The owner's to-do list of 2026-11-06, triaged and ruled on 2026-11-07, plus every to-do the root lane found since. Maintained automatically; the attention strip is what to look at.
Spans are the root lane's estimates until each lane plans its phase; dated milestones are real.
| R1 | done | "Patent fees, pay Nov 7" - nothing is due; the item had no source Dropped. Next real date: the unified non-provisional filing, March 2027. | owner | |
| R2 | done | Message-archive round 2: the rulings sitting In progress today. Also the fix for "EVA can't read recent messages". Sitting #4 closed 11:19 (both batches ruled, identifiers 13/13, amendment ratified). First apply landed on the live database 12:20 under the owner's sign; the second apply's token awaits the sign - the EVA lane rows carry the rest. | owner + EVA | |
| R3 | done | The language module defined: double feed + minions + HERO → graduation tiers → federation HERO is faulty; the whole chain gets a check-up (Phase 202 scope). | owner | |
| R4 | done | EVA reads all of the owner's health documentation and readings from the health vault Ruled: allowed, full scope, owner's own records only. Execution tracked in section 2. | owner | |
| R5 | done | "Milestone 3" = EVA v3.0, Track A (appearance) Migration gate lifted for the visual path the same day. | owner | |
| R6 | owner action | Patent counsel: candidate identified; engagement next week Deferred to the week of 2026-11-09. | owner | |
| R7 | done | Voiceprints learned from voice notes, with participant consent Ruled: proceed. Consents collected by the owner, starting today. | owner | |
| R8 | done | Ten styleframes read; eight Track A design decisions ruled Body/field states · displacement layer · state-derived light · one surface, never a corner · ring as an arrangement · H-band palettes + saved looks + attention lighting · renderer substrate · field knobs first. | owner + root | |
| R9 | done | Engine direction: keep Three.js; Babylon and PlayCanvas out; native wgpu as the horizon A drop-in Three API on wgpu exists but is days old - watch item, not a dependency. | owner |
| 1.2 | open | Patent status check through the existing surfaces; fix two stale rows in the architecture doc No fee due. Watch task for the trademark docket is red since 11-04 - read the run. | root · evidence | |
| 1.3 | open | Refresh the four outreach drafts (June 2026) - teaser / one-pager External-safe rule stands: vision and traction only. | EVA docs | |
| 1.4 | owner action | Introductory email - when triggered Drafted beside 1.3 when the trigger comes. | owner |
| 2.1a | open | Health vault: flip the owner's subject to EVA-readable; amend the boundary docs Step A + E of the written spec. The switch still reads "never" on disk. | health vault | |
| 2.1b | open | Convergence layer: the health connector (records + analyses as packages, key set, tests) Step B + D. Digests only; never raw data to the brain. | orchestrator | |
| 2.1c | open | On-demand export of EVA's own signals into the vault Step C. Operator-triggered, never continuous. | tools / EVA | |
| 2.1d | open | Verify the health packages reach EVA's bridge context in a capture boot Receive side already exists (5-minute poll). | EVA | |
| 2.1e | owner action | Second ring joins the same device route when it arrives Ordered 11-06; developer access confirmed; pairs on arrival. | owner · health vault | |
| 2.2 | dropped | "Tools for EVA to reason over raw ring data" Intelligence lives in the convergence engine; the brain reads the reasoned summary. | - | |
| 2.3 | open | Voiceprint learning from voice notes - new phase, consent-gated, embeddings only Per-channel enrollment; profiles emit confidence + provenance; the brain weighs. | EVA (after round 2b) | |
| 2.3c | owner action | Collect participant consents Starting today. | owner |
| 3.1 | open | Left panel hidden by default A 202 UI decision now that the panel is identified. | EVA · Phase 202 | |
| 3.2 | open | HERO module redesign Six decisions already ruled in October; discuss pass pending. HERO first. | EVA · Phase 202 | |
| 3.3 | open | The brain receives what emerges from the Lab (as data feeds) Real gap: no feed from vocabulary / pool today. Prerequisite: the scheduler-starvation fix. | EVA · Phase 202 | |
| 3.4 | open | Poems reach the brain's reasoning, not only the screen Today: a mood weight only; the poem accessor has zero callers. | EVA · Phase 202 | |
| 3.5 | open | Verb gifts keep happening - verify Built and wired; counter read + ghost-method fix. | EVA · capture boot | |
| 3.6 | open | Check-up of the rest of the chain (double feed, minions, graduation tiers) Owner: "the rest also needs check up". | EVA · Phase 202 |
| 4.0 | done | Record the gate lift and pin the styleframes manifest in the v3.0 scoping Recorded 2026-11-07 in the v3.0 scoping beside the 11-03 output-streaming lift; the styleframes doc pinned into the EVA planning tree (source sha256 89efeaa9…). EVA commit 29145e18, pushed. The Track A discuss itself stays owner-present, parked until after the one boot. | EVA | |
| 4.A0 | open | A0 - renderer substrate: WebGPU renderer in the worker, WGSL cloud-kernel contract, deferred lanes re-lit once Recommended first. Worker renderer is already the live default; three.js 16 releases behind. | EVA · Track A discuss | |
| 4.1 | ruled / specced | Visual revamp from the styleframes - the vibe is the brief Eight decisions ruled; HUD text in the frames disregarded. | EVA · Track A | |
| 4.2 | open | Flocking: field-knob sitting first (sheet + vortex references), neighbour pass only if needed Start from the list of knobs actually live in worker mode. | EVA · Track A | |
| 4.3 | open | Speaking-state configuration None exists today. | EVA · Track A | |
| 4.4 | open | Thinking-state: fix the dead event wiring, then the richer state A listener waits for events nothing emits. | EVA · quick | |
| 4.5 | open | Axis-driven configurations - verify the trigger 33 presets + GPU transitions exist. | EVA | |
| 4.6 | done | Idle state alive and subtly active Controller re-lit 2026-10-25. | EVA | |
| 4.7 | ruled / specced | Body ↔ field as two states of one cloud (transition visible) Fix the retarget stutter first. | EVA · Track A | |
| 4.8 | open | The lit scene: one receiving surface (wall default, floor option, or void + fog), state-derived key light, particles casting shadow Genuinely new: no backdrop, no shadow pass today. | EVA · Track A (on A0) | |
| 4.9 | open | Attention lighting: the real data points she is looking at light up (idle exploration, queries) Primitive exists and is dark on the worker (residual R2); autonomous targets never lit. | EVA · Track A | |
| 4.10 | open | H-band palettes as defaults; admin-saved looks linked to states; admin-only look controls 109 saved looks; an idle event→look engine; mappings switched off since December. | EVA · Track A | |
| 4.11 | open | Arrangements (ring, vortex, sheet, lattice…) + autonomous arrangement by the four-force principle Tension / Coherence / Growth / Decay: written, no code. Old shape modules retire. | EVA · Track A | |
| 4.12 | open | Retarget stutter in the worker (upstream of all motion work) Evidenced 11-04. | EVA · Phase 129 |
| 5.1 | open | Correlator audit: degraded EVA connector, never-succeeded corpus connector, offline health connector Plus a bridge-health read on EVA's side. | orchestrator · quick | |
| 5.2 | ruled / specced | System-wide awareness of her own subsystems In-brain feeds (3.3 / 3.4), not a round-trip through the orchestrator. | EVA | |
| 5.3 | dropped | Connect every signal into the correlator as one item Each signal has its own home above; the archive connector stays deferred behind its gates. | - |
| 6.1 | ruled / specced | Continuous background cognition while idle Parked until the local reasoning substrate stands; the reflection lane is live meanwhile. | EVA · Phase 194 (v3.0) | |
| 6.2 | dropped | Non-deterministic exploration Already a standing mandate, not a task. | - | |
| 6.3 | ruled / specced | Associative discovery and self-directed attention Attention = valuation, never chronology. | EVA · Phase 194 | |
| 6.5 | open | Discoveries persist into long-term memory - verify Memory route + consolidation gate exist. | EVA · capture boot | |
| 6.6 | ruled / specced | "Meaningful activity, not random processes" as the acceptance criterion | EVA · Phase 194 | |
| 6.7 | open | Reflection-lane health read (no code) | EVA · next capture boot |
| 7.1 | open | A repeatable "portable procedure" as a deliverable of the substrate migration Mirrors + model manifest + identity snapshot restore + secrets out-of-band; never a single ZIP. | EVA · migration scoping | |
| 7.4 | open | Hardware detection at install (GPU, VRAM, CUDA arch, RAM, audio devices) | EVA | |
| 7.5 | ruled / specced | Hardware-adaptive configuration - backends and rendering yes, brain selection no One brain, deliberately adopted, never chosen per machine. | EVA | |
| 7.6 | open | Remove hardcoded machine paths (one root variable) 15 files. | EVA · quick | |
| 7.7 | open | Identity continuity across machines - the restore round-trip proof | EVA · migration gate 0 | |
| 7.8 | open | Startup diagnostics after migration - extend the existing health run and boot checklists | EVA | |
| 7.9 | done | Secrets out of the distributable Already the estate's rule. | - | |
| 7.10 | open | Host parity (one active runtime, snapshot handoff) Context written, not started. | orchestrator · Phase 38 |
| 8.1 | done | Verify the phone backup Custody chain closed 11-05. | - | |
| 8.2 | done | Why recent messages are unreadable Answered: a governed publish not yet done, waiting on the rulings sitting. Not a bug. | - | |
| 8.3 | done | Backup freshness Snapshot id and hash recorded. | - | |
| 8.4 | dropped | Import pipeline audit 28 plans, reviewed five times, documented. | - | |
| 8.5 | open | Chronological integrity (watermarks, parity legs) | EVA · 210-24 | |
| 8.6 | open | Retrieval validation on known recent messages | EVA · 210-27 | |
| 8.7 | open | Incremental import (--since) Planned; the missing piece. | EVA · 210-23/24 | |
| 8.8 | open | Diagnostics: last published timestamp, counts, refusals A status operation on the existing reader. | EVA · 210 follow-up | |
| 8.9 | open | End-to-end test on the round-2 capture boot | EVA · 210-27 |
| 10.1 | done | "The endgame document is local-only and cannot be rebuilt from git" - checked False. Tracked in the EVA repo, on the remote, and in the owned bare mirror. No priority-one gap. | root | |
| 10.2 | done | "The health vault is the Convergence layer" - checked False; the orchestrator is. The architecture doc's vault rows were stale the other way and are now corrected. | root | |
| 10.3 | done | "Active privacy-covenant violation in the orchestrator" - checked Stale: resolved in October. One rented copy remains by design until the dated erase on 11-10. | root | |
| 10.4 | done | Architecture doc v1.8: vault rows reconciled, filed families marked filed Checksum regenerated; dated copy on the backup drive. Committed to the root repo 2026-11-07. | root | |
| 10.5 | owner action | Satellite boundary rule (source-side default-deny, from the vault's pattern) added as PROPOSED Ratify or strike. | owner | |
| 10.6 | done | Content-addressed manifest of the canon (owned; replaces the proposed new repo + CI) One file, one verify command. Committed to the root repo 2026-11-07. | root | |
| 10.7 | in progress | Hygiene check that re-verifies the canon manifest Tools lane 2026-11-07: a canon-drift check exists in the machine-hygiene registry (built and tested, commit fa74c9a); it runs when the hygiene routine runs. The tools lane's own row carries the rest. | tools | |
| 10.8 | open | Map the architecture invariants onto the vault's files (covered vs missing) After the EVA-feed steps land. | health vault | |
| 10.9 | owner action | Run the dated erase list (last rented copy of the old training sink) 2026-11-10, owner-executed by rule. | owner | |
| 10.10 | dropped | New repository + hosted CI for the endgame document False premise, and new rented infrastructure on a vendor being exited. | - | |
| 10.11 | dropped | Retention tier carried in the source envelope Valuation is a convergence-layer rule; sources stay dumb. | - |
| 11.1 | open | aeva.aego.dev content rewrite Owner: 'quite the re-write'. Map done: every page is hand-written static HTML; the deploy pipeline itself is healthy (every push to the EVA branch redeploys). Stale: version strip and changelog frozen at March, brain described as the old four-tier router, no current milestone, old guardian names in eight pages, an in-page editor with a GitHub token field, backup files served. Brief: keep the robots block and origin lock, the thesis chapters and the two notes; kill the static changelog, the editor, the backups; render the status strip, knowledge index, model pages and a sovereignty page from the planning state, the canon manifest and the config files. | EVA docs | |
| 11.2 | done | Documentation health scored on this page Cross-repo audit folded: 25 documents scored, drift line-cited in the root planning record. | root | |
| 11.3 | done | Find the documentation-updating worker that stopped working, and why Identified: the in-app website worker + documentation bridge (patent → site-config → index sync, module timestamps, changelog). Loads every boot, never acts: its startup staleness check was disabled for freeze risk, file watchers died with context isolation, it only fires on an explicit architect voice command, and even then nothing commits or pushes, so the Git-integrated site never sees it. | root → owning lane | |
| 11.4 | open | Repair or retire that worker Decision for the EVA lane: give the worker a governed commit+push leg, or retire it and render the site at build time from the planning state and the canon manifest. Until then delete the site's 'auto-update pipeline' claim. | owning lane | |
| 11.5 | done | This page maintained in the background with an attention strip and a timeline Scheduled since 2026-11-08 on the owned scheduler (registry row progress-maintain, task "AEGO progress page"): 30 s after every logon, then every 30 min; rebuilds and redeploys only when something changed, retries a build-and-upload cycle that precedes Wi-Fi, alerts on the Desktop when a run fails. Replaced the session-bound loop, which died with its session on 2026-11-08 06:43 and left the page stale for 12 h. SessionStart hook installed 2026-11-07: every session under the estate prints the attention strip and its lane items at start. job · AEGO progress page: last run 2026-11-11 16:35 (UTC+01:00) ok · 1 s | root | |
| 11.6 | done | Orchestrator mandates: vault row, dead project path, incomplete repo table (plus two worktree copies) Orchestrator lane 2026-11-07: repo table aligned to the root branch policy (projects/ paths, utae / tools / major_domus rows); vault row and dead project path fixed; the two stale worktree copies removed. Docs-only commit on main. | orchestrator | |
| 11.7 | owner action | EVA system-knowledge copy in the orchestrator is seven months and 2,677 commits stale Orchestrator lane verified 2026-11-07: last synced 2026-04-10, 2,688 EVA commits behind, still mandatory reading there. Lane recommends retiring the copy in favour of a pointer to EVA's own document; the owner rules retire vs re-sync. | orchestrator · EVA | |
| 11.8 | done | Tools mandates file five months behind its registry Tools lane 2026-11-07 (commit fa74c9a): mandates category list = the six real directories; registry README corrected (the false 'untracked' claim, the missing category, the MCP note). | tools | |
| 11.9 | open | Money resume state untouched since April Resume state seven months behind commits; mandates file carries the old project name and lists two scripts that no longer exist. | money | |
| 11.10 | open | Guardian documentation regenerated (architecture doc + dev reference + README) One command: the existing sync script; it has never been called. README still names the pre-March guardian set. | EVA | |
| 11.11 | open | EVA resume-state frontmatter: three disagreeing stale dates Live blocks are current; the header is not. | EVA | |
| 11.12 | open | maze inventory still scans the pre-move project path Functional, not cosmetic: two config entries and a schema default point at a directory that no longer exists. | maze | |
| 11.13 | open | major_domus docs: review-round count, remote status and 'not started' all false since 11-05 | major_domus | |
| 11.14 | open | Vault docs: auth model predates the gateway; mandates say 'owner steps pending' though live; history stops at 11-03 | health vault | |
| 11.15 | open | Sovereignty doc claims a renderer that does not exist; guard script still pending Either ship the small renderer + guard or reword the claim. | tools · root | |
| 11.16 | open | Old model ids in renderer code comments Comments name the previous brain while the ids are current. Cosmetic, but it misleads readers of a mandatory file. | EVA | |
| 11.17 | in progress | Evidence resume state five days behind commits; roadmap text from June Evidence lane 2026-11-07: resume state brought up to the 6 Nov commits (current position covers 5 to 7 Nov); the roadmap text from June is still untouched. | evidence | |
| 11.18 | open | Gateway roadmap lists one phase while the milestone is complete | gateway | |
| 11.19 | open | utae mandates describe a deploy path that changed on 11-04 | utae | |
| 11.20 | done | Memory still points money at the old folder name Fixed in the root memory index this tick. | root | |
