Repository navigation
chat: the model picker is a table with headed columns - #1107
Merged
Merged
Conversation
|
|
A /model row drew its facts as one right-aligned `·` tail, so no two rows put their price, window or score in the same column and six hundred names could not be read down. The list is the one list on this surface that is read DOWN: the question in front of somebody scrolling it is "which of these is cheap", "which holds a million tokens", "which can see", and every one of those is a comparison between rows. So the facts get columns — via, first, in/M, out/M, window, t/s, elo, can — under one dim heading line that carries the units the rows used to spell on every one of them. The ranking is modelFields' own ranking laid out down the page instead of along the row, it gives up its columns from the same low-ranked end, and it falls back to the ranked tail wherever a frame has no room for columns (and always at tierPhone). Both shapes are one reading of the model now (modelFacts), so a figure cannot mean dollars per million in the table and something else in the tail. Co-Authored-By: Claude Opus 5 <[email protected]>
… own heading Two questions the table's first reader asked that the corpus could not answer well. The capability words: the page listed all six as though any of them could turn up on a model row, and three of them never can — a model publishing any non-text output modality is not a conversation model and is off the /model list entirely, so draws, speaks and films belong to the media slots. The page says which side each word reads, which three appear where, that the cell reports published modalities only and never infers from the id, and that the looking slot DOES fall back to a name — so a silent …-vl row can be offered there while showing nothing under `can`. The tilde: `why are some model names prefixed with a squiggle` and `why does this model start with ~` both missed the page that answers them, because the tilde shared a heading with `…-latest`. It has its own now, and the unmeasured-model paragraph that was buried in the unpinning section has one too. Six probes for the table's columns and two for the tilde are on the gate. Co-Authored-By: Claude Opus 5 <[email protected]>
The row's capability words were six invented verbs — sees, hears, watches, draws, speaks, films — and two things were wrong with them. A verb had to carry the SIDE as well as the thing (`sees` is "image, on the way in"), so six words had to be learned before a row could be read, and the words were the only place the side was written down. And they were lossy where the catalog is not: `speaks` folded speech, audio and music into one word, so a model that writes songs and one that reads a paragraph aloud drew the same row. A table has a head over every column and a head can say the side for the whole list. So the one `can` column becomes two — `reads` and `makes` — and the cells are the catalog's own nouns: image, audio, video, file, speech, music. Nothing has to be learned and nothing folds. The order is ours, because the catalog has none: it publishes the same set as `text, image, file`, `file, image, text` and `image, text, file` on neighbouring rows. A word this build has never seen is still drawn, after the ones it knows. `makes` is never drawn in /model — a model answering with anything but text cannot hold a conversation and is not on that list — so it costs nothing there and is the column the media slots exist for. modelNameWide drops from 44 to 38, measured: of 355 chat models in a live catalog 343 have ids of 36 cells or fewer, and sizing the name column for the twelve outliers cost every row the whole `reads` column. sees and draws survive only in the filter box, and the comment says why: `image` is a word dozens of model ids carry, so it cannot be a filter term without breaking the search for qwen/qwen-image-3. Co-Authored-By: Claude Opus 5 <[email protected]>
Asked why `makes` never appears, and the measurement answered more than the question did. Across every list this surface has, `makes` has exactly ONE distinct value: empty on /model, because a model you can converse with answers in text and nothing else; `image` on all 54 rows of the drawing slot; `speech` on all 18 of speaking; `video` on all 29 of filming. Four lists, four constants, and a head over each that a person reads before finding out it says nothing — the list's own definition written once per row. So a modality column is dropped when every row agrees on it, not only when nobody published it. Law 4 was the case where the one thing every row says is nothing. It is asked of `reads` and `makes` alone, and the restriction is what makes it safe: constancy means "this is the filter" only where a filter could have caused it. Two models that cost the same are a coincidence, and a price column that vanished because a short list agreed with itself would hide a figure somebody came to read. The emptiness law is about facts nobody published; it may not grow into hiding facts that were. Co-Authored-By: Claude Opus 5 <[email protected]>
