everything the shell
holds.
Three new routes write the tables the resident already reads: push to
the notification queue, schedule and cancel tasks the resident's tick
fires — the tools get native-shaped writes without the daemon growing
a second brain. A JSON fallback gives the one error shape everywhere,
unknown routes included. The daemon composes the tools' environment
(RHEMA_URL, RHEMA_TOKEN, the tools' bin dir on PATH) and hands it to
the resident's shell through the agent-tools env layer; with no
agent_token it provisions nothing, exactly as before.
The proof is the contract's conformance suite run against this router
over real HTTP — same answers as the mock, checked at test time.
phone loads its spec from an embedded manifest under
crates/rhema-claw/tools; the Rust side keeps only the invoke half.
It stays replay-unsafe: a resumed run must not re-queue a control
command or re-retire a device. With this every registry-served tool
spec in the daemon comes from a manifest; only the ToolResolver-style
tools (identity_exec) keep their specs inline.
coding_agent loads its spec from an embedded manifest under
crates/rhema-claw/tools; the Rust side keeps only the invoke half. It
stays replay-unsafe: a resumed run must not re-enqueue a coding job
against an instance that is already running it.
ask_secret loads its spec from an embedded manifest under
crates/rhema-claw/tools; the Rust side keeps only the invoke half. It
stays replay-unsafe: a resumed run must not re-prompt the human or
re-store the credential the first ask already landed.
attach_file loads its spec from an embedded manifest under
crates/rhema-claw/tools; the Rust side keeps only the invoke half. It
stays replay-unsafe: a resumed run must not re-attach a file the
transcript already carries a card for.
identity_set loads its spec from an embedded manifest under
crates/rhema-claw/tools; the Rust side keeps only the invoke half. It
stays replay-unsafe - a resumed run must not re-write the identity.
identity_save, identity_list, and identity_forget load their specs
from embedded manifests under crates/rhema-claw/tools; the Rust side
keeps only the invoke half. identity_list declares replay_safety:
safe - the store answers with its own redacted records - while save
and forget stay unsafe: a resumed run must not re-store an account or
drop one twice. identity_exec keeps its spec inline; it is a
ToolResolver, the exec seam itself, not a registry tool.
notify loads its spec from an embedded manifest under
crates/rhema-claw/tools; the Rust side keeps only the invoke half.
The drift test pins the shipped set: the manifest loads against its
builtin, the registry serves the manifest spec, and notify stays
replay-unsafe - a resumed run must not re-send a notification.
watch_repo, unwatch_repo, and list_watches load their specs from
embedded manifests under crates/rhema-claw/tools; the Rust side keeps
only the invoke half. The manifests stay name-sorted, which is the
order the registry serves and the roster shows. list_watches declares
replay_safety: safe - re-reading the table on a resumed run is free -
and the drift tests pin the shipped set: every manifest loads against
its builtin, every builtin is named by a manifest, and replay safety
reaches the resolver from the file.
bootstrap_save now loads its spec from an embedded manifest, one
folder under crates/rhema-claw/tools; the Rust side keeps only the
invoke half, behind the run.builtin id. Drift tests follow in the
registry's own suite shape once the family grows; for now the
registry asserts the manifest loads, and the render tests exercise
the manifest-served spec through the roster.
The section-header restructure renamed the onboarding offer from
"## Setup" to "## Onboarding" in ONBOARDING.md; three prompt
assertions still looked for the old heading and failed. They follow
the file now.
schedule_task, list_tasks, and cancel_task load their specs from
embedded manifests, one folder per tool under crates/rhema-claw/tools;
the Rust side keeps only the invoke half. list_tasks declares
replay_safety: safe, so a resumed run may re-execute it. Drift tests
pin the shipped set: every manifest loads against its builtin, every
builtin is named by a manifest, and the registry serves the manifest
specs verbatim.
First landed flag-gated: the mechanics were unproven at coding-traffic
scale and the view changes what the model sees past the budget. The
claw then ran every surface on it and nothing fell over, the only user
is the deployment's own, and the sessions most likely to hit the
budget were the ones least likely to find a flag. Below the budget the
decorator is a pass-through, so the default's only always-on cost is
the zoom spec in the prompt.
transcript: None is the off switch; rhema-code spells it
--no-transcript, the claw's transcript: false now writes the resolved
value so false still means off. Saved sessions view fine: the log
stays complete and the view derives per request. The system preview
names zoom too, so what is previewed is what turns send.
The claw's sessions never end by design — one interactive chat, forge
threads alive as long as their pull requests, coding jobs stashed
across runs — so off-by-default would mean the view is never on where
it matters most. On: chat turns wrap the provider seam with the view
and join zoom to the resolver chain, the mirror living on the handler
so it survives the per-dispatch agent rebuild; forge threads and
coding jobs set the coding agent's transcript field. The config turns
it off with transcript: false.
vhaudiquet
kosmos