| 11.21 | open | A documentation-health check that runs on a schedule Nothing in the estate maintains the mandates files, resume states or the system-knowledge copy. Joins the machine-hygiene registry with the canon manifest check. | tools | |
| 11.22 | open | Site: remove the in-page editor and its GitHub token field A token typed into a browser on a gated page is a rented path and a leak surface. Part of the rewrite, but worth doing first. | EVA (site) | |
| 11.23 | open | Site: stop serving backup files, the integration summary and duplicate icons; confirm the 94 MB video is not in git | EVA (site) | |
| 11.24 | open | Site: render version strip, changelog, knowledge index and model pages from data at build time Sources: planning state, roadmap, canon manifest, config files. Pages has no build step today - add one or pre-render in CI. | EVA (site) | |
| 11.25 | open | Daily documentation analysis: results never reach storage The cron dispatch sends no run id, so every run logs 'skipping upload (dry-run mode)'. One-line fix in the change-controlled worker: plan + owner sign-off. | site worker (change-controlled) | |
| 11.26 | open | Documentation health score pinned at zero; patent extraction finds zero claims The score deducts to the floor every day, so it carries no information; the claim regex no longer matches the page. | EVA (doc worker) | |
| 11.27 | open | Orchestrator watchdog must validate the analysis OUTPUT, not the webhook's exit status Exactly the silent-degradation case the registry itself warns about. | orchestrator | |
| 11.28 | open | Self-repair mirror is four months behind the live code The publish workflow only runs on a 'stable' tag; the last was 2026-07-10. A self-repair today would restore July code. Push a fresh tag or dispatch the deploy. | EVA | |
| 11.29 | done | /progress on aego.dev and aeva.aego.dev redirects to the progress page Live 2026-11-07: aego.dev/progress, www.aego.dev/progress and aeva.aego.dev/progress all reach the progress page without the PIN (route rule deployed through the guarded path after owner sign-off). | EVA (site) | |
| 11.30 | done | Site worker: redirect /progress on the apex and the site host to the progress page before the PIN gate Live 2026-11-07: aego.dev/progress, www.aego.dev/progress and aeva.aego.dev/progress all reach the progress page without the PIN (route rule deployed through the guarded path after owner sign-off). | site worker (change-controlled) |
| 12.1 | ruled / specced | Ruling: the phone is a second body, never a second EVA - thin client, one brain on the workstation No client-side reasoning, no client-side speech recognition; raw audio rides an end-to-end encrypted overlay; the shell is Tauri 2, media over WebRTC inside the overlay. | owner · EVA | |
| 12.2 | in progress | Branch state: the port branch runs far ahead of and behind the main line 40 ahead / 336 behind as of 11-05 (a full-shell port: whole renderer carried to mobile, plus client-side ASR and a client LLM that will not board). Drift grows about one commit a day. | cousin | |
| 12.3 | ruled / specced | Salvage into a fresh branch from the current main line instead of a re-base Ruled 2026-11-09 (owner: go ahead): no re-base. `track-d` created from `eva-v1.1` HEAD 33755227 the same day; the salvage list is the lane's seeded task list; `dev-mobile` stays as the reference. | owner → cousin | |
| 12.4 | done | Handoff note to the cousinTauri lane · 11-09 Written 11-05. Sent by the owner 2026-11-09 07:44 UTC as a reply in the collaborator thread (ruling, branch, reading order, access, two questions back). A second note explaining the page's features (flags, collapse / expand, filters, the summary, the drop-in fields) was drafted the same day in that thread; the owner sends. | owner | |
| 12.5 | open | D1 - the overlay and the gateway host Workstation terminates the tunnel; phone and the remote server are peers. | EVA · Track D | |
| 12.6 | open | D2 - the thin Tauri client (mic + camera in; audio, text and a reduced cloud view out) Renders contracts; composes nothing; decides nothing. | cousin · EVA | |
| 12.7 | open | D3 - per-channel calibration and speaker enrollment for the phone microphone A phone mic is a different acoustic channel; the current echo calibration does not transfer. | EVA | |
| 12.8 | open | D4 - the WAN latency budget handed to the turn gate as data | EVA | |
| 12.9 | ruled / specced | Native rendering horizon: a Three.js-compatible API on wgpu exists but is days old Watch item for the shell decision; Three.js stays the authoring surface; the kernels are written portable. | cousin · EVA | |
| 12.10 | done | Cousin reports progress through a drop-in file on his branch The page reads .planning/progress-items.tauri.json from the lane's branch on the remote at every build; moved from dev-mobile to track-d and seeded with nine items on 2026-11-09. The lane flips them; nothing else is needed. | root | |
| 12.11 | done | Collaborator summary published and the cousin introduced to the page by email Summary gated by Cloudflare Access (owner + collaborator); custom domain progress.aego.dev attached 2026-11-07. | root | |
| 12.12 | done | track-d seeded for the Tauri lane: working agreement, mainline digest since 2026-09-15, progress drop-in Three commits on the branch 2026-11-09. The agreement names scope (D2 + the client side of D1), branch mechanics (weekly merge-ups, never re-base dev-mobile), reporting and the reading order. | root | |
| 12.13 | done | Collaborator access: push on every repository except the one project kept separate Owner directive 2026-11-09; the owner sent the ten invitations the same morning (push on every repository except the one kept separate). Acceptance is his; he already had write on the EVA repo and sits on the summary gate. | owner | |
| 12.14 | done | Collaborator summary carries a 'For the Tauri lane' block with the dated decisions that changed the lane's direction Data in items.json meta.collaborator_brief; rendered by build.py; name-free by construction. | root |
| 9.1 | done | Intake triage written, every item verified against code / git / disk | root | |
| 9.2 | done | Styleframes manifest, read, re-integration map, renderer note | root | |
| 9.3 | done | Memory and resume state updated | root | |
| 9.4 | open | Two stale patent rows in the architecture doc Tracked edit + checksum regeneration; left for the owner's word. | root | |
| 9.5 | done | This progress page Static, self-contained, no index. Live at progress.aego.dev; summary at /summary/ behind Access. | root | |
| 9.6 | done | Timeline fullscreen option Done 2026-11-07: 'Full view' pill moves the timeline into a fixed overlay (Fullscreen API when a gesture allows, overlay-only fallback), SVG sized to fit, Esc / pill / leaving fullscreen close it, focus returns to the pill; #timeline-full deep link. | root (page) | |
| 9.7 | done | More vivid palette for statuses and markers Done 2026-11-07: light #1fa7a0 / #f0b429 / #d12b31 / #8d7fc0, dark #39d6c9 / #ffc94d / #ff6b6b / #a78bfa; every chip label >= 4.5:1 (dark text on teal / amber / violet via --on-vivid); shapes still carry meaning. | root (page) | |
| 9.8 | done | The estate's animated particles background on the page Done 2026-11-07: vendor/ holds byte-identical copies of death/site/particles-reload.js + particles-bg.js (sha guarded in build.py), canvas fixed behind a translucent content panel, summary page too; CSP script-src gains 'self' only. | root (page) | |
| 9.9 | done | Page restyled in the evidence vault's design idiom Done 2026-11-08 on the owner's ask: dark-only vault shell (top-bar, meta-row, stat boxes, outlined filter chips, collapsible sections with the ▸ marker), vault palette (teal / azure / gold / coral / violet), Comfortaa + JetBrains Mono self-hosted from vendor/fonts (sha guarded); CSP gains font-src 'self' only. Summary page shares the shell. | root (page) | |
| 9.10 | done | Shared flags (owner + Tauri lane), collapse / expand all, back to top Done 2026-11-09 (Codex + Gemini plan review): Pages Advanced-Mode Worker + KV flags API (progress.aego.dev/api/*), Access app on /api/auth/* with the two-person policy, Cookie Path on both apps, e-mail secrets, merge-warning hook + brief line installed, register 1.0.7 (cf-kv-progress-flags, cf-access-progress). First use: SIGN IN TO FLAG once per browser. | root (page) | |
| 9.11 | owner action | Sections collapsed on landing, sticky top bar + pinned section titles, flag from a session (service token) Built 2026-11-09: landing collapsed, vault stacking, flag.py CLI + Worker service-token identity. OWNER STEP: run bash progress/setup-flag-token.sh once (creates this machine's Access service token into .env, the non_identity policy, FLAG_OWNER_CN, redeploys); then any session flags on your word: python -I [local path] <item id>. | root (page) + owner | |
| 9.12 | done | Access gate on the pages.dev hostnames: every hash-addressed deployment URL and the alias /summary The owner ran bash progress/access-pagesdev.sh 2026-11-11 00:11Z: two Access apps (wildcard *.aego-progress.pages.dev on every path; aego-progress.pages.dev/summary), the summary app's two-person policy copied. Verified 00:13Z: a hash URL's page and summary and the alias summary redirect to the Access login; the apex page, status.json and /api/flags stay 200. The script's first verify ran inside the propagation minute and printed FAIL; the re-run two minutes later passed. Register 1.0.14 (cf-access-progress). | root (page) + owner |
| 13.0 | done | Where the plan lives: the sovereignty mandate + the dependency register at the estate root (opened 2026-11-06/07) 65 registered dependencies: 30 to demote behind an owned seam, 21 tolerated with a dated re-judgment, 14 to drop. By vendor: 26 Cloudflare, 15 GitHub, 4 Google, the rest small. Rules S1-S12 bind every new proposal. | root | |
| 13.1 | ruled / specced | Rulings in force: GitHub = mirror then delete; Cloudflare = hibernated apex-only read-only tenant after the exit; origin hardware decided at E4 Cross-review-locked 2026-11-06. | owner | |
| 13.2 | done | E0a - root docs, register, mandate rows, one dead key pruned Done 2026-11-07. | root | |
| 13.3 | open | E0b - capture + zero-risk drops, per lane Redacted infrastructure manifest and zone exports to git; dead tokens removed; orphan DNS records dropped. Each lane separately authorised. | tools · EVA · site worker · gateway · vault · money | |
| 13.4 | in progress | E1 - durability: owned bare mirrors of all 16 repos Mirrors exist on the owned D: drive since 2026-11-07. Still owed: nightly push in the backup tool, an offline bundle with encrypted secrets, an independently powered replica. | evidence · tools | |
| 13.5 | in progress | E2 - one owned scheduler; every cron a registry row Nov-Dec 2026. The ten unregistered workflows get rows; the site worker's 09:00 dispatch retires after one local cadence. Tools lane 2026-11-07: registry plan drafted (one owned scheduler, every job a registry row); the page's own maintenance job is the first effectful candidate and needs a cutover window - see the tools lane rows. job · AEGO canon drift: last run 2026-11-11 15:15 (UTC+01:00) ok · 2 s · AEGO sovereignty register drift: last run 2026-11-11 15:20 (UTC+01:00) ok · 1 s | tools · orchestrator | |
| 13.6 | open | E3 - state comes home by journaling before every rented write Dec 2026 → Jan 2027. Owned write-of-record first, rented store second; snapshot-consistent ops dump to owned media. | evidence · orchestrator | |
| 13.7 | owner action | E4 - hosting re-home to an owned origin Gated; earliest Q1 2027. Entry gates: the hardware ruling (always-on box) and an origin acceptance test. Rollback is restore, not undo, after the point of no return. | owner · all lanes | |
| 13.8 | open | E5 - GitHub wind-down, two clean months after E4 Every runtime GitHub flow replaced first: site dispatches, page writes, the EVA publish and self-repair paths. | all lanes | |
| 13.9 | open | E6 - registrar, DNS and account; dated re-entry 2027-03-01 Domains to a plain registrar with zone export; owner re-judges name-server placement. | owner | |
| 13.10 | owner action | Owner rulings still outstanding for Track E Counsel freeze dates (proposed 2026-11-20 → 12-05); whether the architecture doc's sovereignty line is anchored on-chain; the gateway mandate amendment; the registrar check. | owner | |
| 13.11 | open | Drills: a restore from the owned mirrors, re-run at every phase gate No row has a recorded drill yet. | evidence | |
| 13.12 | done | This page is itself registered rent (a static-sites consumer) with the same exit as every static dir Moves to the owned origin at E4 like everything else. | root | |
| 13.13 | open | Automation-registry row for the progress page job (aego-progress-maintain) The E2 registry row progress-maintain (task "AEGO progress page", 2026-11-08) names an orchestrator automation-registry row that does not exist yet, so the fleet checker prints an XREF line every run. Add: surface windows-task, task_name "AEGO progress page", cadence every 30 min + logon (+30 s), cadence_seconds 1800, anthropic false (the Admin API cost read is billing metadata, not a model call). The canon-drift and sovereignty-register-drift rows have the same gap. | orchestrator | |
| 13.14 | open | Sovereignty guard: second checkouts and git worktrees need a generic rule (death-p6 flagged 15 consumer files already covered in death/) Found 2026-11-11 by the root lane's full guard read (two earlier reads only saw the tail): death-p6/ is a git worktree of death (branch p6-port, death 84882a5) and the guard's repo rule treats it as a repo named death-p6 that no row names, so 15 files already covered in death/ came out UNREGISTERED (death-p6/.github/workflows/data-guard.yml:55,56; package.json:8,9; scripts/access-gateway.py:32,181; scripts/deploy.sh:3,12,35,38; src/auth.js:31; test/guards.test.js:15,109,110; wrangler.toml:4). Interim, owner ruling 2026-11-11: register 1.0.15 carries a not_registered_because entry with paths death-p6/** (hides growth inside the worktree; turns STALE-PATH when the worktree goes, root drops it then). Ask: a generic rule in tools/system/sovereignty-guard/sovereignty-guard.ps1 - a dir whose .git is a FILE pointing at <repo>/.git/worktrees/ maps onto the main repo's consumer key, so growth inside a worktree stays visible - instead of a hard-coded name (ExcludedSegments at :97 prunes a name at any depth, :213; ExcludedPaths at :98 is the root-relative fit; test-sovereignty-guard.ps1:215 hard-codes the excluded-segments INFO string, so any list change updates that case; README:83,88). Same read also registered alessiodevecchi.com/scripts/phase11-sane05-rebuild.mjs (one-shot SANE-05 D1 rehearsal rebuild) under cf-d1-eva-ops; when the nemesis lane deletes it the guard prints STALE-PATH and root removes the path (a shrink, no ruling). | tools |
| 14.1 | ruled / specced | Introduction statement: organic path - EVA is told the situation in conversation and says it as she sees fit; no script, no brief An external draft script was checked claim by claim: three load-bearing claims are false today (open source, rules readable in git, local-first brain). Format kept: about 30 seconds, first person, no ask, forwardable. | owner · EVA | |
| 14.2 | owner action | Record the statement: tell her who hears it, pick a take by ear, check the name is said [ˈɛːva] Every rendered utterance already lands as an mp3 with its manifest line; nothing to build. | owner (EVA session) | |
| 14.3 | owner action | Confirm the synthetic voice's provenance and consent before the file leaves the estate No still frame of the endgame doc travels with it. | owner | |
| 14.4 | owner action | Decide what the second touch is for | owner | |
| 14.5 | ruled / specced | "Ask EVA" visitor page - design: edge dumb relay → her one brain on the desktop; a visitor is a new unverified perception source; conversation only, no capability execution Design memo 2026-11-07; nothing built. The current site host is the wrong host for a visitor (gated). Proof under each answer: timestamp, model, manifest hash. | EVA · site worker · root | |
| 14.6 | owner action | Owner beta pass first: the owner is the first visitor, from mobile, on an owner-issued tokened link Ruled 2026-11-07: several guests, each on their own tokened link with a small turn budget; no outside link before the beta pass. | owner · EVA | |
| 14.7 | open | Capture the two referenced social posts into the vault before she may cite them Neither post has a vault capture as of 2026-11-07; the owner confirms which one is the comment in question first. | evidence | |
| 14.8 | owner action | Visitor page build: plan rev 32 approved and handed to the EVA session as a GSD phase - relay Worker, tokened links, the visitor source in the brain, the static page Approved 2026-11-08; root-lane deliverables done (register row, memo rulings, state, memory). Hand-off acknowledged by the live EVA session, which is finishing other work and will not self-start the phase. Next move is the owner's: open a fresh EVA session (or a second checkout) and point it at the hand-off brief in the root planning record; it then runs phase add → plan (cross-AI convergence) → identity backup → execute. The roadmap's 217 slot was taken on 11-07, so the phase takes the next free number. | EVA (phase) · root (register, memos) · evidence (secrets map) · owner (provisioning) | |