Three changes the owner asked for, and one they did not have to. The heads are `inputs` and `outputs` rather than `reads` and `makes` — `reads image` was always slightly wrong, since you look at a picture rather than read one, and the pair reads as a pair. `text` is named. Leaving it out was the emptiness law applied one step too far: the cell it produced was BLANK under a head saying `inputs`, which does not read as "text, like everything else here", it reads as "nothing". A row that published no modalities says `text` too, which is the one silence law drawn where somebody can see it. The cells are joined by a space rather than `, `. Three cells on the widest row, and the widest row is what a column is sized by — with commas and `text` the column needed 101 cells of measure and would never have been drawn at all. And the one that fell out: the TAIL still leaves `text` out. Same reading, asked with withText false. A cell has to be true of every row under its head; a tail carries what tells rows apart, and `inputs text · outputs text` is the same nine words on five hundred rows, spending room the window and the price are queueing for. Co-Authored-By: Claude Opus 5 <[email protected]>
…wn keys Three things the owner asked for. `text` is out of the modality cells again — tried in for one wave on the argument that a blank cell under `inputs` reads as "nothing", taken back out because what a cell is for is what the model does BEYOND holding a conversation, and every model on the list reads and writes text. Two blank cells mean text in, text out. The heads stay `inputs` and `outputs`. And the keys the box promised: `→ providers` and `ctrl+t` did nothing whatever on home's model list. The door never armed the fold, so there was nothing to open, and it answered neither key — while the placeholder under the list named both. Home arms the fold now, enter on a provider pins it, and ctrl+t walks the rung. The rung is held on the DRAFT and spent when the next conversation attaches, because nothing behind home may be touched and an agent this window happens to be holding is a conversation nobody is looking at. The keys also moved off the placeholder and onto the foot. A placeholder is the one line on screen that disappears the moment somebody uses it — so `→ providers` was gone by the first typed character, which is exactly when a person has found their model and wants its machines. The foot stays, and it can say what each key does WHERE it does it. Co-Authored-By: Claude Opus 5 <[email protected]>
It read `baseten: first token 0.4s, steady 64 t/s, no tail — from the sheet` under a row that already read `baseten 0.4s · 64 t/s · $1.2/M · out ≤ 32k · 69%`. The same three numbers in prose, under a name the row had just said, one line further from the eye — and it cost the fold a row every time the cursor moved, on the one list where a row is a machine being compared against fifteen others. The only thing it added at the end was where the figures came from, which is one fact about the whole list rather than about the row the cursor happens to be on; the page that explains the ledger says it once instead. laneWhy goes with it. lineUnder keeps its other case — the line that stands where the providers would be when nothing behind a model has been measured. Co-Authored-By: Claude Opus 5 <[email protected]>
… are Asked what the difference between the two rows is, and the honest answer was "under the row you ship with, none that a request can see" — both send no provider choice. They differ in two ways nothing on screen said: auto starts choosing the moment routing is latency or price, and openrouter also stops codeaf buying a speed probe. So the rows say what they ARE now. `auto` is `codeaf tries to pick the best provider`, and under `simple` it carries `— not while routing is simple`, because a sentence true only on a setting most people have not got is a sentence that lies on the default install. `openrouter` is `default routing`. They stand beside each other above the machines instead of at either end of them. They are the two rows a person is choosing between, and telling them apart means reading them side by side rather than a screen apart. And the bullets go. `filled chooses for you, hollow declines to` is not true under `simple`, where neither chooses — a mark that is wrong on the default install is worse than no mark, and the indent already says these two are not machines. Co-Authored-By: Claude Opus 5 <[email protected]>
`→` on a model now opens two answers and nothing else: `auto`, which reads `automatic routing according to /settings (recommended)`, and `openrouter`, which reads `default routing`. `→` on `openrouter` opens the machines it routes to and walks the cursor in; `←` closes one level at a time. The machines live there because every one of them is a machine that row routes to — naming one is a narrower answer inside it rather than a third thing beside it. The machines are drawn as a table with their own heading, by the same engine as the model list: modelTable is colTable now, built over a column set, and laneColumns is the second set. A `·` tail put each provider's price wherever that provider's note happened to end. And they are drawn alphabetically. The ledger's own order — fastest first — is still what auto, bestLane and the model row's `via` read; the picker sorts its own copy after taking the prediction, because an order that moves whenever a belief updates is an order the eye has to start over on. The `auto` sentence stopped naming `simple`. It is a value of a `routing` setting that nothing on that screen mentions, and the owner — who owns the program — read the row and asked what it meant. Co-Authored-By: Claude Opus 5 <[email protected]>