| 14.9 | done | Register row for the relay Worker on ask.aego.dev: TOLERATE, re-entry 2027-02-05, gated, EVA-owned Register 1.0.6 (68 rows); table re-rendered with the tested renderer and the drift check passes; canon manifest re-attested. Consumers include the secrets-sync map and the zone WAF rule, so the S10 guard holds at the first deploy. | root | |
| 14.10 | open | Secrets propagation map: add the two verifier-hash lines and the Worker directory for the relay Relayed 2026-11-08 (root state block has the exact lines): two SECRET_MAP entries mapping the relay's desk and admin key hashes to the ask-eva Worker, plus the WORKER_DIRS entry pointing at the relay directory in EVA's tree. Lands once the relay directory exists (the sync needs its wrangler.toml); the keys themselves never leave the root .env. | evidence | |
| 14.11 | owner action | Owner-run provisioning for the relay, in order: WAF rule, key generation, deploy, mint the owner-phone token, beta pass from mobile Runbook = plan rev 32 §D. Each step waits for the EVA phase to ship its scripts; the first deploy is the hard test of Durable Objects on the free plan (fallback = an owner ruling for the paid plan on the same register row). The beta pass is the acceptance test before any outside link is issued. | owner |
| 15.1 | done | Run-out warning for the org API credits: automatic estimate, a line in every session brief, an attention-strip blocker, a Desktop file and a toast Runs in every page build and in the daily digest task; the Console baseline is re-read when a new grant lands. job · AEGO sovereignty digest: runs through its own registrar; no ledger (its lane's E2 step-5 decision pending) | root | |
| 15.2 | done | Subscription-first rule written into the root and global instructions and printed in every session brief API credits only for consumers with no subscription path: EVA's runtime brain and perception, the orchestrator daemon, the site worker. Supersedes the 11-05 'burn the org credits' directive. | root | |
| 15.3 | open | 210 round 2b paid delta: can it run on the subscription? If not, say why before the paid step The paid step stays owner-interactive. | EVA · 210 | |
| 15.4 | open | Daemon enrichment calls: can they move to the subscription rail? Dispatched sessions must stay key-stripped | orchestrator | |
| 15.5 | open | Invoice and statement parsing: move what runs interactively to the subscription; only unattended runs stay on the API | money | |
| 15.6 | open | Scripts that call the API (they still read the EVA key, not their own): move interactive analysis to the subscription | evidence | |
| 15.7 | open | Task registry: the daily digest task now also runs the credit check (local alert only, effects still none); update its purpose and notes | tools | |
| 15.8 | open | Cost aggregator: its window drops the last day (the exclusive end equals the window end), so the cost watchdog's 'latest complete day' is two days old Found 2026-11-08: the 11-07 run's window ends 11-06 but its records stop at 11-05. | tools | |
| 15.9 | open | Guard-script toasts use an unregistered app id, which Windows usually drops silently; the Desktop file still lands The credit check shows its toast under PowerShell's registered id; the same fix applies to the guard and vault-pull scripts. | tools |
| 16.1 | open | Health-data separation is policy only: EVA's read tool reaches death/data and nothing checks eva_access 2026-11-11: hand-off written for an EVA session ([local path] item 1: an eva_access check in the read tool's containment block). Still open: EVA's own session performs the edit. Brief §0 says health documents enter only via the death repo. Verified: EVA_BOUNDARY default-deny and s0 eva_access: never on disk, but code.read_file (server_dev.py:37-41) allows any [local path] file by exact path; the secrets floor does not cover death/data. Sanctioned path = death lane 3. Decide: a read-route floor on death/data now, or the eva_access check inside the lane 3 build. | EVA + health vault | |
| 16.2 | owner action | Brief §0 constraints that do not match the repos: delivery paths, the workstation GPU, the death 'dumb pipe' wording [local path] and [local path] Drive/AEGO_cloud_bkp do not exist (what exists: /backup-dual, [local path] Drive/AEGO_BACKUPS, [local path] Drive/AEGO/backups). Docs say RTX 5090, the brief says 2x4090. death's Worker stores and serves landed records in R2 + D1, it is not static-only (death CLAUDE.md: stores, verifies, backs up, does not reason). The Opus-with-reasoning rule holds (claude-opus-5-5, adaptive thinking). Compass is out of perimeter as stated. | root | |
| 16.3 | open | 1.1 EVA reads planning docs (md / pdf / docx) and cites the section Not done, so not flagged. Markdown: yes, any [local path] file as text, 500 KB cap (STATE.md and ROADMAP.md exceed it; STATE-DIGEST.md landed today as the workaround). PDF / DOCX: no parser wired (pypdf installed, unused). Section citations: no mechanism. Planned as GAP #1 in the local-reasoning-lens thread (v2.9 TBD). | EVA | |
| 16.4 | owner action | 1.2 Quick classification of inputs routed to the Guardians (health documents excluded) Nothing exists; no quick_classify. Name collision: 'Quick Classification' is already Phase 211 (sprout path for drops under 20 images, spec only). Intake accepts images only; a filename pre-triage exists in tools/ingest. Waits on the owner's answer to question 16.19 (what is the input). | EVA | |
| 16.5 | open | 1.3 EVA reads all of [local path] recursively, case-insensitive index, collisions logged 2026-11-11: build order handed to an EVA session (hand-off item 3: deny list first, then the casefold index, then the three-spelling test). Single-file read by exact path works; list_files is eva_v1.1-only and not recursive; no casefold / index / collision log anywhere. Planned only as threads: eva-whole-machine-read-scope (OPEN, deny list undecided), Phase 194 design-only, Phase 151 scoping. Needs the deny list (death/data, .env copies, venv, node_modules, workspace/input) and the eva_access check before it is built. | EVA | |
| 16.6 | open | 2.1 Voice chunking and word mangling: measure, then fix 2026-11-11: hand-off item 4 (the two boundary bugs to test in isolation, WER with jiwer, the AUDIO_CONFIG override by the WER gate). Premise partly wrong: utterances are already cut by the adaptive VAD (1 s silence end, 600 ms min, 15 s max, 500 ms pre-buffer) and sent whole to Parakeet; no fixed windows. Documented mangling causes are names, missed onset, code-switching. Two candidate boundary bugs found by reading, untested: the worklet flush tail spliced onto the next utterance (eva-perception.js 4398 / 4473 / 2242) and per-250 ms resample + auto-gain (audio-dsp-utils.js). No WER tooling (jiwer installed, 790 clips without references). AUDIO_CONFIG don't-add rule 'no multi-layer VAD before NeMo' applies; the WER gate is the override. | EVA | |
| 16.7 | open | 2.2 Evaluate pyannote (segmentation-3.0, diarization-3.1, community-1) against NeMo + TitaNet, modes A live and B offline 2026-11-11: hand-off item 4 (compare against NeMo MSDD / Sortformer too; output to documentation/eval-pyannote.md). Today: TitaNet labels per utterance (Phase 168), no diarization, pyannote.audio not installed; NeMo 2.6.1 ships Sortformer / MSDD / online diarizer. The parked voice-understanding spec chose NeMo MSDD first, Phase 999.6 backlog = diarization: the eval must state it reopens that choice. Owner's print unreliable on the Jabra (P14 re-enrol open). HF_TOKEN is in .env. Output goes to documentation/ (no docs/ folder). | EVA | |
| 16.8 | open | 2.2 GDPR rules in the brief vs reality: voiceprints plaintext, backed up unencrypted to Drive, reset deletes only the owner's print, a third-party print without consent record 2026-11-11: hand-off item 5 (consents first, then encryption at rest + backup zip, then a reset covering every print). Prints are .npy in workspace/.cache (eternal tier); eva-backup.ps1 zips them with the raw enrollment WAV into [local path] Drive/AEGO_BACKUPS; DELETE /api/audio/speaker/reset removes the owner's print only; the second enrolled person's print has no consent record. Consents item (due 11-07) still has no collected record. | EVA | |
| 16.9 | ruled / specced | Speaker recognition in WhatsApp voice notes: the plan is page item 2.3, not Phase 210 Phase 210 is text-only and excludes voice notes. tools/audio/transcribe-voice-notes (Whisper large-v3) has no diarization and takes the speaker from chat metadata. Item 2.3 'voiceprint learning from voice notes, consent-gated, embeddings only' is scheduled 2026-11-17 to 12-19 with no spec dir yet; the pyannote eval (16.7) should fold into it, not duplicate it. | EVA | |
| 16.10 | in progress | 3.1 Unify the model picker / escalation: the live work is the Claude Code tooling; EVA's renderer still carries its own tables EVA: Python reads config/llm-models.json; the JS side keeps 9 live model-id sites (brain, model-router with unlogged escalation, architect, launcher manifest) listed as the mirror set in SUBSTRATE_SUCCESSION_PROTOCOL.md; no phase unifies them. Tooling: six decision points (pin, global fallback, effort router, escalation gate, GSD overrides, hand-set hold); router policy declarative, gate regexes hard-coded, only the gate logs reasons; a tools session has +761 uncommitted lines on the router today. | tools + EVA | |
| 16.11 | owner action | The 'best' model alias resolved to Opus 5.5 today: both escalate skills downgrade a Fable-pinned session Observed 2026-11-10 in the root session (pin claude-fable-5-1): loading escalate-security (model: best) moved the turn to claude-opus-5-5; the 11-09 memory said best = Fable 5.1. Decide: pin the escalate skills to claude-fable-5-1 (loses the agnostic alias) or verify the alias per Claude Code version. | tools | |
| 16.12 | done | 3.2 ADR: EVA's tools in a dedicated repo (re-evaluate, do not reverse) ADR written 2026-11-11: [local path] Three options (keep in EVA / selective migration into tools under its existing rules / a new eva-tools repo); recommendation = migration list, no new repo (no new GitHub remote during the exit, the registry and three migrated EVA-shaped tools already prove the path, versioning via the ENGINE_VERSION pattern death consumes). The owner rules B vs C and the first tool to move (image -> ASCII is the obvious candidate). | tools | |
| 16.13 | in progress | 3.3 EVA versioning: no two sources agree and the progress page shows no EVA version package.json 1.1.0 = runtime app_version; README v1.2.1; aeva site v1.1.1; tags in two schemes (newest by date 60fps / plasma / stable); no CHANGELOG, no VERSION file; ROADMAP v2.7 shipped, STATE milestone v2.9. 2026-11-11: the page now shows the version of record (package.json, read at build; a 'sources disagree' chip while README and site differ) - root lane. The single-source proposal is hand-off item 2 for an EVA session (README and site read package.json at build, CHANGELOG opened, v<semver> tags only); the first entry is the owner's to name. | EVA | |
| 16.14 | in progress | 4 death: pull from Fascicolo del Cittadino and Fascicolo Sanitario Elettronico Evaluation written 2026-11-11: [local path] Option (a) recommended and buildable now: dated delivery folder, the four existing tree-pipeline stages unchanged, one new script fse_index.py (sidecar index per file: type, sha256, CDA header fields, text-layer flag, proposed target folder; the move stays the operator's sort step), DIARY ritual as for any batch. Option (b) SPID automation not recommended (second factor keeps the owner present anyway; portal changes; terms of use). Owner: confirm the batch convention in the local runbook, make one real export, rule (a). Then a death-lane session builds the index script. | health vault | |
| 16.15 | in progress | 5 money: pull from Agenzia delle Entrate (cassetto fiscale, precompilata) 2026-11-11: the privacy blocker is fixed first (money ba57990, pushed): 47 bank-statement PDFs + statements/.processed.json untracked (files kept on disk), collected_statements/ ignored, the weekly Action adds its five output paths instead of the whole tree; ade/ ignored ahead of any download. The PDFs stay in the remote history until the owner rewrites it; 135 + 3 invoice PDFs are still tracked (owner's call, see the evaluation). Evaluation written: [local path] - option (a) recommended: money/ade/inbox/<date>/ raw exports, scripts/ade_import.py (manifest; FatturaPA XML parsed into reconciliation rows; CU / F24 / 730 PDFs by labelled regex, unparsed listed, never guessed; never in CI); option (b) not recommended. Owner: one massive Fatture e Corrispettivi export + one cassetto document, rule (a). Then a money-lane session builds the importer. | money | |
| 16.16 | done | 6.1 Claude configuration backup + one-command bootstrap on a new machine Built 2026-11-11 (tools 164cb5d): tools/system/claude-config-backup/ - backup.ps1 (secret-free snapshots: CLAUDE.md, keybindings, commands, skills, agents, hooks, scripts, plugin registry, per-project memory, every checkout's gitignored .claude/settings.local.json pin, settings.json + the MCP part of ~/.claude.json REDACTED by cfg.py with ${CLAUDE_CFG_...} placeholders and a secrets-index naming the .env key for each), bootstrap.ps1 / bootstrap.sh (one command on a clean machine: copy, placeholders filled from [local path] old profile / estate-root paths rewritten, repo pins placed, estate installers re-run, owner steps printed). First real snapshot 20261111-1227 on Drive (1,526 files, 0 leaked values); restore rehearsed into a scratch profile. ops.js re-pointed (evidence 622666c6, not pushed); the old script is a deprecated shim. Owner: add the two CLAUDE_CFG_* keys the backup lists to [local path] once; the managed-settings policy needs UAC on a new machine. | tools | |
| 16.17 | in progress | 6.2 Plan to leave third-party dependencies: exists and is active (Track E), not on standby 2026-11-11: no docs/dependency-exit-plan.md was written (it would duplicate SOVEREIGNTY.md); cost / effort columns per row remain the ask for the register. SOVEREIGNTY.md + sovereignty-register.json 1.0.10 (71 rows), daily digest, tasks Ready, E0a done 11-07, E1 mirrors exist (nightly push / bundle / replica pending, D: mirrors stale at 11-06), rulings GitHub mirror-then-delete and Cloudflare hibernated apex-only. docs/dependency-exit-plan.md must not be written (second source of truth); the brief's cost and effort columns have no per-row field yet: add them to the register or render a view. 70 of 71 rows without a passed drill. | root | |
| 16.18 | done | Effort router: MAX posture loads fail with 'Unknown skill' because aego-posture-max is path-gated; the gated-rung hint never asks the owner Fixed 2026-11-11 (tools 1bc84c2, skills synced into ~/.claude/skills, 35/35 tests): root cause was the paths: list on aego-posture-max - Claude Code's automatic-loading scope HIDES a skill until a listed file has been read, so every early MAX prompt failed with 'Unknown skill' (7 times in 4 sessions, 11-07 to 11-09); the PreToolUse floor already raises the scope on the first brain write, so the gate bought nothing. Removed. The owner-only rungs are now asked for ONCE per session: MAX = one line before the work (/aego-max for the turn or /effort max for the session), end the turn, anything else = xhigh; LIGHT = work at medium, the reply offers /aego-low once; recorded in the session state, later prompts carry a reminder (owner 2026-11-10: 'it should ask confirmation and if denied stays xhigh; same for low'). | tools | |
| 16.19 | done | EVA's runtime spends the org (Ultra) API credits before the purchased balance Verified 11-10: EVA's key is the root ANTHROPIC_API_KEY (same hash), in the one Console org; promotional credits are spent before purchased by Anthropic's rule; the 11-07 Console read shows purchased $1,138.36 untouched since 11-04. What is lost is only the unspent part of a grant at expiry ($86.99 of the 11-02 grant lapsed 11-10, estimate); the current $190.51 grant runs to 12-10. | root | |
| 16.20 | owner action | Question 1: what enters the quick classification - generic documents, AEGO artifacts, model outputs, or only new drops? Blocks 16.4. Options and the Phase 211 name collision are in BRIEF-VERIFY-2026-11-10.md. | owner | |
| 16.21 | owner action | Question 2: margin note 'bridge info forward? eva, [?] or not?' - clarify or drop If the missing word is 'semantic': the bridge contract already answers it (never raw data, always a reasoned summary; orchestrator/src/bridge/types.ts). | owner | |
| 16.22 | owner action | Question 3: delivery paths [local path] + [local path] Drive/AEGO_cloud_bkp (new, or stale note?) and the workstation GPU (2x4090 or RTX 5090?) See 16.2. A single PowerShell dual-copy command exists as /backup-dual once the destinations are settled. | owner |
| EVA:210-sitting-4 | done | 210 rulings sitting #4 - both batches ruled (285 children), identifiers 13/13, amendment ratified, knowledge backup run 2026-11-07 ~11:20; dispositions Sitting #4; rulings files pinned to the labeled r2 proposals. | EVA | |
| EVA:210-boot-wal-fold | done | Owner boot per the reconciled boot checklist - folds the pending eva.db WAL; clean close · by 2026-11-07 Done 12:11; WAL folded, verified on disk before the first apply. | EVA | |
| EVA:210-apply-B-r2 | done | 210 apply batch B - 3 role hits on confirmed rows; signed, banked, applied, proven on two copies · by 2026-11-07 Applied 12:20; inverse proven; AFTER snapshot clean. | EVA | |
| EVA:210-apply-C-r2 | done | 210 apply batch C - 2 inserts + 1 hit, 2 rebinds; signed, banked, applied, proven on two copies · by 2026-11-07 Applied 14:35; baseline complete (D-02). | EVA | |
| EVA:210-one-boot | done | Owner ONE boot - boot reads for batches B and C PASSED (both new rows resolved by voice); clean close verified · by 2026-11-07 Closed 12:03, WAL folded; baseline keys taken after the close. | EVA | |
| EVA:210-round-2b | in progress | 210 round 2b - real --since delta parse DONE + paid delta extraction DONE on the org credits (2026-11-10; one thread left at its baseline on purpose); NEXT = owner's call on that thread, then 210-24 (post-pass --since) before dossiers Owner AFK, full agency; cap raised in his words (D-04 ruling recorded). Extraction 54/54 terminal after one retry. 210-24 is unbuilt and sits behind 210-20/21 (brain files, owner sign-off); the excluded thread needs a union render decision (its old session is not on the new device). Excluded-thread path ruled: union render plan 210-29 written (wave 19). Union render for the two-device thread: tool built and reviewed, staged with parity (nothing lost, the new session added); published on the owner's go, parsed and extracted; the two-device thread now rides the same pending round as the others. | EVA | |
| EVA:210-thread-held | owner action | The held thread: hold lifted on the owner's word, whole thread extracted and retried, post-pass done; the owner's rulings and the signed apply are next · by 2026-11-11 Sitting D ran in one evening: free estimate, paid extraction, the one retry, post-pass with EVA closed. Next in the owner's hands: read the dossier, rule, sign, apply; then the one boot that also carries the digest check. The manifest hold is cleared (delegated); she rides future rounds like the other threads. | EVA | |
| EVA:214-substrate-commit | done | Phase 214 - brain substrate Opus 5 → Opus 5.5: commit live and the owner-eared identity-continuity read PASSED 8/8 on its own boot 2026-11-08 evening: 188 calls, no truncation, cache warm from turn 2, tool loop clean, lanes quiet; week-after cost/refusal ledgers still owed. | EVA | |
| EVA:214-bystander-write-defect | done | HIGH defect from the 214 boot's bystanders-only mic window: non-owner speech reached the brain's intake and was written as owner correction rows (+35 rows; the brain answered 14 of 243 stranger turns, unheard) - FIXED (who-axis WRITE floor) + the 34 rows retired + the 4 corrections.json entries retired The who-axis gated her voice but not the write path. FIX LANDED 2026-11-08 (66425908: the who-axis WRITE floor, steps 1-6 - intake floors + brain R4/R5 + G211, health 229/229). Capture boot 2026-11-09 01:59 PASSED the null control (8 non-owner turns answered → 0 rows, 8 refusal lines; the owner's voice wrote 2 owner-stated corrections); two of the owner's own code-switched turns scored 0.42-0.46 and were refused as `other` → P14's echo re-cal owns that. STEP 7 APPLIED 2026-11-09 11:41 (owner present): 34 rows quarantined `209-bystander-boot1-2026-11-08` via the 209 ritual (dry-run proof_ok, owner-signed ops_sha, TIER-0 11-33 zip, inverse rehearsed byte-identical on a copy; 0 boot-#1 rows left in the correction pool; ledger in the 209 phase dir). §7c DONE 12:45 (retireCorrections landed a1138a4f; the owner retired the 4 corrections.json entries from the console, file backup verified) · detector `wrong.` family landed · W3-B lane fix landed. The who-axis arc is CLOSED; P14's code-switched null control carries the owner-voice wobble. | EVA | |
| EVA:218-ask-eva | owner action | 218 Ask EVA - tokened visitor page + edge relay + visitor adapter + brain floors: LIVE on ask.aego.dev and PROVEN 2026-11-11 (a phone question answered whole after the length fix); next: the guest program (consent form first), plan r2 waiting for the owner's decisions 2026-11-11: the owner deployed the relay twice (particles background, then the background at 35% opacity); a capture boot answered a question from the phone in full (no output-limit hit, no errors) and EVA was closed cleanly. Guest program planned the same day: consent form with separate ticks (talking; learning and remembering; training her own future brain; web lookup by name; voiceprint), a credit-grant gate, permanent links for the owner and one family member, daily caps, a monthly pool, device binding, a consented guest-data lane, owner binding of guests, voiceprints from existing voice messages first and a page microphone later. Two planners wrote it, an adversarial reviewer found 19 issues (all folded into plan r2 and consent draft v0.4). Owner steps next: rule the decision list, fill the contact line, then the consent slice is built, reviewed again and deployed by the owner. Beta pass checks B and C still open. | EVA | |
| EVA:214-week-after-ledgers | open | Phase 214 week-after comparison: Opus 5 vs Opus 5.5 cost, output length and refusals over a full week · by 2026-11-15 Extraction runs by itself on 2026-11-15 (task 'AEGO EVA 214 week-after ledger', 10:00 and 22:00, refuses while EVA is up); a session then reads handoffs/214-cost-baseline/summary-2026-11-15.md, writes the protocol 3.8 verdict, and confirms the preserved-thinking ruling 2.2-d. | EVA | |
| EVA:triage-1109-hot-recall | owner action | Hot-memory recall defect (filed 2026-11-11 from the 2026-11-09 boots): yesterday's exchanges sit in hot memory but are never recalled - the search was keyed on a 3-word episodic hint, and the prompt renderer read fields the hot entries never carried, so the Recent block rendered empty since Phase 72 2026-11-11: replayed on the real worker code against a copy of hot memory - both defects proven, the render one dominant. Fix proposed and verified on the copy (content-word, rarity-weighted search; input-keyed recall per turn on the Phase 216 template; one data formatter for both renderers). Brain + worker edits wait for the owner's sign-off and a fresh session; a sibling session holds uncommitted brain hunks. Packet: handoffs/HOT-RECALL-PROPOSAL-2026-11-11.md. 2026-11-11 13:40 (session 1ad80b9c): APPLIED in the worker and the brain after five plan-gate review rounds + a code gate (G214, tests/js/hot-recall-scoring.test.mjs, health 232/232; the dedup key without the timestamp, early-boot exchanges held for the bridge, one formatter with the who token); the replay on a fresh copy returns the four 2026-11-08 joke exchanges at ranks 1-4. Owed: the owner's capture boot (the Clapton question -> [HOT-RECALL] keyed=input hits>=4). | EVA | |
| EVA:triage-1109-write-floor-threshold | owner action | Owner sentences under the 0.50 speaker-label threshold refused by the write floor (filed 2026-11-11): re-measured on the rebuilt voiceprint from three days of backend logs - the owner's softer register and a close family voice share the 0.40-0.49 band, so no threshold separates them; the floor must weigh the cosine (park near-threshold turns for the owner's word) rather than move a number 2026-11-11: the owner ruled it the same night (root lane): park near the threshold for his word, refuse only far below, boundary derived from the measurement. The census (AUDIO_CONFIG section 5, the todo) seats that boundary at 0.40 on the current voiceprint: the soft owner sentences and the close family voice both park, bystanders below it stay refused. Next: the apply in intake + brain (MAX, fresh session), then the accumulator run on the new print with the close voice as the impostor set, EVA closed, backup first. 2026-11-11 13:40 (session 1ad80b9c): the ruling is APPLIED - the label carries park_floor (0.40) + the owner-reference cosine; a verified other inside [0.40, 0.50) is PARKED as a row stored quarantined at insert (never dropped, never counted as written, never in the dedup ring); the brain renders the band in WRITE FLOOR; release through the 209 flow (scripts/209-parked-dossier.mjs + a release action in the merge script). G211 amended, WF6 / M10 / P1-P2 / E31-E36 green. Owed: the capture boot (one soft sentence -> parked, then the louder repeat writes) and the section-5 accumulator run with the father as impostor (re-derives 0.40). 2026-11-11 13:50 (session 5a21fc62): the park is PROVEN on the owner's capture boot - his soft Clapton question (owner cosine 0.50 rounded) parked into quarantine with a ledger row and the dossier lists it; one owner row written the same boot; the louder repeat did not happen (his later turns came from far away, 0.07-0.34, refused below the band as designed). Owed: the louder repeat near the mic, the section-5 accumulator run, and his release word on the parked row (209 flow). LOW filed: the stored cosine is rounded to 2 decimals (todo 2026-11-11-capture-boot-1325-follow-ups). | EVA | |
| EVA:triage-1109-dev-list-folders | done | Dev-mode file tools: the listing never showed folders (so a directory could not be discovered by browsing) and read-file decoded images as text - FIXED 2026-11-11: folders ride in the listing, images and binaries are reported as data with a closed code; the capability description tells the brain 2026-11-11: backend route + renderer envelope + capability description; 14 pytest cases on the real route functions and a 5-check both-sides pin (npm run test:dev-files); health 231/231. Owed: the voice check in a capture boot (ask her to open the styleframes folder and name what is inside) and the owner's call on how 'look at these images' should route (ingest path vs an image branch). | EVA |
| orchestrator:1 | done | D-4 monthly D1 archive job (orchestrator = sole writer) landed + live Window 2026-11-07: main 0cadf75, one restart, PostRestart OK; scheduled daily 01:00Z, first real run 2026-12-01T01:00Z. | orchestrator | |
| orchestrator:2 | done | Phase 37 cross-review deferrals XR-03/08/09/12 + IN-04 landed + live Same window as D-4; IN-01 stays open. | orchestrator | |
| orchestrator:3 | open | D-4 first real run - dated follow-up (legacy-layout check first, then verify 2026-11) · by 2026-12-01 Read-only checklist in 261106-kf5-WINDOW.md; closes the FLAGS entry; then nemesis deletes the dead handler. | orchestrator | |
| orchestrator:4 | owner action | I-05 ruling: orchestrator.query_result in the monthly archive type policy Landed fail-closed (option c de facto). Rule a / b / c; a /query call in a month blocks that month until ruled (hygiene WARN). | orchestrator | |
| orchestrator:5 | done | Erase (xi): delete the f3s top-up run dir after the nemesis acknowledgement Gate met 2026-11-09 (the nemesis archive lane re-read the cloud archive: 51/51 checks pass, hashes match the top-up report); run dir deleted 2026-11-10. The eight-month second copy sat outside it and is verified intact. | orchestrator | |
| orchestrator:6 | owner action | 2026-11-10 Drive erase list (five targets, ≈ 20.2 GB) - owner runs the rm lines · by 2026-11-10 Runbook in STATE PICKUP; (iii) 15.49 GB needs the owner's decision; then empty the Drive Trash. | orchestrator | |
| orchestrator:7 | open | Phase 38 multi-host parity - plan it in a second checkout Unblocked since Phase 37 closed 2026-11-06; the launch banner is in the orchestrator STATE PICKUP. | orchestrator | |
| orchestrator:8 | open | SANE-04 ops.ts route migration - waiting on the nemesis 11-03 route table Orchestrator-side census done (7 consumed /ops/api routes, sent to the nemesis lane). Never batched with a D-4 window. | orchestrator | |
| orchestrator:9 | in progress | WR-02 follow-up: outbox containment for pruneOrphanTemps / enqueueObservation - BUILT + PARKED Quick 261107-mee on a branch (root + observations/ child guards, 5 tests, 5 invariant pins, three reviews, verifier passed); lands at the next owner-gated restart window; full suite is a window precondition (memory was under the floor). | orchestrator | |
| orchestrator:10 | done | Anthropic spend anomaly 2026-11-03 ($12.00) - ATTRIBUTED: EVA brain live-use rate, not the orchestrator 2026-11-07 Admin API read-only: 11-03..11-06 = $12-21/day on the EVA brain key (Opus 5 live use; ≈45 % cache-hit), same shape as October live days; ≈ $0.75/day when EVA is closed; the 16.2× WARN came from a closed-week median and self-clears. Orchestrator daemon ≈ $0.11/day. EVA-lane levers (prompt caching; the 210 extraction riding the brain key) recorded in FLAGS. | orchestrator | |
| orchestrator:11 | in progress | EVA P12 (Phase 44 spool drainer + bridge status icon) - banner sent to the EVA session 2026-11-07 spool:undrained 7 persists until EVA drains; EVA schedules it as its own phase. | EVA | |
| orchestrator:12 | done | CLAUDE.md drift (progress 11.6) fixed - repo table aligned to the root branch policy (projects/ paths, utae / tools / major_domus rows), death row now BUILT (Worker death-vault) 2026-11-07 docs-only commit on main; the two stale worktree copies were removed by the window. | orchestrator | |
| orchestrator:13 | owner action | EVA system-knowledge copy (progress 11.7): retire or re-sync - owner ruling needed Verified 2026-11-07: last synced 2026-04-10, 2,688 EVA commits behind, yet mandatory reading in this repo. Recommend retire → pointer to EVA canon + orchestrator-side invariants only (this repo is read-only toward EVA by charter). | orchestrator | |
| orchestrator:14 | done | Automation registry: five Windows scheduled tasks registered + one stale row retired (tools-lane registry check) · by 2026-11-08 2026-11-07, owner go; live for the daily 08:00Z watchdog tick (offline evaluation: 0 findings); tools lane cross-references set, its check reads 0 XREF. Dated check 2026-11-08 08:00Z: no new WARN. | orchestrator | |
| orchestrator:15 | in progress | Automation watchdog: task-missing finding + disabled/retired rows - BUILT + PARKED Quick 261107-ujj on a branch (exit-1-only classification, strict flags, stderr piped; 17 new tests, 20 mutants killed, three reviews, verifier passed); lands at the next owner-gated restart window with the WR-02 branch; full suite is a window precondition (host memory pressure). | orchestrator | |
| orchestrator:16 | done | Automation registry: HYGENE watchdog row retired; rows added for canon drift, sovereignty drift, the progress page and both iPad displays (tools-lane attention item) 2026-11-08, owner go; quick 261108-fast. Covers root item 13.13 (aego-progress-maintain row now exists, cadence 1800). Tools check: XREF 6 -> 2, exit 0; the last two need the tools lane to name aego-ipad-display-mini1 / aego-ipad-display-duo in its two iPad rows (a dry run with those pointers gives 0 XREF). | orchestrator | |
| orchestrator:17 | open | Automation watchdog: long-running scheduler jobs read as failed (codes 267009 / 267011 / 0x800710E0) Jobs that stay running under the scheduler wrapper (both iPad display servers and, since the tools lane moved it onto the wrapper, the standby guard) read as failed under the watchdog's any-non-zero rule: three false task-failed warnings open since the 2026-11-09 08:00Z tick. Known noise, not an incident. Fix folds into the parked quick 261107-ujj branch before its owner-gated window. | orchestrator |
| health vault:science-proven | done | Windows Claude Science proven on the operator's subject (Records Panel profile, two runs verified) 2026-11-07: write scope proven by sha256 diff vs the backup mirror; mirror VERIFY PASS. | death | |
| health vault:wsl-science-retired | done | Old WSL Claude Science install deleted (distro kept) 2026-11-07, owner-run; Windows Science is the only install. | death | |
| health vault:q7-preferred-source | owner action | Phone: set one Preferred Source on the hourly-activity automation, re-export one day twice (register Q7 test) Tests whether Apple Health de-duplication is what rewrites hourly counters downward. | death | |
| health vault:push-76f55b1 | done | Push the 11-07 docs commit (76f55b1) to origin Pushed 2026-11-07 on the owner's word (origin/main carries 76f55b1, 52d68f5, da4ed43). | death | |
| health vault:mirror-stale-family-folders | done | Vault Drive mirror: two pre-10-18 family subject folders removed (fully covered by the family backup) 2026-11-07, owner-run; verified read-only first (path+size, diaries are older prefixes); Drive trash keeps them 30 days. | death | |
| health vault:compass-runtime-sovereignty-row | owner action | compass package: register a SOVEREIGNTY row for the bundled Python runtime's upstream (a GitHub release fetched on the author's machine at build time, pinned by sha256) Rule S4: no dependency without a row; root lane owns the register. Nothing is fetched on the patient's Mac. | death | |
| health vault:hardening-lane-committed | done | Compass → death hardening lane (G1 guards, G2 OS names, G3 atomic device byte quota) committed cd9bc60 + pushed 2026-11-08; 105/105 Worker tests. Deploy = owner (`! bash scripts/deploy.sh`). | death | |
| health vault:hardening-lane-deploy | owner action | Deploy the hardening lane Worker (cd9bc60) and run the after-check Owner-typed `! bash scripts/deploy.sh` (Claude's deploy is classifier-refused). | death | |
| health vault:parity-ruling | ruled / specced | Compass/death parity ruled 11-08 (pipe parity + one canonical normalisation) - brains clause SUPERSEDED 11-09 by the owner's standing feature-parity rule 2026-11-08; docs/reviews/2026-11-08-observations-layer-PLAN.md; plan gate Codex + Gemini folded. 2026-11-09: owner reaffirmed full feature parity (compass docs/PARITY.md); port queued as compass-parity-port. | death | |
| health vault:observations-layer | done | Observations layer built in aego-tools tree-pipeline (parse_hae byte-identical to compass, observations_core, derive_observations stage, puller post-landing + pending mirror, T1 OS names) 2026-11-08: 41 + fixture tests green; LIVE on s0 22:56 UTC (78 batches, 230,385 rows, 0 errors, rebuild == incremental, write scope proven, mirror VERIFY PASS). Follow-ups: _derived ~121 MB mirrored daily (owner may exclude), 3 metrics unknown to the shared parser. First unattended night OK (2026-11-09 04:00 task, result 0): 2 vitals batches landed, 2 derived (143 observations, 0 errors), derived files mirrored VERIFY PASS, no alert, no lease; 80 batches / 230,495 current rows. | death | |