The `openrouter` row said `default routing`, which described one of the things inside it rather than the row itself — so the sentence is gone and the answer is where it belongs: `default`, the last row after the machines, with empty cells. It is the same kind of choice as the machines above it — "serve this from here" — and somebody reading down that list should not have to leave it to pick the one that declines to pick. The cells are empty and honestly so: nothing has been measured about whichever machine the router feels like, because it is not one machine. `enter` on the container still writes the same thing, one press earlier. And the line about a model nobody has measured moved into that fold, where the machines would be — which is where a person went looking for them. The fold opens with nothing measured now; `→` on it used to do nothing at all, and `default` is always in there to be chosen. Co-Authored-By: Claude Opus 5 <[email protected]>
It closed on the press, which made every choice final and every comparison a round trip: pick a model, watch the list vanish, type /model again to see what the other one cost. The list is a table now — a thing built to be read down and compared — and a table that shuts the moment you touch a row is a table you can use once. So enter applies and leaves it up, and esc is the way out. Applying is safe to repeat: switching twice lands on the second, pinning twice writes the second row. All four doors moved together, because there is one list. The marks follow the choice (picker.restate). They stay snapshots against everything running underneath — that is what the freeze is for — but the person pressing enter is not running underneath, and a list still marking the model they had just left would be the one row on it that was false. The manual claimed esc gives the model in use back as it was. It does not any more: enter already changed it, and esc only closes. Co-Authored-By: Claude Opus 5 <[email protected]>
The `auto` row is `auto-route based on /settings`. And a table's column heads are painted apart from their cells. Both were dim, so `provider first t/s $/M` beside `cloudflare 0.8s 58 $1.3` was the same text twice — nothing on screen said the first line was the labels rather than a provider whose numbers had gone missing. They are muted now, and italic besides: the hue does the work on a colour terminal and the italic does it on one whose two dim tiers land close together. Muted and not ink, because a heading is read once and the figures under it are read every time; a head louder than its own column is a label shouting over the thing it labels. Co-Authored-By: Claude Opus 5 <[email protected]>
The picker's box carried a small query language beside the name search — `@cloudflare`, `<1s`, `>50t/s`, `$<0.3`, `fp8`, `tools`, `sees`, `draws`, and `fast`/`cheap` to reorder — and every one of those terms was asking about a FACT. The facts are columns now, so the question they answered is one a person can see the answer to, and a syntax nobody can discover is a feature only its author can use. So they are gone, not reinterpreted: `$<0.3` is looked for as a name, matches nothing, and the list comes back empty rather than quietly answering the old question. `sees` still finds deepseek-v4-flash, because those letters run through that id in order — and no longer because the model can see. `/model <one-word>` is always a slug now; the two-words-open-the-picker rule and `/model @name` are untouched. Typing inside an open provider fold still narrows that model's providers by name (#1022), which is a name search too. `app.setLevel` picks up the one door call that removing the grammar exposed: ctrl+t in the picker and home spending its draft's rungs were `SetReasoningFor` plus `keepLevel` written out twice, and the off-loop ratchet counts call sites. Co-Authored-By: Claude Opus 5 <[email protected]>
Two things the rebase onto dev made visible. The change entry was numbered 1106, which is somebody else's merged pull request — the wordmark (#1106) — so the one file whose whole job is to tell the next reader what moved was pointing at the wrong change. CI only checks that an entry was added, so nothing would have caught it. And `cmd/codeaf/models.go`'s comment still described the modality tail as `reads image, video · makes image`: the heads became `inputs`/`outputs` and the separator became a space two waves ago. The comment exists to say this line and the picker row have ONE spelling, so a stale example there is the drift it was written to prevent. Co-Authored-By: Claude Opus 5 <[email protected]>
ZeroPoint95
force-pushed
the
claude/model-selection-table-f6a1ba
branch
from
September 17, 2026 23:05
28c21cf to
04ee366
Compare
TestC9SourceBuildRefusesBeforeTheNetwork and TestC9AnInstallEndsWithTheNewBinarysVersionLine failed on every macOS laptop and passed in CI: `t.TempDir` answers under /var/folders/…, /var is a symlink to /private/var, and on Linux the two spellings are one. The product is right and is not touched. ExecutableTarget runs the path from os.Executable through filepath.EvalSymlinks on purpose — an installer has to replace the real file, and writing through a symlink replaces the link or lands somewhere nobody asked for. A test that hands that door an unresolved path and then demands its own spelling back is asserting the opposite of the law it is testing. So the path is canonical at its source: `updateTarget(t)` resolves the directory (the file does not exist yet, and EvalSymlinks needs what it is given to exist) and joins the name. All nine sites in the file use it, so the seven that do not compare paths today cannot start failing when they do. Co-Authored-By: Claude Opus 5 <[email protected]>
… openrouter TWO GESTURES SHARE ONE PAIR OF KEYS and position alone was the wrong way to break the tie. `→` and `←` were the tree's only at the very end and start of what was typed, so leaving an open fold cost one press per character in the box: with `deep` typed, `←` stepped through p, e, e, d while the fold stayed open. Time breaks it now as well. Somebody still editing is still pressing keys, so 600ms of quiet (pickerQuiet) hands the arrows back to the tree — chosen against typing cadence, which puts 100-200ms between keys, so it cannot land inside a word. The position rule is kept on top of it, which is what makes an empty box behave exactly as it always did. Coming back is any edit at all, and `ctrl+b`/`ctrl+f` are never the tree's, so they take the caret back without changing a letter of the query — the mode cannot trap anybody. The walk deliberately does not count: reading a filtered list must not quietly take the arrows away from the tree. And the decision is made by asking whether the text or the caret MOVED, not by keeping a second list of editing keys beside listNavigate's own switch. The foot now names whichever of the two keys actually works, because a foot saying `←` while `←` stepped through a word is what made the fold feel broken. Separately: enter on the bare `openrouter` row opens its list as well as choosing. It writes what it always wrote — the same answer `default` inside it writes, one press earlier — but shut, that read as "you have chosen openrouter", which sounds like a destination and hides that there was a list underneath. Open, the cursor lands on `default` wearing the mark and it reads as the true sentence. It needed no new state: marked already gave the container the mark only while shut, and cursorToMachine already walks onto the marked row. Co-Authored-By: Claude Opus 5 <[email protected]>
A paste reaches the filter box without going through picker.navigate, so the quiet window never saw it: text arrived and the box still read as untouched, which made a paste the one way to put characters in there that did not count as typing them. `←` straight after would have gone to the tree. picker.pasteFilter is the one door clipboard text now takes into either picker's box — chat's and the settings panel's — and it stamps. It also owns the insert-then-rank pair those two sites were each writing out, which is a pair that only has to be forgotten once to leave a filtered list showing rows the query excludes. Opening the list with a query already in it deliberately does NOT stamp. `/model deep flash`, and home's and a room's same command, finished the query before the list existed — the hands were never at this box — so the arrows are the tree's on the first frame, which is the whole reason that door exists. Co-Authored-By: Claude Opus 5 <[email protected]>
foldHere asked whether the cursor was on a row inside the open machines with `row.lane >= 0` — which is every real machine. `default`'s lane number is negative, like the two container rows' are, so it was missed when `default` stopped being a note beside `openrouter` and became a row under it: `←` there shut the model's whole fold instead of just the machines, and the way in and the way out were different lengths. Found by checking the press that follows the gesture in the commit before this one. `enter` on `openrouter` now lands the cursor on exactly that row, so `←` is what a person does next — the skip was reachable by the most likely route to it. Co-Authored-By: Claude Opus 5 <[email protected]>
A table makes a screenful comparable by eye. Over six hundred rows the eye is not enough and ordering by the column is the only thing that is — so `alt+s` walks the columns and `alt+shift+s` turns one round, which is the tasks place's own pair of chords, read in picker.foldKey so all four doors get them. A chord rather than a bare `s` for that page's reason: `s` is one of the commonest letters a filter starts with. This is also where the filter box's `fast` and `cheap` went. The objection to them was never sorting — it was that a word typed into a name box is an undiscoverable way to ask for it, and that two words were two opinions about six columns. Four laws, three of them found by trying it against the real catalog: `list` is IN the cycle, because it is the name search's own best-match order. A sort you cannot undo would throw that away for the life of the list. A column this list published nothing in is SKIPPED. With nothing measured there is no `first` and no `t/s`, and the second press of the key moved no row and painted no arrow — indistinguishable from a broken key. Rows that published nothing sort LAST both ways round. A model with no price is not the cheapest, and turning the column round must not make it the dearest: it is out of the comparison. The `cheap` word this replaces got that right in one direction only, by calling an unknown price infinity. The cursor lands on the TOP, not back on the model in use. Reversing a column looked like it had done nothing, because rank() was pulling the cursor to the current model and the window stayed around it — showing somebody who asked for the cheapest model their own row's neighbourhood. And the arrow is MEASURED, not appended: colTable.fit takes it, so the column is two cells wider rather than the block being pushed past the measure and dragging every right-aligned row under it. picker.measure splits out of tableFit for the same reason those were never one question — the measurement is over the rows and the fit is over a width, and the cycle needs the first without the second. Co-Authored-By: Claude Opus 5 <[email protected]>
ZeroPoint95
marked this pull request as draft