| health vault:compass-m9-vendoring | owner action | Compass M9 (after M8): vendor parse_hae.py + observations_core.py from the tools repo byte for byte (brief in the 11-08 plan §7) Paste the brief into a compass session after the first install on his Mac; never before. | death | |
| health vault:lane3-plan-v2 | done | Lane (3) EVA flows for s0: implementation plan v2 + plan-gate cross-review landed (Codex 8H/6M/1L + Gemini 2H/1M/2L, all folded) 2026-11-07: docs/reviews/2026-11-07-lane3-s0-flows-PLAN.md + -REVIEWS.md. 2026-11-09: D10 added (observations availability from _derived). Nothing built, nothing flipped. | death | |
| health vault:lane3-rulings | ruled / specced | Lane (3) rulings: D3 local-only enforced, D5 none for now, D9 approved as precondition, D10 counts only Owner, 2026-11-09, in session. Recorded at the top of docs/reviews/2026-11-07-lane3-s0-flows-PLAN.md. The 'EVA-readable switch OFF' blocker now waits on the tools lane (D9) and the connector build, then the flip. | death | |
| health vault:lane3-d9-tools-preconditions | open | Lane (3) D9 (tools repo, owner-gated): atomic MANIFEST write (temp + os.replace), MANIFEST schema_version, provenance-header grammar written once (skill + docs/DIARY.md) APPROVED 2026-11-09 as the precondition. Brief: docs/prompts/2026-11-09-lane3-d9-tools-preconditions.md. Tools lane executes in its own checkout. | death | |
| health vault:lane3-connector-build | open | Lane (3) step B: death connector in orchestrator-2 (death.ts, source medical, metadata-only closed schemas, startup assertions, stable-snapshot protocol), parked until a restart window Rulings done 2026-11-09; starts after lane3-d9 lands. Brief = the plan file. Quick task with /code-review + Codex/Gemini at the code gate. | death | |
| health vault:lane3-flip | owner action | Lane (3) step A: flip s0 to eva_access: allowed (subject.json + diary context entry + EVA_BOUNDARY.md + CLAUDE.md rule 4), EVA backup first LAST, once the connector is live: flipping earlier changes nothing on disk behaviour and misreports the page. Supersedes the page item 2.1a as the executable version of it. | death | |
| health vault:compass-parity-port | in progress | Compass → death feature parity port (standing owner rule 2026-11-09): engine, weekly digest, therapy calendar, alerts, heartbeat strip, Science export, watch-model setting + ledger P1 opening, P2 particles green, P3 naming, P6 drop target (if approved) 2026-11-09: plan v3 gated (3 rounds Codex+Gemini+internal, all HIGHs folded) at docs/reviews/2026-11-09-parity-port-PLAN.md; owner: P6 approved (compass shipped it as 24879b2), opening for everyone from a NEW photo (owner provides), portrait tracked, inputs via the vault UI. A1 DONE in tools, committed 2026-11-10 as bb458e4 (99 tests green); code gate found 10 origin bugs, all fixed the same day as tools f9cc9d5 (ENGINE_VERSION 2, parity digest unchanged; docs/reviews/2026-11-10-parity-A1-code-review.md). Codex on the fix diff done (3 folded, cf25765, pushed). Before A2: compass ports the fixes (paste-ready prompt docs/prompts/2026-11-10-compass-engine-fixes.md). Next: A2 stage+puller -> A3 Worker -> A4 UI (+P1/P2) -> A5 live -> B4 P6 -> A6 docs/ledger. Hand-off: the prompt doc's 'State at hand-off'. | death | |
| health vault:pull-status-notification | owner action | Vault pull: a positive 'all landed' signal (phone notification via a device status route + Shortcut; EVA feed line folds into lane 3 D10) Idea 2026-11-09 after the FitPaddy automation check (8 runs/day, ring HR + sleep landing daily). Today only failures notify (Desktop file + toast). Owner to say go; then a short plan in docs/prompts/. | death |
| evidence:1 | done | US trademark watch red since 5 Nov: a tracked mark registered on 3 Nov; captured, counsel docs updated, acknowledged Not a fault: the watch reports events by going red. Full tracked set re-pulled 7 Nov; five counsel documents carry dated notes; ack state, pushed 7 Nov; counsel gateway query returns the new notes. | evidence | |
| evidence:2 | done | US trademark watch no longer forgets: a red stays red until acknowledged Five red episodes (Aug to Nov) had cleared on their own unreviewed. Window now starts after the last clean run; offline self-test passes; pushed 7 Nov, live from the next daily run. | evidence | |
| evidence:3 | done | Registration certificate of the newly registered mark: downloaded and filed Owner downloaded it past the captcha on 7 Nov; filed in the capture set with its hash (unsealed). | evidence | |
| evidence:4 | owner action | EU trademark watch rebuilt on the EU office API; production subscription waits for the EU office's approval Built and proven on the test service. 11 Nov: production keys in hand and accepted (token issued); production addresses taken from the API's own spec; the search plan subscription shows Pending approval on the office's side, so every call is refused until they approve. The daily job is already switched over (keys as repository secrets; a test run reached the office and was refused as expected). After approval: the first production read, reviewed, then the baseline. | evidence | |
| evidence:5 | done | Evidence resume state brought up to the 6 Nov commits STATE.md current position 7 Nov covers 5 to 7 Nov; roadmap text not touched. | evidence | |
| evidence:6 | done | Note to counsel on the US register update: sent 7 Nov on the owner's word Sent on the 6 Nov digest thread; secured byte for byte in the matter folder. | evidence | |
| evidence:7 | done | Owner ruling for the root lane: name the EU office trademark API on the rented-service register Applied by the root lane: register 1.0.4 names the EU office trademark search API on the read-only register watches line (no row, as ruled). | root | |
| evidence:8 | done | Secrets propagation map carries the relay's two verifier-hash lines and its Worker directory (closes root item 14.10) Added 9 Nov, names checked against the relay code; dry run lists both for the relay Worker; pushed 9 Nov. Both hashes pushed through the map on 10 Nov (values unchanged: the live desk and admin key checks pass before and after); the sync daemon restarted on the new map and reports all in sync. The plain keys stay unmapped. | evidence | |
| evidence:9 | done | Vault home changelog read as stuck at 13 Oct: rows built from vault items were stacked on top; now placed by date Fixed and live 11 Nov (both load orders tested; live list opens on 28 Oct). Then, on the owner's word: five new changelog rows (2 to 11 Nov) and the erasure timeline extended to 10 Nov with its 3 Nov point (the US registration of the class 35 mark); live list opens on 11 Nov. Independent review the same day: no high findings; the one medium (the timeline's sources line still said 10 October) and four lows fixed and live. | evidence | |
| evidence:10 | in progress | Machine service token rotated after test rigs sent it to third-party font and analytics hosts 11 Nov, on the owner's word: new secret at the access layer (old one revoked at once), root secrets file updated, pushed to the edge worker by the sync daemon; live proof: new secret accepted 5/5, old refused 5/5. Left: the EVA tree's own copy (EVA session; harmless meanwhile, every EVA caller also sends the ops key). Rigs now add credentials for the vault host only. Separately: since 11 Nov the access layer drops the service-token headers on the vault host; machine checks there use the audit token. | evidence | |
| evidence:11 | done | Vault access log records the visitor's real address (it logged a Cloudflare address for every counsel visit since July) One-line fix in the vault worker, harness 4/4, live 11 Nov (production deploy on the fix commit). Past rows cannot be corrected; the real login addresses stay in the PIN-attempt log. | evidence |
| tools:canon-drift | done | Canon-manifest drift check (page item 10.7) 2026-11-08: runs on the owned scheduler as Scheduled Task 'AEGO canon drift' (daily 09:15 local, repeated every 3 h until 21:15, + 5 min after sign-in); alerts on the Desktop on drift or an unreadable file. First real run: 11/11 rows OK. job · AEGO canon drift: last run 2026-11-11 15:15 (UTC+01:00) ok · 2 s | tools | |
| tools:mandates-docs | done | Tools mandates file + registry README brought current (page item 11.8) 2026-11-07: CLAUDE.md category list = the six real dirs; README categories, the false 'untracked' claim and the retired tools/mcp plan fixed. | tools | |
| tools:e2-registry | in progress | E2: one owned scheduler, every job a registry row (page item 13.5) Steps 1-3 done 2026-11-08: registry + read-only checker; apply-aego-task.ps1 + run wrapper (lease, run ledger, Desktop alert); jobs canon-drift, sovereignty-register-drift, ipad-display-mini1 and progress-maintain (the page every 30 min). Live: 11 tasks OK. Tests: 47 + 16 + 14 (+ 20 for the sovereignty check). Next: step 5 (move the older tasks' own registrars onto apply) and the owner's retention decision. | tools | |
| tools:hygene-watchdog-removed | done | Disabled HYGENE Chrome Renderer Watchdog removed Owner decision 2026-11-08: the task had done nothing since July (its script was gone); removed from Task Scheduler and from the registry. Chrome Memory Saver is the remaining guard against runaway tabs. | tools | |
| tools:digest-credit-note | done | Task registry: the digest task's description names the credit check (page item 15.7) 2026-11-08: purpose and notes updated; action unchanged, effects stay none. | tools | |
| tools:effort-override-per-checkout | done | Effort router: overrides per checkout, never below a critical scope; fewer false write alarms 2026-11-08: overrides hold for the whole checkout (507dd04) and never lower a CRITICAL scope; read-only commands that only throw output away no longer raise the floor (33cf5b5, owner ruling). Tests 25/25; high + max-effort reviews, all findings fixed. | tools | |
| tools:cost-window-last-day | done | Cost aggregator: the last day of every window is no longer dropped (page item 15.8) 2026-11-08: the Admin API's ending_at is exclusive; the adapter now asks up to the day after the window end. Verified on a scratch copy against the live API: window 11-04..11-07 now returns 11-07 too (before: up to 11-06), earlier days unchanged; a one-day window works. The orchestrator's next aggregator run picks it up (no restart). | tools | |
| tools:toast-app-id | done | Guard and vault-pull toasts now use a registered app id (page item 15.9) 2026-11-08: death-vault-pull.ps1 and tanstack-guard.ps1 show their toasts under PowerShell's registered id (the one run-aego-task.ps1 and the credit check use). One-line change each; encoding kept (vault pull stays UTF-8 with BOM), both parse under PS 5.1 and 7. The Desktop alert files are unchanged. | tools | |
| tools:sovereignty-renderer | done | SOVEREIGNTY.md register table: renderer + daily drift check + the S10 guard (page item 11.15) 2026-11-08: renderer + daily drift check (0749aeb) and the sovereignty guard (system/sovereignty-guard/, S10): walks [local path] without gitignore, maps every rented-API hit to a register row, checks allowlist growth against git HEAD; 36 tests (both shells), code-reviewed; first live run clean (973 covered files, 0 unregistered). Owner decision open: four rows with repo 'all' + path '**' make every hit 'covered', so the guard cannot fire until they are narrowed (207 files covered only by them). Not scheduled yet; root lane updates the S10 path in SOVEREIGNTY.md. job · AEGO sovereignty register drift: last run 2026-11-11 15:20 (UTC+01:00) ok · 1 s | tools | |
| tools:progress-maintain-schedule | done | Schedule progress/maintain.py every 30 min through the E2 registry 2026-11-08 (owner directive; the 3-day gate lifted): Scheduled Task 'AEGO progress page' (root lane's row progress-maintain, f436df3) runs progress/maintain.py 30 s after sign-in and every 30 min through the E2 wrapper. Registered by the owner, verified by this lane: checker 11 OK, all suites green, Task Scheduler diff = only the new task. First scheduled run 21:35: exit 0, deployed; the live page shows built 21:35. The session-bound loop is retired. Open: log/ledger retention (owner decision). job · AEGO progress page: last run 2026-11-11 16:35 (UTC+01:00) ok · 1 s | tools · root | |
| tools:ipad-second-screens | in progress | Second screens: mini 1 + iPhone Duo live (ipad-mjpeg-display, E2 jobs); next: the remote hub 2026-11-08: mini 1 and Duo served by E2 rows ipad-display-mini1 / ipad-display-duo; Extend / Mirror / Not now dialog; Mirror shows a Duo-shaped window of the Samsung; guard keeps a real monitor primary and the dead panel's ghost output off. spacedesk's iOS app draws nothing on the foldable Duo. | tools | |
| tools:dell-2560-workspace | dropped | Dell main screen: get the 2560x1600 workspace back (NVIDIA DSR) or undo the panel disable 2026-11-08: superseded - the Dell U2415 was replaced by a Samsung LS49AG95 (5120x1440, native), now the primary screen. | tools | |
| tools:claude-sessions | done | Claude Code sessions snapshot + resume per repo window (system/claude-sessions) Live 2026-11-08 (root-lane session snapshot-resume-tool-plan, 97010d2..42090a1): hooks keep a per-session roster; a VS Code folder-open task reopens a window's sessions (same cwd + permission mode; never kills, never auto-prompts, never resumes bypassPermissions or -p). install.js re-run from this checkout, tools-2 deleted (per that session). | tools | |
| tools:remote-hub | in progress | Remote hub: iPhone Duo + iPad mini 2 with Bluetooth keyboard (channel 1) and mouse controlling the laptop Plan: tools/.planning/remote-hub-PLAN.md (input forwarding from the Duo's page to Windows SendInput with a pairing PIN + HMAC, pan-on-edge viewport over the 5120-wide Samsung, mini 2 joins, mini 1 retired after the ghost guard moves). Step 1 (device spikes) done on the Duo 2026-11-09 (input_probe.py + ios_tab_js.py, Duo driven over USB): the Lift arrives as a real mouse (hover, 3 buttons, wheel, ~59 Hz), MX Keys keys arrive without a focused field incl. Cmd+C / Ctrl+C; iOS keeps Cmd+Space / Cmd+Tab / Cmd+H / Globe; movementX reads 0 at the screen edge, so pan-on-edge = dwell hot zone (results in the plan). mini 2 (iOS 12) done too: touch + keyboard arrive, no mouse. Step 2 measured 2026-11-09: full-width frames cost 2.8x the crop, so panning = server-side zmq crop (B). Step 3 built the same night: remote_input.py (scan-code keys, absolute mouse, wheel, PIN pairing + HMAC + counter, kill switch Ctrl+Alt+Shift+F12, auto-release of held keys), 26 tests, xhigh security review with every should-fix item fixed, laptop-side end-to-end OK; the Duo's E2 row now runs with --allow-input. Step 4 built the same night behind --pan (viewport_pan.py dwell hot zone + ffmpeg crop moved at runtime through zmq via a stdlib ZMTP client): laptop-verified edge-to-edge slide at 1403 px/s, 20 updates/s, catch-up + clamping; 37 tests, second xhigh review applied. 2026-11-10 re-assessed (plan tools/.planning/remote-hub-REASSESS-2026-11-10.md, seven cross-review rounds): the older Razer Blade becomes the home remote via Sunshine (host) + Moonlight (client), owner gate + register rows first; the Duo tries Moonlight side by side with our page; travel = owned WireGuard on the main laptop (tunnel 10.86.77.0/24) after a CGNAT check and the owner's DDNS / port-forward rulings; mini 2 takes over mini 1's 1024x768 VDD output; the later owned 2x RTX 5090 server becomes the host. After the 12:15 restart (2026-11-10): both display servers back on their own; reachability check found DOUBLE NAT (the Nest sits behind a Fastweb FASTGate), so travel needs the FASTGate's WAN IP checked (public vs Fastweb CGNAT) and forwarding on both routers or a DMZ; register-row drafts for Sunshine + Moonlight are in the plan (owner ruling to add). 2026-11-10 afternoon, TEMP fix live for working away with only the Duo: Tailscale tunnel (owner: 'your call' -> Tailscale now, owned Headscale later) + Sunshine (hardened, forced 1920x1080 per stream) + Moonlight 1080p@60; the laptop stays awake with the screen on while VS Code is open (standby guard). REAL FIX recorded for 2026-11-11 (owner: 'this is just a temp fix'): full-height picture, pan the ultrawide from the pointer, sharp pinch-zoom of the whole desktop, on-screen keyboard, over the tunnel; candidates in the plan. 2026-11-11 REAL FIX BUILT and tested by the owner on the Duo ('everything works pretty great'), commit 37eecb6 (unpushed): ipad_mjpeg_display.py --remote over HTTPS on the tailnet (owned name-constrained CA, armed pairing, signed batches), GPU capture 60 fps with GDI fallback, 4:4:4 JPEG, pinch zoom, edge pan, compact on-page keyboard; 94 unit tests + 20 e2e checks; two Fable reviews + a verification, nothing HIGH or MEDIUM open. Owner ruling 2026-11-11: keep Sunshine / Moonlight / spacedesk / the iOS Zoom shortcut as fallbacks (Sunshine running, firewall tailnet-only; spacedesk rule home network only). Open: register the display-remote task (owner), H.264 transport, the Razer. | tools | |
| tools:remote-register | done | Register the display-remote scheduled task 2026-11-11 13:23: registered and verified by the owner (apply-aego-task.ps1 -Id display-remote, no admin needed), started at once; the task's server listens on 100.79.112.79:8604 with the row's arguments (fps 60, quality 6, chroma 444). It runs at logon and every 15 min, so Claude Code's low-memory clean-up no longer stops it. job · AEGO display remote: exited 2026-11-11 16:49 (UTC+01:00) fail · 8707 s (exit -1) | tools | |