September 18, 2026 01:56
Four things, and a fifth the first of them broke. EVERY COLUMN IS TWO RUNGS — its own direction, then reversed — so alt+s alone reaches every order a table has. alt+shift+s retraces the cycle instead of meaning "reverse", which is what it meant while a column was one rung. Walking back off the first column wraps to the last, which is where walking forward came from; it was jumping to the last SORTABLE column from anywhere, so the two directions were not each other's opposite. EVERY TABLE IS ALWAYS SORTED and always shows its arrow. tableSort's zero value is each table's first column — the name — ascending, so there is no unsorted state to explain. THE PROVIDERS SORT TOO, with their own tableSort and their own arrow, and the key orders whichever table the cursor is in — the rule the fold's other keys already follow. The two orders are independent. note and last 8 do not sort: a note is whichever ONE thing is worth saying about a lane, so ordering by its text would rank "bad replies" against "tail 3s" alphabetically, and a sparkline has no single value. `up` STANDS BEFORE `note`, in laneColumns and laneCells together. Uptime is a figure and reads down its last digit with the figures before it; prose in the middle of a run of numbers breaks the run. It is the drop order too, so a narrow fold keeps the comparable figure over one row's own caveat. And the fifth: AN ALPHABETICAL DEFAULT BURIED THE BEST MATCH. `gpt` answered anthropic/claude-gpt-echo before gpt-5-classic, which is the search itself going wrong rather than a matter of taste. The name column reads queryScore first while the box has text and is alphabetical inside a tier; with an empty box every score is equal, so the arrow still means the whole column. Ten existing tests encoded the catalog's order while testing something else. Most now look their row up by name rather than by index. One was a real conflation: chatOnly stood for both "which models pass the chat question" and "what order a picker shows them", which made a sort look like a filter regression, and is two slices now. Co-Authored-By: Claude Opus 5 <[email protected]>
THE FOOT READS THE SAME WAY AT EVERY LEVEL: ↑↓ pick · ← back · → providers · alt+s sort · enter <verb> · ctrl+t effort · esc grouped by what each key MOVES. The first two move the cursor — walking out of a fold is a cursor move, so `← back` belongs beside the walk rather than stranded on the far side of the only key that commits anything, which is where it was. The next two change the list. Then enter, where the eye stops. Then ctrl+t, the one key here that touches neither the cursor nor the list: it dials a setting on the row and leaves everything as it was. Home says `enter choose` now. Every other row of the same fold already said choose, so `use it` was a second word for one gesture on one rung of it. Two things the ordering pass exposed. The `openrouter` row did not name `→ providers` when nothing was measured, though the key worked — the hint still asked for a believed machine, which stopped being true the moment `default` became a row inside that fold. And a machine's row did not name the sort, though alt+s orders the providers from in there. Pinning a model at home no longer writes a line under the box. It read `model · <name> · for the next conversation you start here`, and the rule above the box already carries the pinned model — for as long as the pin lasts, rather than until the next note replaces it. And the `/model` a person typed stays in the box as the chip it was, with the filter after it: `› /model filter by name`. The list is a different editor from the one the command was typed into, so those words vanished from the one line they were looking at and left a `›` and a grey phrase that could have belonged to any list on this surface. draftBlockFull is the one function all four box shapes go through now, and the tack's width is paid by head — so the wrap room, the caret column and every continuation row's indent follow from it without anything downstream knowing a tack exists. It still fits whole at sixty cells. Co-Authored-By: Claude Opus 5 <[email protected]>
…y tie Two reasons the sparse columns did not behave. THE SORT ASKED THE WRONG LANE. pickerRankOf read bestLane — the quickest-feeling lane the ledger holds — while the `via`, `first` and `t/s` CELLS come from the lane the row NAMES: the pin, or the chooser's answer, or nothing at all under a routing row where codeaf does not choose. So a row whose cells were blank still carried real numbers into the sort, and the blanks did not land together. modelLaneReading is that one reading now, asked by modelFactsOf for the cells and by pickerRankOf for the order, with the pin read for the row in use alone exactly as the cells read it. AND THE TIES WERE LEFT TO CHANCE. A sparse column leaves a whole block of rows it cannot tell apart, and a stable sort leaves that block in whatever order the rung before it produced — so the same press drew a different screen depending on how it was reached, which reads as the sort being arbitrary at exactly the place a person is least sure of it. The name breaks every tie now, so the blanks come back alphabetically and a second press draws the same screen. tableColumn.words marks the columns holding names rather than figures. `via` is the only one, and it needed saying on the COLUMN: a pair that both published nothing fell past the name test and was compared as zeroes, which is one rule for the column and a different one for some of its pairs. Co-Authored-By: Claude Opus 5 <[email protected]>