| tools:remote-h264 | in progress | Remote: H.264 / HEVC transport (NVENC + WebCodecs) instead of a full JPEG per frame 2026-11-11 BUILT (commit d89add7, unpushed), live on the scheduled server since 16:50: /video pulled like /frame, best kind every live viewer accepts (HEVC/H.264 4:4:4 or 4:2:0), JPEG fallback for browsers without WebCodecs (mini 2), duplicates dropped before the encoder (a still screen sends nothing), budgeted resync and step-down. Bench with a real moving pointer: JPEG 135.6 Mbit/s vs H.264 2.1 / HEVC 2.4. Plan gate 4 rounds + a fresh review to 0 HIGH/MEDIUM; code review fixed and verified 0/0/0; 188 unit + 49 e2e + 22 synthetic video + 58 page checks. Open: the Duo's decoder probe (USB not seen today) and the owner's test on the Duo. | tools | |
| tools:remote-razer | open | Remote: the older Razer (fresh Windows) as a remote Two paths, owner's choice: our page in Edge (import the CA into Trusted Root, add its tailnet IP to --allow and to the 8604 firewall rule) or Moonlight to the Sunshine fallback (tailnet address 100.79.112.79). Checklist in the remote-hub REASSESS plan. | tools | |
| tools:remote-ca-renewal | open | Remote: renew the owned CA + server certificate before it expires (2029-01-19) · by 2028-12-19 python remote_view.py --make-tls <dir> --ip 100.79.112.79 --dns anyma-alessio.tailccb303.ts.net --new-ca, then install the new ca.mobileconfig / ca.cer on every device (the CA key is deleted after signing, by design). Also needed if the laptop's tailnet address changes. | tools | |
| tools:e2-stale-alerts | open | E2 wrapper: clear a long-running job's alert once its relaunch stays up (stale alerts linger today) Found 2026-11-10: run-aego-task.ps1 clears AEGO_TASK_<id>_ALERT.txt only on exit 0, which a long-running job (the iPad display servers) never reaches, so after any kill and a healthy relaunch the alert stays on the OneDrive Desktop for good (two from 2026-11-09 14:49 removed by hand today). Fix to plan + test: clear the alert once the relaunched child has stayed up past a short grace period. Proposed, not built: the wrapper serves 11 tasks. | tools | |
| tools:shared-hook-helpers | done | Lift the hook-group helpers shared by the effort-router and claude-sessions installers into tools/shared/ Landed 2026-11-09 (plan tools/.planning/SHARED-HOOK-HELPERS-PLAN.md, independent plan review folded, code review high before commit): shared/claude-hooks.js = hookSet (isOurHook / desiredGroup / stripOurs / audit / apply / remove, one drift rule counting our entries: missing / duplicated / differs) + sameGroup + readStrictJson / backup / writeJson (atomic rename with 3x20 ms retries, symlink-safe). Both installers consume it; router exports and test suite unchanged (25/25); new claude-sessions test/install.test.js sandbox round trip (30 checks); shared suite 11 tests. Live --check for both installers byte-identical before and after, exit 0. No settings.json edit was made and none is needed (hook commands point at router.js / hook.js, not the installers). | tools | |
| tools:docs-health | done | Documentation-health check (page item 11.21) 2026-11-08: machine-hygiene check docs-health reads progress/items.json docs_health (path[] + max_age_days, no second list), dates docs by their last commit (uncommitted edits by write time), flags STALE (over the limit while the repo moved on; 'quiet' when it did not) and STALE-STATE for every resume state; -Json for the root lane's build.py (its step 4). 41 tests (both shells), code-reviewed (10 findings fixed). First run: 4 STALE + 4 STALE-STATE. Not scheduled yet. | tools | |
| tools:claude-kit | done | claude-kit: the AEGO Claude Code tooling, installable in one command for a collaborator 2026-11-10 (8e3a1cf, 63b1b39): system/claude-kit/ packages session-tags, claude-sessions, the effort router + posture skills, the escalation gate + escalate skills, the sibling git guard and the model-pin check. install.py --root (portable router scope, idempotent hooks, --uninstall); make-kit.py builds dist/ (shipped in the repo) + a git-ignored zip and refuses secrets and owner paths; test_install.py runs against a temp HOME. Registry row added 2026-11-10. Rebuilt 2026-11-11 from 9b8d29b (sibling round: one writer of settings.json, close verb); installer follows the router's SessionEnd hook and drops global_defaults for a collaborator (four internal review rounds, Codex and Gemini out of quota). | tools | |
| tools:sovereignty-guard-worktrees | open | Sovereignty guard: recognise a git worktree generically and map its hits onto the main repo's consumer key (page item 13.14) Root relay 2026-11-11 (root 37138f4): [local path] is a worktree of death (branch p6-port; .git is a FILE 'gitdir: [local path]'). The guard's repo rule (<root>/<key>/.git exists) saw a repo named death-p6 that no row names: 15 files already covered in death/ came out UNREGISTERED. Interim owner ruling: register 1.0.15 (root 32c8344) carries a not_registered_because entry paths [death-p6/**]; guard prints 0 UNREGISTERED. Ask: not a new entry in $ExcludedSegments (sovereignty-guard.ps1:97, prunes a name at any depth, :213) or $ExcludedPaths (:98) but a generic walk rule: a dir whose .git is a file pointing at <repo>/.git/worktrees/ is that repo, hits map onto the main repo's key, so growth inside a worktree stays visible. test-sovereignty-guard.ps1:215 hard-codes the excluded-segments INFO string; README lines 83 and 88 describe the list: both move with the change. When it lands, tell root; the death-p6 register entry is then removed (a shrink, no ruling). Recorded by the kit session at its close; a tools session implements. | tools | |
| tools:hygiene-old-cloud-task | owner action | Weekly audit: switch off the old cloud task 'AEGO Weekly Laptop Maintenance' (it still sends FAILED briefs) Root relay 2026-11-11: a 'Weekly Maintenance Audit - FAILED, no device bridge' brief from 2026-11-09 07:08 UTC came from the OLD cloud task, never disabled (HYGENE_ROUTINE.md open action 5, blocked by the permission check on 11-05). The audit did run: the bound 'HYGENE Weekly Laptop Maintenance' task wrote report-2026-11-09 + latest.json to [local path] Drive/aego-maintenance at 07:02:54 UTC. The brief's fix ('Require this computer') is wrong: it would make two audits write the same folder. Owner: delete the old task in the Claude desktop app, keep the HYGENE one. 11-09 report alerts triaged 2026-11-11 (root, read-only): 8601/8602 = this lane's ipad-mjpeg-display (mini1 + Duo), both 0.0.0.0 but URL token + --allow one LAN IP (Duo also --allow-input); 28252 spacedesk, 49675 services.exe RPC, 49685 Spotify, 59869 Logi Options+; startup 'VDD Control' = the Virtual Display Driver those displays hot-plug, Signal = owner app. All expected. Open only: BitLocker state needs an elevated read. | tools | |
| tools:tool-migrations-planned | open | Planned tool migrations into aego-tools: a plan for each, in the repo whose code moves 2026-11-10: index tools/.planning/TOOL-MIGRATIONS-PLAN.md. invoice-reader + bank-statement-parser -> money/.planning/todos/pending/ (invoice-reader tied to page item 15.5; statement parser waits for a second consumer); archive-to-wayback -> evidence/.planning/todos/pending/ (a no-override refusal of our own hosts inside the tool is a hard gate; register row wayback-witness path moves); chat-archivist planned in the tools index (overlap with EVA's render-whatsapp.py to check first). eth-tx-fetch: no plan, nothing built, owner decision. Each moves the next time its code is edited (asymptotic), never as a sprint. | tools |
| site worker:1 | done | v1.2 Phase 10 - bridge carries text in / reply out only (every control removed) Deployed and verified 2026-07-01. | site worker | |
| site worker:2 | in progress | v1.2 Phase 11 - bridge clean-up (dead code, one API prefix, dropped-message handling): 3 of 7 plans live Waves A and B deployed 2026-11-06; Wave C1 deployed and verified 2026-11-09. Wave C2 (dropped-message handling: a one-shot table rebuild) deployed 2026-11-11 through the guarded path on the owner's sign-off: every check passed, counsel's access unchanged, the first hourly sweep marked the nine long-stuck messages as dropped with a reason. One proof still open: the owner restarts EVA and sends one message from the control panel. After it: cross-repo hand-offs, a 24 h traffic census and removal of the old prefix: 2 more guarded deploys. | site worker | |
| site worker:3 | open | v1.2 Phase 12 - the operator-to-EVA conversation becomes the control panel's main surface Starts after Phase 11. Replaces clutter, never adds to it. | site worker | |
| site worker:4 | open | v1.3 control-panel slim-down (sections 2-11: cut or merge by default) Parked behind v1.2; scope locked 2026-05-25, reconciled 2026-06-09. | site worker | |
| site worker:5 | done | D1 archive hand-back from the orchestrator (months 2026-03..10) verified from R2 and acknowledged 2026-11-09: read-only re-read, 51/51 checks PASS; ACK sent to the orchestrator lane (closes their Erase xi). | site worker | |
| site worker:6 | owner action | D1 prune plan - delete the four excluded event types by id range, plus the API-key switch in the same deploy Plan written 2026-11-11 and reviewed by three independent reviewers (all: safe with changes; every finding folded). Nothing executed. Waits for the owner's sign-off and four choices (filter shape, key switch now or later, age-based stage, refusal answer). Runs only after Phase 11 Wave C2; two owner checkpoints (deploy, then the bulk delete after a small test). | site worker | |
| site worker:7 | owner action | Monthly-archive monitoring change (the site worker only detects; the orchestrator writes) Plan written 2026-11-11 and reviewed by three independent reviewers (every finding folded). Recommended shape is thinner than first described: one warning line on the control panel when a month's archive is missing, no stored state, no notification. Waits for the owner's sign-off and three choices (how much monitoring, timing, closing four obsolete failure notices). | site worker | |
| site worker:8 | open | Remove the dead monthly-archive code from the site worker (~400 lines) · by 2026-12-15 Planned 2026-11-11 in the same plan as the monitoring change (402 lines, self-contained, exact removal list verified). After the first orchestrator-written month (run 2026-12-01) verifies, unless the owner chooses to remove it earlier with the prune deploy. | site worker | |
| site worker:9 | done | Control-panel sign-in hardening (two security fixes) Found by the Phase 11 review legs; deployed and verified 2026-11-09 through the guarded path, every check passed, counsel's access unchanged. | site worker | |
| site worker:10 | owner action | Owner: confirm the sign-in allowlist entries flagged by the 2026-11-09 security review, and pick the session-tier follow-up option Read-only review found no evidence of misuse; a few entries need the owner's recognition. The session-tier change gets its own signed plan. | site worker | |
| site worker:11 | open | Deploy guard defect: a deploy attempt that the safety scan blocks weakens the scan of the next attempt Found by a plan review 2026-11-11 by reading the guard script (not triggered so far: every guarded deploy to date passed its scan first time). Until fixed: after any blocked attempt, that attempt's record folder is deleted before the signed retry. The fix is a small change to the guard script and gets its own signed plan. | site worker |
| compass:build-m0-m7 | done | compass package built through M7 (hub, UI, alerts fail-closed, Science export, installer, GUIDA, Science bundle); 605 tests on Windows 2026-11-08, HEAD 17d6ad5, hub 0.6.3, local git, no remote. macOS parts UNTESTED until the first install (M6-NOTES §6). | compass | |
| compass:m8-first-install | owner action | M8: first install on the patient's machine with the author present (release test) - OWNER 2026-11-09 late: the patient has a PC LAPTOP, not a Mac (M11 D2); the install waits for the Windows carry 0.9.0 (row pc-carry-0-9-0) 2026-11-09 late evening: the patient's machine is a PC laptop (owner, M11 decision D2) - the Mac carry 0.8.2 cannot be installed for him; the Windows installer (M11, merged db19bcc, UNTESTED on a real PC) is the shipping path and its carry is planned in PLAN section 12.6 (row pc-carry-0-9-0). Date: the owner's. The Mac notes below are history of the 0.8.2 carry. | INSTALL DAY 2026-11-09 (owner: the patient comes today). CARRY compass-0.8.2.zip (owner 2026-11-09 'let's install 0.8.0', then 0.8.1 and 0.8.2 after his look at the live demo: the question as a glass dialog over a sharp page, outline controls, «<nome> compass» over a slower opening, green accent, his portrait from the photo he chose; sha256 78922bd7...1a0be, built twice byte-identical at afb87bd, verify-package OK, in compass-work/package-0.8.2/ and on Drive AEGO/backups/compass/package-0.8.2/ with its .sha256, GUIDA.pdf, RICETTA-PROFILO.pdf and README.txt; the same Installa.command upgrades a 0.7.2 Mac in place) - NOT 0.8.1 / 0.8.0 / 0.7.2 / 0.7.1 / 0.7.0 / 0.6.4 / 0.6.3 (superseded). Checklist items 34-36 = P6 on the real Mac. The zip carries his portrait (ritratto.txt) at the top level; the installer stages it like every file and moves it to the settings folder. CPython 3.12.16+20261026 arm64 + x86_64 pinned, two builds byte-identical, MANIFEST + BUILD.json + the installer's own verify-package checked. Suites on the shipped tree: Windows 630 OK (13 skipped); WSL Python 3.12 628/630 (2 = the known test helper OpenSSL >= 3.4 flags). Run-sheet: docs/M8-GIORNO.md; on-site checklist M6-NOTES 6 items 1-33 (#28 = macOS ACL check; #29-33 = M10). Decide the consent text before he signs (placeholder today unless v1 is approved). | compass | |
| compass:frozen-alert-texts | owner action | Frozen alert texts from the medical team (alerts stay disabled, visibly, until then) Wording guard rejects medic*/allarm*/urgent*/grave and the formal register. | compass | |
| compass:consent-final | owner action | Consent: jurisdiction + final text (placeholder today) A new text changes consent_sha256; the page shows the 'testo cambiato' screen. | compass | |
| compass:bozza-texts | owner action | Digest texts, thresholds (z 3.0/2 vs 2.5/3) and plausibility ranges are BOZZA Owner + medical team. | compass | |
| compass:device-models | owner action | O4 + O5: confirm watch/iPhone/Mac models; decide strict completeness vs HAE 'Since Last Sync' at first install | compass | |
| compass:runtime-sovereignty-row | done | SOVEREIGNTY S4 row for the bundled Python runtime's upstream (GitHub release fetched at build time on the author's machine, sha256-pinned) 2026-11-09: row 'pbs-python-runtime' MERGED (register 1.0.8, root commit 2c972a5, table re-rendered, drift check OK; owner: 'go if robust'). Owned copy [local path] verified; rebuild drill PASSED (a fresh clone at ae87d10 + the D: copy + the same portrait reproduced compass-0.7.1.zip byte for byte). Builds can use --runtime [local path] | compass | |
| compass:acl-hardening | open | macOS ACLs on the data root (Codex HIGH, pre-existing): make-root strips ACL entries (chmod -N) before sealing to 0700; the hub's start check refuses a root that carries ACL entries Owner 2026-11-09 'do what's most proper' -> AFTER M8, not in the install-day package: untested macOS code in a fail-closed path could stop today's install. Today's control = M8-GIORNO step 6 / M6-NOTES item 28 (ls -lde ~ ~/<Nome>; chmod -N with him present). Build it from what his Mac shows (ls -le output, chmod -N on a folder without ACL), tests with the commands stubbed; design in PLAN 'Post-build fix'. | compass | |
| compass:m10-opening | done | M10: the page's opening - the patient's portrait in characters, full bleed over the particle field, dissolving into the interface; particle wires grade to green where a dot lights up; portrait never in git (package -> settings folder -> hub) 2026-11-09: owner decided (patient's photo, full bleed like the author's landing page, background removed, every open) and gave the go. BUILT + VERIFIED the same day: commits bc10383 (hub 0.7.0) + ae87d10 (0.7.1: Codex diff review + /code-review folded, PLAN 7.8); Windows 630 OK, WSL 628/630 (known helper errors); the real page driven in headless Chrome with a synthetic portrait (opening, reveal, consent -> Primi passi, ticks -> diary, Arrivi, key skip, 0 console/CSP errors). Package 0.7.1 carries the portrait. Pipeline + outputs in compass-work/portrait/ (outside the repo). Safari / the real file: M8 items 29-33. | compass | |
| compass:parity-death-m10 | open | Parity (owner rule 2026-11-09): port M10 to the death repo - the opening with the operator's own portrait, the particle wires' green; check whether death names a view like Battito; ledger docs/PARITY.md The death lane does the port in its own checkout (guarded tree, its own plan + reviews); compass keeps this row open until the death commit id lands in docs/PARITY.md. P6 (one drop target + sorting + moving) is BUILT in compass 0.8.0 (2026-11-09): its port is the row parity-death-p6. | compass | |
| compass:parity-death-p6 | done | Parity: port P6 to the death repo - «Metti qui» (one target, the hub sorts by bytes, one question for documents), «Sposta in...» as an append-only re-categorisation record; ledger docs/PARITY.md P6 2026-11-09 22:49: the death port LANDED on the death branch p6-port at 84882a5 (32 files, plan 22547ce, its own Codex rounds + code-review, browser run OK); docs/PARITY.md P6 = done. The death lane merges its own branch into its main (death main still at 186fc71 when recorded). Built in compass as hub 0.8.0 (PLAN section 8). | compass | |
| compass:consent-v1-draft | done | Consent v1 "Prima di cominciare" (informal, tu) confirmed by the owner 2026-11-09 and current from 0.7.2 (commit 9043fe9); v0-bozza stays as history 2026-11-09: owner ruled the first access is digital on the page; v1 text written for approval (commit 06721a4), not current yet (indice.json still v0-bozza). INSTALL DAY: with the placeholder the page shows the 'versione di prova' notice and he will be re-asked when v1 lands; approving v1 before he arrives means flipping indice.json + the three v0 test pins and rebuilding (0.7.1). 'Battito' -> 'Arrivi' done in M10. | compass | |
| compass:p6-drop-target | done | P6 / 0.8: one drop target «Metti qui» above the tiles, the hub sorts by the bytes (new category Note vocali), the one question for documents, «Sposta in...» recorded append-only - owner's go 2026-11-09, BUILT the same day (hub 0.8.0, PLAN section 8) 2026-11-09: Codex read-only plan review (6 HIGH + 3 MEDIUM + 2 LOW, all adopted before the build: re-hash at complete, all-or-nothing vitals preflight, stricter export check, truthful per-file move records, effective category computed per file, the waiting question reachable under every visibility via /api/smistamento), then the Codex diff review + /code-review high before the commit (decisions in PLAN 8.7). Verified: Windows suite 650 OK (13 skipped) + the WSL run; the real page in headless Chrome (compass-work/p6_check.py: mixed drop, question, sorting, tiles, Sposta in..., reload under Niente, 0 console/CSP errors). Committed 24879b2. PACKAGE 0.8.2 BUILT the same day (afb87bd: the glass dialog, outline controls, the title over a slower opening, the green accent, the real portrait; sha256 78922bd7...1a0be, two builds byte-identical, verify-package OK; compass-work/package-0.8.1/ + Drive): it is the carry for the install day (upgrade in place if 0.7.2 is already there; schema 8 additive). Death port brief: docs/P6-DEATH-PORT.md (parity-death-p6). | compass | |
| compass:m9-vendor-normalisation | open | M9: vendor the shared normalisation (tools tree-pipeline parse_hae.py + observations_core.py) byte-for-byte into hub/vendor/ with VENDOR.json; rebuild-observations identical before/after; DERIVATION_VERSION unchanged AFTER M8, never before (the first install ships the reviewed 0.6.4). Brief = section 7 of death/docs/reviews/2026-11-08-observations-layer-PLAN.md. Parser parity re-checked 2026-11-09: hub/parse_hae.py == the canonical copy (sha256 0f244ae5...8158). | compass | |
| compass:m11-windows-installer | done | M11 (owner ask 2026-11-09): an installer for a PC (Windows) - runtime row, service model, ACLs vs POSIX modes, TLS without openssl; PLAN section 9.1 Scoping done 2026-11-09 (PLAN section 9.1); the owner decided the same evening (build it, one person on one PC, no admin) and it was built in a worktree and merged into main 2026-11-09 evening - the live row is windows-installer-m11. Not in 0.8.x: the carry stays 0.8.2. | compass | |
| compass:pc-carry-0-9-0 | owner action | The Windows carry 0.9.0 for the patient's PC laptop (owner D2 2026-11-09): consent text wording (new version, owner confirms), the GUIDA's Windows edition, the Science bundle texts, a Windows run-sheet, the hub's network info on Windows (<COMPUTERNAME>.local + LAN addresses for the iPhone), the D3 standard-account run, the package built twice + verify-package + Drive copy 0.9.6 BUILT 2026-11-10 evening (2f49912): the box can be switched on at the visit (consent v2 signed + current, the rules pinned, no budget, tutto-only); sha256 0e60e4d7...a08c twice byte-identical, verify-package OK; carry compass-work/package-windows-0.9.6/ + Drive; 0.9.5 superseded. THE CARRY FOR HIS LAPTOP IS 0.9.6; at the upgrade he accepts the new consent text once. | 0.9.5 BUILT 2026-11-10 evening (39dc27c): the consent v1 is current again (0.9.3/0.9.4 would have asked him to sign the v2 draft at the upgrade); sha256 1417c9b0...9c79 twice byte-identical, verify-package OK; carry compass-work/package-windows-0.9.5/ + Drive; 0.9.4 superseded. THE CARRY FOR HIS LAPTOP IS 0.9.5. | 0.9.4 BUILT 2026-11-10 evening (cc53cb3; the installer round after the synthetic run: Disinstalla.cmd from the app folder fixed, F4-F9 folded; sha256 08f92099...63dd twice byte-identical, verify-package OK; carry compass-work/package-windows-0.9.4/ + Drive) - the carry for his laptop is now 0.9.4. Synthetic pass on it: ALL FOUR STEPS PASS (2026-11-10 17:01, laptop shape): install 0.8.3 rc 0, the forced rollback rc 1 as designed with 0.8.3 restored, the clean upgrade to 0.9.4 rc 0 (heartbeat 0.9.4), Disinstalla.cmd from the program folder rc 0 - «Fatto», the program folder, the task and the shortcut gone, the settings and logs removed on «si», the data root untouched. | SYNTHETIC RUN 2026-11-10 afternoon (owner: not on his PC): the real 0.8.3 + 0.9.3 packages and scripts in a sandbox shaped like his laptop (OneDrive Desktop, Installa.cmd via cmd.exe, accented name) - install 0.8.3 PASS, the forced rollback PASS (0.8.3 restored, WinError 10048 in servizio.log), the clean upgrade to 0.9.3 PASS, Disinstalla.cmd from the app folder FAILS ('in use', code 1 - M11-NOTES 9 F8, the one fix the next package must carry); D3-RUN section 8, M11-NOTES section 6. Items 1, 3, 8-10, 12, 13, 15, 16 still need the real PC. | D3 PREPARED 2026-11-10 afternoon (owner: proceed, option 1): docs/D3-RUN.md is the run sheet for the standard-account run (0.8.3 then the 0.9.3 upgrade, the forced rollback, Disinstalla); the two packages sit in [local path] (hashes checked); an Opus 5.5 API review of the upgrade path on the org credit found six installer defects, verified in the code, recorded as M11-NOTES section 9 F4-F9 and as watch-points in the sheet - to fix after the run with its evidence. THE RUN IS THE OWNER'S (a standard account signed in interactively). | BUILT 2026-11-10 night: the carry is compass-0.9.1.zip (commit 24b763c, PLAN section 12.6; 0.9.0 from 29fb795 superseded an hour later by the Codex-gate fixes) twice byte-identical, sha256 14486083...fcd67, verify-package OK; carry compass-work/package-windows-0.9.1/ + Drive AEGO/backups/compass/package-windows-0.9.1/ (zip, .sha256, the PC GUIDA.pdf, RICETTA-PROFILO.pdf, README.txt). The Codex read-only gate on PLAN 12.6/13 RAN at 01:00 (nine findings: two fixed in 0.9.1, the section 13 amendments recorded); the Gemini pass is still owed. The chat-box branch was merged 2026-11-10 (852c8bb, hub 0.9.2; row chat-box-b2): the carry is now 0.9.3 (engine fixes + the box off; commit 247f64e, sha256 44175436...4990, compass-work/package-windows-0.9.3/ + Drive; row engine-fixes-port) - 0.9.1 superseded for the upgrade run (the box is off on his PC until the owner's items in row chat-box-owner are done). In it: the hub knows <COMPUTERNAME>.local + the LAN addresses on Windows, «Mostra il link per l'iPhone» (the profile offered on the LAN for 10 minutes, consent-gated), the page says «computer», the Science texts and the GUIDA are the PC's. Consent stays v1 (owner). Verified: Windows 693 OK (three foreground groups), WSL the known OpenSSL errors only; /code-review high folded (10 findings). OWNER NEXT: (a) the D3 run on a standard local account of your PC - install 0.8.3, then upgrade with this zip (M11-NOTES section 4, M8-GIORNO-PC.md); (b) then the upgrade on his laptop with you present (GUIDA 9b: the profile link). The 0.8.3 on his PC keeps working meanwhile. | compass | |
| compass:m12-aggiorna-update-button | owner action | M12 «Aggiorna» (owner ask 2026-11-09 late): an update button on the page that fetches the new version from the internet, verifies it and lets the installer replace the program - lead's decision: Cloudflare read-only static origin, NOT GitHub; signed manifest, the hub verifies, the installer's own rollback transaction installs; a new consent purpose + SOVEREIGNTY row first DONE 2026-11-11 evening on main (87826d4): «Aggiorna» + «Scarica il pacchetto» (PLAN 13, 13.1, 13.2), hub 0.10.0; the origin LIVE on R2 (compass.alessiodevecchi.com) serving release 1 = 0.10.0; the real-origin press proven from the author's PC (D3-RUN 11). OWNER: the visit with the carry compass-work/package-windows-0.10.0/ (his portrait inside; from then on he downloads and updates himself); the yes on the 13.2 consent sentence; the offline copy of the key; the attended real-task gate (M11-NOTES 17-19). | OWNER INPUTS GIVEN 2026-11-11 (afternoon): consent v3 approved and current; ORIGIN = compass.alessiodevecchi.com (a separate static Pages project: the owner's hand to create, PLAN 13.1 walks him); the key ceremony done (RSA 3072, private half on [local path] - the owner still owes the offline copy); invariant 2 amended; the register row approved as drafted (ready for the root lane). Gates run: full suite + WSL, code review folded, the synthetic D3 fifth step end to end. Left: the attended real-task gate on the author's PC (to write), Codex after 2026-11-15, the Pages project + DNS by the owner, the lead's merge, the carry build with --sequenza 1. | BUILT 2026-11-11 on worktree branch m12-aggiorna (hub 0.10.0; one commit per slice: the verifier, the ledger, the updater + helper commands + hub wiring + consent v3 BOZZA, Installa.ps1 -Aggiorna, the page, release.py + the build; the touched suites green). NOT merged, NOT shipped: dark until the owner's four inputs (consent v3 text, origin host, key ceremony, invariant 2) and the register ruling (row draft .planning/sovereignty-row-draft-compass-update-origin.json); then the gates (full suite + WSL, the synthetic D3 fifth step, the scripted real-task gate on the author's PC, /code-review high, two builds byte-identical) and the lead's merge. Record: PLAN section 13.1; pickup docs/PICKUP-M12-AGGIORNA.md rewritten. | HANDOFF 2026-11-10 night: docs/PICKUP-M12-AGGIORNA.md (state, the owner's four inputs, what exists to build on, the build order and gates). NOT BUILT; 0.9.6 cannot update itself - the first version carrying the button and the public key is installed by hand, only the next one can come through the button: before the visit or at a later one is the owner's call. | Planned 2026-11-09 late in PLAN section 13; NOT built (it collides with invariant 2 'no update checks' and the consent v1 'non si collega a internet' until the owner amends both). Owner inputs: the consent v2 text, the origin host name, the key ceremony for the release key, the register row (S4), the amended invariant 2. Then Codex at the gate + the security reviews. After the 0.9.0 upgrade package (12.6). | compass | |
| compass:engine-fixes-port | done | Port the shared-core engine fixes into the hub (death lane hand-off 2026-11-10: ten bugs found by a code gate in the lifted engine / digest / alerts / therapy / export logic, fixed in tools f9cc9d5 + cf25765, ENGINE_VERSION 2, regression tests) - PORTED into the hub 2026-11-10 afternoon (owner's go; hub 0.9.3, PLAN section 14; the fixes ported, not vendored; therapy #5 not applicable; tests/test_parity.py reproduces the tools' fixture) DONE 2026-11-10 afternoon: hub/engine.py (receipt_moment, complete, ENGINE_VERSION 2, the '' series decides its day, zscore), hub/config.py (finite settings, min_scale an object), hub/alerts.py (_extreme, zscore), hub/digest.py (guard on load with the period words, TemplateError on bad braces/shapes, copertura counts every metric with data), hub/science_export.py (engine.complete); ten regression tests fail on the pre-port tree; parity fixture reproduced (cab112ff...e684, status domande). Codex plan gate folded (five), /code-review high + Codex on the diff. RELEASED 2026-11-10 15:20: commit 247f64e, compass-0.9.3.zip twice byte-identical (sha256 44175436...4990), verify-package OK, carry compass-work/package-windows-0.9.3/ + Drive AEGO/backups/compass/package-windows-0.9.3/ (zip, .sha256, GUIDA.pdf, RICETTA-PROFILO.pdf, README.txt). The chat box is inside but OFF. /code-review high (eight) + Codex (three) folded, PLAN 14.4. Nothing installs on his laptop without the owner. | Queued on the owner's explicit go only (he is rebooting). Brief [local path] record [local path] details in docs/PICKUP-2026-11-09-evening.md. Plan mode first; vendoring the six cores (M9) vs porting the fixes is the plan's first decision; the parity fixture must reproduce; then the release path. ~2-3 h. Nothing installs on his laptop without the owner. | compass | |
| compass:chat-bridge | done | Owner ask 2026-11-09: how can he ask about his health - a chat box with dictation bridged to Claude (Pro / Science); PLAN section 9.2 weighs Science-as-is vs the API from the hub under his key vs a local model Superseded by the owner's ruling of 2026-11-09 late (option b2 built, row chat-box-b2) - closed 2026-11-10. | compass | |
| compass:windows-installer-m11 | done | M11: an installer for a PC (Windows) - built 2026-11-09 in a worktree (owner decisions: build it, one person on one PC, no admin): Installa.cmd/.ps1, Disinstalla, tls.ps1 (.NET certificates), Task Scheduler, the helper extended, build --runtime-windows, 27 new tests; UNTESTED on a real PC (docs/M11-NOTES.md section 6) Owner rulings 2026-11-09 late (M11-NOTES section 4): D1 ACCEPTED (os.startfile; security note stays), D2 the patient has a PC LAPTOP - the Windows installer is the shipping path (the carry: row pc-carry-0-9-0), D3 decided by the lead: a standard local account on the author's own PC before the install day (no VM), D4 YES - the row draft .planning/sovereignty-row-draft-pbs-python-runtime-windows.json is ruled in, ROOT LANE TO MERGE into the register, D5 the iPhone profile name is now 'compass - certificato locale' on both platforms (nobody holds the profile yet). MERGED into main 2026-11-09 evening (no-ff; PLAN section 12; Windows suite 684 OK, WSL run, /code-review high on the merge diff: 5 fixes folded, 3 follow-ups F1-F3 and the owner decision D5 - the iPhone profile name's long dash - in M11-NOTES section 9); NOT shipped - hub stays 0.8.2, the carry for the Mac is final; 0.9.0 only on the owner's word. UNTESTED on a real PC (M11-NOTES section 6). | compass | |
| compass:chat-box-b2 | done | The «Chiedi» box (PLAN section 11, option b2): the hub calls the Anthropic Messages API under the author's organization key (chiave-claude.txt in the settings folder), consent v2 purpose 'conversazione', conversazioni/<day>.jsonl + conversation_turns chained, the rules prompt sha256-pinned, the export as capped context verified against its hashes, no retry; built 2026-11-10 in a worktree, MERGED into main 2026-11-10 (852c8bb, hub 0.9.2, not shipped); the smoke call made (claude-sonnet-5-5 answers), a safety read on synthetic data done, a review round folded (PLAN section 11.12) 2026-11-10 afternoon: merged (852c8bb), suite 716 OK Windows + WSL, /code-review high on the merge (ten findings: six folded - a pending withdrawal never sent, reconcile isolated per day, one deadline for the whole read, one send path, one dock row per upload, the orphan domanda stated; solo-digest left to the owner), Codex read-only on the fix diff. Smoke call: model claude-sonnet-5-5 answers (Codex finding 1 settled), rules sha256 821cf942...64c90 NOT pinned (the medical team approves hub/chat_prompt.md first). Safety read (ten probes x Sonnet 5.5 + Opus 5.5): every rule held; the open question was cut at max_tokens 1024 (thinking counts) - now 4096 + chat_bridge.effort 'low'. Owner rulings still open: the final consent v2 text (segnaposto true: the hub refuses the real transport while it is a BOZZA), the medical team's sight of hub/chat_prompt.md, retention/geography facts in the consent, a budget-capped key in the Console, 'solo-digest' vs the box (Codex plan review 1). Register row draft .planning/sovereignty-row-draft-anthropic-api-patient-chat.json for the root lane. Death port: PARITY P7. | compass | |
| compass:chat-budget-dock | done | The chat credit and the bottom dock (owner addition 2026-11-10): a local token budget (chat_bridge.budget per day / per month, reset at local midnight / the first), the hub counting input+output tokens of every answered turn, heartbeat chat.budget {used, limit, resets_at, period}, 429 budget_exhausted; the dock at the bottom of the page stacking the credit bar, the upload row and the archive-check row, hidden when nothing is live; built 2026-11-10 with the box Bar text (tu, BOZZA): «Claude: credito di oggi 63% usato, si rinnova a mezzanotte» / «… finito, …»; never a currency amount (the Console balance is the author's, not readable from the patient's PC). Driven in the headless check compass-work/chat_check.py. | compass | |
| compass:chat-box-owner | done | The «Chiedi» box: the owner's rulings of 2026-11-10 evening are in 0.9.6 - consent v2 signed and current, the rules approved and pinned by default, no budget, the box only under «tutto»; at the visit only the key file (CHAT-BRIDGE 8). Left: the register row (root lane), PARITY P7 (death lane) DONE 2026-11-10 evening (2f49912, PLAN 14.7). | 2026-11-10 evening: v2 is worded for a PC («computer»); v1 is the current text in the package, so the box cannot open until you sign v2 AND set consenso/indice.json to v2 (PLAN 14.6). | 2026-11-10: the hub refuses the real transport while the consent is a BOZZA (consent_draft) or the rules are unpinned (rules_unpinned), so nothing can leave his PC before these. The smoke call and the safety read ran on the author's PC with the root organization key (scratchpad only, deleted). CHAT-BRIDGE section 7 (10), PLAN section 11.12. | compass | |