ZeroPoint95
marked this pull request as ready for review
September 18, 2026 13:08
AbirAbbas
added a commit
that referenced
this pull request
Sep 18, 2026
…1195) modelConnectionStatus renamed every custom-id row to the connection's Written word, and the catalog template's Written is the bare id, so a person who had connected nothing yet saw `custom` where the manual, the README and #1107 say `Custom OpenAI-compatible API`. Only a connected instance is called what the person called it now; the contract test draws both rows and is red without the fix. Found verifying the staging build of #1194. Co-Authored-By: Claude Fable 5.1 <[email protected]>
dev landed the crew family, the Model Pool and custom model connections, so `/model` now draws a dim heading per service over the rows it holds. The one conflict was the hint grammar's table — both sides had rewritten the picker's foot — and the merge surfaced one real defect: the sort ignored the service groups, which moved a lonely connection above `openrouter` on a column it had published nothing in, and would have drawn one heading twice. The service order is the outer key of every sort now, so a column orders the rows inside a service and never the services; and `pickerRankOf` reads a price as both halves or neither, the way the cell does, so half a price sorts with the blanks rather than among the cheap rows with an empty cell. Co-Authored-By: Claude Opus 5 <[email protected]>
…ares dev's #1321 moved every quick-search list onto internal/fuzzy — an fzf-style alignment, higher score better — and reworked the picker's ranking around the lane grammar this branch deletes. Both halves land: the matcher is dev's, the decision about what the box means is this branch's. So the picker's own three-rung ladder is gone (queryScore, tokenScore, subsequenceAt and the rung constants) rather than merged back — the bonus model puts a prefix above a substring above scattered letters without tiers to hold it there — while splitQuery, keepsLanes, orderByLanes, bestOf, lanePrice and laneTermWord go with the grammar they served. The words are folded before they become terms, because every model id is lowercase and the matcher's smart case would pin `GPT` to bytes no id carries. picker.sortHits reads the score the new way round, biggest first. The emphasis dev added rides along: rowHit draws the matched letters in bold, and the sort key still orders whatever the search kept. Co-Authored-By: Claude Opus 5 <[email protected]>
Collaborator
|
Drove this in a real terminal against a throwaway home with a live catalog, at 140 and 80 columns, and everything the description claims holds up: the headed table, Three things I would like fixed before it merges, all small:
Not blocking: the settings sheet's foot never names Also: dev moved under you this morning (#1108 landed), and this branch now conflicts in |
…ying Review on #1107 found three: The task composer's `alt+o` list drew the headed table with an arrow on `model` and swallowed the chord that moves it — composerPickKey handed every key to the walk and never read the list's own key map. The other three doors read it. The settings panel's slot row answered the chord all along and its legend never said so, and the composer's foot did not either; both spell it from sortKeyWord now, so one chord has one name. commands.md said a plain text chat model "says `text` under both" columns. The renderer skips text on both sides, so that cell is always empty — and this is the page the in-product model answers "what do these columns mean" from. models-and-cost.md and palette.go's own header still said esc gives the model in use back. Enter commits when it is pressed; esc only closes. A section is retrieved alone, so the stale one was served by itself. Not blocking but in the same pass: the cycle block had lost the `out/M` rung its own prose names, and docs/MULTIMODAL.md still promised the `sees · draws` tail. Co-Authored-By: Claude Opus 5 <[email protected]>
ZeroPoint95
enabled auto-merge
September 21, 2026 16:25
Collaborator
Author
|
recheck |
AbirAbbas
approved these changes
Sep 21, 2026
AbirAbbas
left a comment
AbirAbbas
left a comment
Collaborator
There was a problem hiding this comment.
Re-verified 2026-09-21 after the review items were addressed: each item checked in the code and on the built binary, gates green locally and in CI at this head. Details in the review ledger.
santoshkumarradha
added
the
area:chat
santoshkumarradha
added a commit
that referenced
this pull request
Oct 24, 2026
dev carries #1332, #1108, #1333, #1107, #1208, #1071, #1376, #1377, #1381, #1385, #1386, #1387 and #1384. #1108 is the santos/dev slice held at 759d704, which dev2 already descends from, so the tree was merged against 759d704 as its base: the slice counts as already here, and only what dev did beyond it is brought in (the nested-module walk, the image guard's duplicate, and everything from #1333 on). The commit still records origin/dev as its second parent, so a dev2 to dev pull request sees dev as merged. Four files conflicted: - tools_image.go: both sides restored the empty-prompt guard; dev2's comment kept, and dev's second copy of the guard's test dropped because #1372's test pins the same refusal. - surfacedoors_law_test.go: dev2 added one ledger door and #1071 crossed workingNowAgent; the ratchet counts the merged ledger, 22. - tui_e2e_test.go, tuiwords_test.go: the home that #1071 draws is the one in the tree (dev2 never redrew home after the slice), so the suite waits for #1071's words.
santoshkumarradha
added a commit
that referenced
this pull request
Oct 25, 2026
* tui3, config: the gate row lands on the conversation you are in, and /status names the gate (#1063) The three Safety rows — `ask before running`, the tool exceptions and the shell command rules — wrote the profile and left the running gate alone, while the YOLO badge read that profile live. So the badge and the gate disagreed in both directions: `allow` lit the badge over a gate that kept asking, and `prompt` put it out over a gate that was still wide open, which is the false-safety claim #322 and #325 exist to prevent. `applySetting` now pushes those three rows through `ApplyApprovals` — the seam /permissions already drops a banked rule through — and refreshes the badge on the same keystroke, on the branch where the push landed. A rebuild that could not be done is said out loud on the panel's foot line in /permissions' own words, `saved · from the next session`, and the badge stays with the gate in force rather than following the file. And /status carries the posture it never carried: `approvals prompt`, `allow` or `deny`, in the `ask before running` row's own words, in the note, in --json and on the phone's status sheet, from the one posture reading the badge uses. The status row keeps its negative-space badge and the segment is no longer written into the page twice. The note's label column is measured from the widest label it carries, so three crew assertions that spelled `"\ncrew"` plus exactly five spaces were assertions about every other row on the page. They read the crew line by its label now. Co-authored-by: Claude Fable 5.1 <[email protected]> * attribution: the footer names CodeAF, and still links to agentfield.ai (#1075) * attribution: the footer names CodeAF, and still links to agentfield.ai The pull request, issue and comment footers read "Drafted with agentfield ai". They now read "Drafted with CodeAF"; the link, its utm parameters and the "reviewed and owned by the author" tail are unchanged. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01GNBScbyNAbbEQ5jn9G6auy * docs: the change entry for the CodeAF footer Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01GNBScbyNAbbEQ5jn9G6auy --------- Co-authored-by: Claude Opus 5 <[email protected]> * session, prompt, tui3: a wrong completion check is answered with [no change], and the answer stands (#1065 round 1) (#1067) * session, prompt: a wrong completion check is answered with [no change], and the answer stands (#1065 round 1) The end-of-turn reader saw 600 bytes of the last message, so a long table read as cut off; the carry-on told the model to explain itself, and the explanation became the only answer left in view under the fold. The reader now sees up to 8 KB of the last words, and a cut it still has to make ends with `[clipped by codeaf: N of M bytes]`, which its ask says is never evidence of a cut-off answer. The carry-on lead says who wrote the note and offers one exact reply, `[no change]`: it ends carrying on for the ask without another reading, the transcript keeps it for the model, and neither replay nor the live feed draws it — so the settled answer before it is what the fold finds. system.md trades `# Tone` and `# Delivery` for `# The answer`, `# Words or work`, `# When corrected` and `# Messages from codeaf`, and the two lines that pushed action on questions are qualified. The lean page keeps all four; the prefix waivers rise by the 1,705 bytes that cost, dated and named. Co-Authored-By: Claude Opus 5 <[email protected]> * docs: the change entry takes the pull request's own number Co-Authored-By: Claude Opus 5 <[email protected]> * session: a quiet landing is asked about the notes it was handed, not the page that names them The worker's system page now names [silent] and [stuck] under `# Messages from codeaf`, so a search of the whole request found the tag on the page. childWasHanded reads the conversation and leaves the page out. Co-Authored-By: Claude Opus 5 <[email protected]> * session, prompt: [no change] answers the note it follows, and a long ask leaves the last words cut by name (#1065 round 1) Self-review of #1067 found the token honoured on the wrong replies. The gate read the turn's carry-on count, so a model that made calls in answer to the note and then said [no change] ended the turn unread on an answer those calls may have made stale, and a token after a load or ask nudge counted too. It now reads the transcript: the token must be the very next reply to the reader's own lead (answeredNoteUnchanged), and the dead declined flag is gone. An ask up to the whole digest rides in its head, so eight kilobytes of last words behind a long ask reached the backstop clip and ended in a bare `…`. checkpointClipSaid takes the room that is left. A turn that ends on the token no longer starts the route judge or hands the token to the memory reflex, and a later reading's last words skip it. `# Messages from codeaf` named `[still asked]`, which only the reader ever receives, and left out `[stuck]` and `[held]`, which the conversation does; it now names the tags that arrive and says any other opening, such as `[image #1]`, is the person's. The waivers sit on the measured 1,779 bytes, and the manual and the change entry say what the gate actually honours. Co-Authored-By: Claude Opus 5 <[email protected]> * prompt: the new sections keep the rules the old two carried, and say what stays in view (#1065 round 1) Owner review of #1067. Replacing `# Tone` and `# Delivery` had dropped five rules; each is back inside the new sections: match the person's task and vocabulary, choose the safe option under uncertainty, evidence and blocking details complete, never a compiling scaffold or a narrowed test, never half-solved work. `# The answer` said only the last message reaches the person, which `# Planning` contradicts: the plan and the per-batch sentence are shown while a turn runs. It now says that once a turn ends only its last message stays in view. `# Words or work` sat beside `## Work or words`, which spends the same two words on hand-off sizing; it is `# Answer or change`, and it says an answer