| compass:parity-death-p7 | open | Parity: P7 - the «Chiedi» box and the bottom dock to the death repo; the death lane decides first whether a chat box fits the vault (a dumb pipe) - port, n/a with the reason, or a dated deferral; the dock on its own fits today; ledger docs/PARITY.md P7 Brief for the death-lane session: docs/P7-DEATH-PORT.md (2026-11-10 evening, against compass 592369d / hub 0.9.6: the box as the owner ruled it - no budget, tutto-only, the rules pinned by default). The death lane works in [local path] (its own plan + reviews); compass keeps this row open until docs/PARITY.md P7 carries the death commit id or the n/a reason. | compass | |
| compass:register-rows-root-lane | done | Root lane: merge the two compass register rows - pbs-python-runtime-windows (M11 D4 «yes», 2026-11-09) and anthropic-api-patient-chat (the «Chiedi» box, rulings of 2026-11-09 and 2026-11-10) - from compass .planning/ into [local path] DONE 2026-11-10 evening by the root lane: both rows are in [local path] (root commit ffa7d35, register 1.0.11, 73 rows; cd48694 = 1.0.12, the consent folder path respelled consenso/v2/** after the guard's STALE-PATH on the trailing slash; table re-rendered, drift check OK, guard: compass clean, canon manifest re-attested a423465; committed, not pushed - the root checkout carries another session's 7 unpushed commits). Merged as drafted except the register's conventions: re_entry 2027-02-08 for both (S1: no passed fresh-clone drill = 90 d from the merge; the drafts said 2027-03-01 and 2027-05-01), role RUNTIME + effects external on the chat row (its effects prose folded into the dependency text), the work-folder placeholder replaced by the real path. Verified at merge: both Windows tarball copies hash 1f2ab538...b149 = the upstream SHA256SUMS; hub/chat_prompt.md sha256 = the config default pin; test_no_egress asserts api.anthropic.com:443; hub 0.9.6. | Hand-off note: compass .planning/NOTE-for-root-lane-register-rows-2026-11-10.md; the two drafts sit beside it (the chat row updated 2026-11-10 evening to the rulings and to the calls really made). Checked 2026-11-10 evening: the register holds pbs-python-runtime (Mac) only; neither row is in. The compass lane never edits the register (S4); it closes this row when the root lane says the rows are in. | compass | |
| compass:visit-0-9-6 | owner action | The visit: upgrade his laptop to 0.9.6 (the carry; he accepts the new consent text once, keeps «Tutto»), then switch the box on - one key of its own in the Console (named compass, no cap), chiave-claude.txt + "chat_bridge": {} in his config.json, restart; «Chiedi» appears The exact lines: docs/CHAT-BRIDGE.md section 8; the upgrade steps: the README in compass-work/package-windows-0.9.6/ (sha256 0e60e4d7...a08c); the day-after sheet docs/M8-GIORNO-PC.md. Nothing leaves his PC before the key file exists; deleting it closes the box again. Nothing installs on his laptop without the author present. | compass | |
| compass:ricerca-fonti-nota | done | The research bench (PLAN 15): web search in the team's sites, every query shown, his condition note - BUILT on branch ricerca-fonti (hub 0.11.0, c1-c8), dark until the owner's inputs; code gates: the full suite + WSL, /code-review, the headless check; Codex owed from 2026-11-15 BUILT 2026-11-11 after three plan-review rounds (Gemini x3, Claude x3: no open HIGH/MEDIUM). Not merged into main until the gates pass. Nothing reaches the patient before every owner item below. | compass | |
| compass:fonti-list-team | done | Owner + team: the list of trusted sites (fonti-affidabili.json, schema compass-fonti/1, bare lower-case domains, optional path) and the approving role; placed at a visit in his config folder, its sha256 as chat_bridge.ricerca.fonti_sha256 DONE 2026-11-11: the owner approved the list («approved»): fourteen sites (AIRC, AIOM, ISS, AIFA, EMA, Humanitas, MSD Manuals IT, Mayo Clinic, NHS, NCI, NCBI, Cochrane, WHO, Orphanet), versione equipe-1, approvato_da «l'autore, per l'équipe». The real file is [local path] (never in git); it goes to his config folder at the visit with its sha256 in config.json. Example: docs/fonti-affidabili.example.json. A missing or changed file = research off, the box open, the page says why. | compass | |
| compass:rules-v2-approval-pin | done | Owner + team: approve hub/chat_prompt.md version 2 (the research section, «fonte», the note as «riferito»); then the pin commit (CHAT prompt_sha256 = its sha256; the test tuple with it) DONE 2026-11-11: the owner approved the rules v2 for the team («approved»); the pin f57ed90c...c9be is the config default (c11). The default pin is None on the branch: the real transport refuses to run unpinned (rules_unpinned). The safety read's defaults land in the same commit. | compass | |
| compass:consent-v4-signature | done | Owner: sign consent v4 (consenso/v4: the research as a rule asked of Claude plus the visible queries, the note; capacita ricerca + nota-condizione) - segnaposto false, indice.json -> v4; he is asked once at the next open DONE 2026-11-11 (owner: «as soon as he gets here» = the patient accepts the text at the first open with the author present): v4 is current and signed in the release (c12); he reads and accepts it once at the visit. Until then v3 stays current and the research and the note stay off (consenso_versione), whatever is on disk. | compass | |
| compass:console-web-search | done | Owner: check in the Console that web search is enabled for the organization (the compass key); prove it with chat-prova with the list in force (one searching call, the sources printed) DONE 2026-11-11 (owner: «can you run it?»): chat-prova with the approved list from the author's PC - request req_011CgwCxPeszwUkCyDKytXDr, claude-sonnet-5-5, 24017 in / 890 out, 1 search, 10 pages read, 4 sources cited (Mayo Clinic, MSD Manuals x2, PMC), all in the list, every claim «fonte», no advice; web search is enabled for the organization. The scratch key file was deleted after the call. A 400 invalid_request_error at every research turn otherwise; the page would say «Claude ha rifiutato la richiesta … può dipendere dalla ricerca». | compass | |
| compass:safety-read-ricerca | done | Owner's go: the safety read of the research bench on synthetic data with the real key from the author's PC (ten probes x Sonnet 5.5 + Opus 5.5, a provisional list; every recorded query audited for a value, date, day or name; the 8192 cut; cost; «nothing found»; pause_turn; reply size; timeout) DONE 2026-11-11 (owner: «go»): ten research probes x claude-sonnet-5-5 + claude-opus-5-5 on synthetic data (28 days, two cycles) with the approved list and a synthetic note, through the hub's own path with the real transport; every rule held (no supplement advice, no alarm, the injection and the name-search refused, the labels explained); queries flagged for a note word, a digit or a name: NONE on both; Sonnet 254k in / 9.2k out, 5 searches; Opus 306k in / 10.7k out, 7 searches; no cut at 8192, no pause_turn, no timeout. Transcripts compass-work/chat-bridge/safety-read-ricerca-<model>.md. Defaults kept (max_uses 3, max_tokens 8192, timeout 120). Real spend on the organization key, never from a test. Transcripts to compass-work/chat-bridge/. Fixes max_uses, max_tokens and timeout_seconds in the pin commit. | compass | |
| compass:parity-death-research | open | Parity: the research bench (sources, queries, the note) to the death repo - the death lane decides after P7 (port, n/a with the reason, or a dated deferral); ledger docs/PARITY.md P9 Depends on the death lane's P7 decision (docs/P7-DEATH-PORT.md). The dock and the page's source rendering fit the vault as they are; a search over the operator's own records is the death lane's call. | compass | |
| compass:register-row-amendment-root-lane | open | Root lane: amend the register row anthropic-api-patient-chat with the research bench (web search: the words of a search reach the search service Anthropic uses; the team's allowlist; the note; $10 per 1000 searches; consumers hub/fonti.py, consenso/v4/) The dated amendment is in compass .planning/sovereignty-row-draft-anthropic-api-patient-chat.json (_amendment_2026-11-11) and in .planning/NOTE-for-root-lane-register-rows-2026-11-10.md. The compass lane never edits the register (S4). | compass | |
| compass:visit-0-11 | owner action | The visit 0.11: install compass-0.11.0.zip (73 MB, sha 6e0eb5f0...fa5f, with his portrait), he accepts consent v4, the key + the approved list + the config line, verify «Ricerca su internet attiva», his note, the first question with sources - the sheet docs/VISITA-0.11.md REBUILT 2026-11-11 from 854cd02 with the portrait of 0.8.3 (out-20261109, fa86ebe4...), sha256 6e0eb5f0...fa5f; the first build (wrong portrait, 57717554...) is in package-windows-0.11.0/superseded-wrong-portrait/. The Drive copy in the shared folder replaced. Package built 2026-11-11 from 854cd02 (ricerca-fonti): compass-work/package-windows-0.11.0/. The list: compass-work/fonti-affidabili.json, sha256 2b6cb4ce...cdca. Nothing reaches him before the visit; the box opens only with the key file. | compass | |
| compass:opening-rain | open | The opening as digital rain (owner request 2026-11-11): built and committed on main (0aa6078), not in 0.11.0 - reaches his PC with the next release (through «Aggiorna» once 0.11 is installed); death port = PARITY P1 ui/intro.js only; PLAN 7 'The rain'. Full suite 819 OK; headless Chrome: page at ~5.5 s, canvas gone ~8.5 s, skip 0.25 s, 0 console/CSP errors. The opening is ~2.5 s longer than before (owner may want a shorter hold or a faster fall). | compass |
| Tauri port (cousin):1 | open | Read the handoff note, the seed assessment, the overlay design and the mainline digestTauri lane · 11-09 TRACK-D/README.md lists them in order. | cousin | |
| Tauri port (cousin):2 | open | Cherry-pick the Android scaffolding, the launch scripts and the rebrand onto track-d New files; should land conflict-free. | cousin | |
| Tauri port (cousin):3 | open | Cherry-pick the connection layer and re-point it at the overlay backend-url, http client, mobile bootstrap, connection settings, the connect-failure unblock. | cousin | |
| Tauri port (cousin):4 | open | Spike: native audio + WebRTC library for Tauri 2.12 (Android first) One-page result: library, licence, what works in background, what the iOS audio session needs later. | cousin | |
| Tauri port (cousin):5 | open | Define the client render surface: which contracts it consumes, what the reduced cloud view shows brain.* / perception:* / tts.audio_chunk. Composes nothing, decides nothing. | cousin · EVA | |
| Tauri port (cousin):6 | ruled / specced | Client ASR and client LLM stay on dev-mobile; nothing of them comes over Ruling 2026-11-02: perception and reasoning stay on the workstation. | owner | |
| Tauri port (cousin):7 | open | Write up the server token-gate changes as input to the D1 security review Not ported blind: under the overlay the gate semantics change. | cousin → EVA | |
| Tauri port (cousin):8 | open | Playback handles segment streams and flushes the local jitter buffer on barge-in Depends on the output-streaming path landing on mainline (B0.5). | cousin | |
| Tauri port (cousin):9 | open | Weekly merge-up from eva-v1.1 into track-d Small weekly merges instead of six-week jumps. | cousin |
Each job writes its own run ledger on the owned scheduler; this table and the items that name a job are stamped from it at every build, nobody edits them by hand.
| task | lane | cadence | state | last run · 24 h |
|---|---|---|---|---|
| AEGO death vault pull s0 | health vault | daily 03:00, daily 08:30, daily 13:00, daily 18:30, logon +3m | unwrapped | runs through its own registrar; no ledger (its lane's E2 step-5 decision pending) |
| AEGO death vault watchdog | health vault | daily 09:00, logon +10m | unwrapped | runs through its own registrar; no ledger (its lane's E2 step-5 decision pending) |
| AEGO sovereignty digest | root | daily 06:30, logon +3m | unwrapped | runs through its own registrar; no ledger (its lane's E2 step-5 decision pending) |
| AEGO standby guard | tools | logon +30s, every 15m | failed | exited 2026-11-10 17:16 (UTC+01:00) fail · 17973 s (exit -1) · 24 h: 0 ok, 1 failed |
| AEGO TanStack Guard | tools | every 6h | ok | last run 2026-11-11 12:22 (UTC+01:00) ok · 395 s · 24 h: 4 ok |
| AEGO-AISearch-Rerank-Watch | gateway | daily 03:00 | unwrapped | runs through its own registrar; no ledger (its lane's E2 step-5 decision pending) |
| AEGO-Reap-Claude | tools | every 15m | own launcher | own synchronous launcher by design (E2 step 5): Task Scheduler holds the real result; no ledger |
| AEGO canon drift | tools | every 3h, logon +5m | ok | last run 2026-11-11 15:15 (UTC+01:00) ok · 2 s · 24 h: 5 ok |
| AEGO sovereignty register drift | tools | every 3h, logon +6m | ok | last run 2026-11-11 15:20 (UTC+01:00) ok · 1 s · 24 h: 5 ok |
| AEGO iPad display mini1 | tools | logon +1m, every 15m | failed | exited 2026-11-11 13:26 (UTC+01:00) fail · 39365 s (exit 1) · 24 h: 0 ok, 3 failed |
| AEGO progress page | root | logon +30s, every 30m | ok | last run 2026-11-11 16:35 (UTC+01:00) ok · 1 s · 24 h: 48 ok |
| AEGO iPad display duo | tools | logon +1m, every 15m | failed | exited 2026-11-11 13:26 (UTC+01:00) fail · 39366 s (exit 1) · 24 h: 0 ok, 3 failed |
| AEGO display remote | tools | logon +1m, every 15m | failed | exited 2026-11-11 16:49 (UTC+01:00) fail · 8707 s (exit -1) · 24 h: 0 ok, 3 failed |
| document | repo | last change | state | drift |
|---|---|---|---|---|
| Architecture doc (root) | root | 2026-11-07 | fresh | - |
| Root mandates | root | 2026-11-07 | fresh | - |
| Sovereignty register + mandate | root | 2026-11-08 | fresh | renderer, daily drift check and the S10 guard exist (tools 0749aeb, 6bc875f); the guard is unscheduled until the catch-all consumer rows are narrowed (root lane, in progress) |
| Canon manifest | root | 2026-11-07 | fresh | - |
| Root resume state | root | 2026-11-07 | fresh | untracked by design (allowlist): no history |
| EVA mandates | EVA | 2026-11-02 | fresh | names the synced drive as the durable second copy; ruled rented on 11-06 |
| EVA README | EVA | 2026-05-17 | stale | lists the old guardian set; config v3.0 changed it in March |
| EVA architecture doc + guardian dev reference | EVA | 2026-10-11 | aging | guardian weight tables pre-v3.0 while the mandates file is current; the generator script exists and is never called |
| Endgame doc + digest + convergence map | EVA | 2026-05-24 | stable canon | - |
| EVA failure-mode archive · audio config | EVA | 2026-11-06 | fresh | - |
| EVA resume state | EVA | 2026-11-07 | aging | frontmatter carries three disagreeing stale dates; live blocks are current |
| aeva.aego.dev site content | EVA | 2026-04-21 | stale | spec version mismatch inside the site; family count predates two filings; model page shows a four-tier layout; patent-forward framing |
| Orchestrator mandates | orchestrator | 2026-11-07 | fresh | - |
| EVA system knowledge (orchestrator copy, mandatory reading) | orchestrator | 2026-04-12 | stale | 2,688 EVA commits behind; wrong tiers, sizes and latencies; no current brain - owner ruling pending (retire vs re-sync) |
| Orchestrator flags + resume state | orchestrator | 2026-11-07 | fresh | - |
| Vault mandates | health vault | 2026-11-07 | fresh | gateway described as pending owner steps; it is live |
| Vault architecture doc + README | health vault | 2026-11-03 | fresh | auth model described from before the gateway; history list stops at 11-03 |
| Evidence mandates + resume state | evidence | 2026-11-07 | fresh | roadmap text from June |
| Tools mandates | tools | 2026-11-07 | fresh | - |
| Tools registry README | tools | 2026-11-07 | fresh | - |
| Site worker mandates + state | site worker | 2026-11-06 | fresh | - |
| Money mandates + resume state | money | 2026-04-03 | stale | old project name; two scripts listed that do not exist; state seven months behind commits |
| Gateway docs | gateway | 2026-11-06 | fresh | roadmap lists one phase while the milestone is complete |
| major_domus docs | major_domus | 2026-11-03 | fresh | 'two review rounds', 'no remote', 'not started' - all three false since 11-05 |
| maze config (not a doc, but the inventory path) | maze | - | stale | scans the pre-move project path; functional drift |
| doc automation | last run | verdict |
|---|---|---|
| Daily documentation analysis (evidence workflow, dispatched by the site worker at 09:00) | 2026-11-06 green | runs green daily but changes no document: it only writes a JSON result to object storage. It never kept anything up to date. |
| Site/docs publish workflow (EVA repo) | 2026-07-10 | no run in four months - under investigation (relaunched sweep) |
| Guardian-config → docs sync script | never called | exists; not in any script hook; two of its three targets are stale → one command fixes them |
| Documentation analyzer script (EVA) | never | its report file was never produced |
| Weekly /sync-docs command | no evidence of a run | manual prompt from January; not scheduled |
| Sitemap regeneration (site worker dispatch) | 2026-04-23 | no longer auto-deploys; register says drop by 2027-01-31 |
| Verdict | - | nothing in the estate maintains the mandates files, the resume states or the EVA system-knowledge copy. Documentation health is manual until a hygiene check exists. |