asked for in chat is written in the reply, not a file, unless the person asks for one. The waivers sit on the new measurement, 2,035 bytes over dev on both arms. Co-Authored-By: Claude Opus 5 <[email protected]> * prompt: the messages-from-codeaf list names every note codeaf writes The system prompt now distinguishes conversation user-role notes from private reader and tool-result markers. A structural test follows the production constants, and the byte waivers record the exact fixed and lean measurements. Co-Authored-By: Claude Fable 5.1 <[email protected]> * session: no change skips judgment only when it answers the reader The completion loop now uses the transcript context before suppressing the route judge or substituting the prior answer for memory. Tests cover the withdrawn and ordinary-token memory paths, and the manual separates counting from display. Co-Authored-By: Claude Fable 5.1 <[email protected]> * test: the model stub replays the no-change fold The OpenAI-compatible stub can now drive the real binary through eleven read rounds, a long table, a rejecting reader, and the exact token reply. The recipe records the tmux setup and the expected log and screen evidence. Co-Authored-By: Claude Fable 5.1 <[email protected]> * prompt: the standing-news tag stays with the event, not on the page The messages-from-codeaf list had named [something you set up fired], and TestTheSteeringLineReadsAsNewsAndNotAsARequest refused it: that line says under the news itself what it is and what not to do about it, so the page's copy is one law bought on every request of every turn for a turn most sessions never have. The list keeps the compaction tags, the structural test now files the standing frame with the private voices the page must not name, and the waivers fall to the new measurement (fixed 55,280, lean 47,055). Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Opus 5 <[email protected]> Co-authored-by: Abir Abbas <[email protected]> * Clean internal experiment records and revive test/ux for codeaf (#1068) * chore: clean internal experiment records and revive test/ux for codeaf Public-repository cleanup ahead of opening the docs to outside readers. - Remove four internal DOE/experiment record directories that reference private issue and pull-request numbers and are not current-product documentation: docs/design/pin-doe, plan-gate-doe, turn-wall-share-doe, and workspace-foundation. - Neutralize internal machine references in benchmark and design docs: the bench host ("spark"), its secrets.env path, and a personal working branch name, all now generic placeholders. - Revive test/ux/, the user-facing journey suite, for the renamed product: collapse the removed v1/v2 dual-surface logic into the single v3 surface, repoint the binary to cmd/codeaf and state to ~/.codeaf/CODEAF_*, and delete gate.sh whose premise was the v1-vs-v2 parity table. Co-Authored-By: codeaf <[email protected]> * chore: drop internal conversation-runtime wave records, keep the measurement contract The conversation-runtime directory was a local development wave: day-by-day status, /private/tmp paths, "owner authorized" process notes, draft PR numbers, and local change logs. None of it is current-product documentation a public reader needs. Keep PARETO.md, which is the benchmark's cited measurement contract, trimmed of its dangling calibration link and owner language. Co-Authored-By: codeaf <[email protected]> * chore: neutralize the remaining bench-host and work-machine references A wider sweep found the internal bench host ("Spark"), its secrets path (fleet/secrets.env), and a scratch ops directory still named in live docs, bench READMEs and bench scripts that the earlier redaction had not touched. Rename the host to "benchhost"/"the bench host", drop the secrets path, and replace "the laptop" as the owner's own machine with a neutral "work machine" where it meant the internal one. The manual's first-person "the laptop you are sitting at" is public-facing and left alone. Co-Authored-By: codeaf <[email protected]> * chore: fix review findings in the public-cleanup diff - PERF.md: drop a private tracker issue reference (#846). - PARETO.md: restore a complete sentence dropped when the calibration link was removed, and align tense with the remaining present-tense claim. - home-mission-control/DESIGN.md: drop the internal "fleet" system name and an owner-framing phrase, consistent with the secrets-path scrub elsewhere. Co-Authored-By: codeaf <[email protected]> * docs/design: the two records live code still cites stay in the tree plan-gate-doe/REPORT.md is the measured evidence behind the plan-gate default that twelve comments in cmd/codeaf, internal/config, internal/session and internal/splitgate point at, and turn-wall-share-doe is the run internal/session/turnwall.go says it was added from. CLAUDE.md keeps the record on purpose for exactly this reason, and neither folder names a machine, a secret or a private address. Co-Authored-By: Claude Fable 5.1 <[email protected]> * test/ux: the revived journey suite goes back out #991 removed it because it drove the v1 and v2 surfaces, and the revival did not change that: its journal verb reads graph.db tables (messages, nodes, usage, commands) that the v3 chat never writes, lib.sh still waits for the resident, nothing runs it from the Makefile or a workflow, and its only evidence was bash -n. docs/JOURNEY.md says internal/e2e is the one suite that drives the binary, and that stays true. A suite that has been run green against bin/codeaf can come back on its own pull request with a target that runs it. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: entry for #1068 Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: the #1068 entry says why the journey suite is out, correctly The first draft said the v3 chat never writes the graph.db tables the suite reads. Running the suite showed both message rows landing, so that sentence was wrong; what is true is that nothing runs the suite, it had never been run, and its first journey fails on its first screen check (#1072). Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: codeaf <[email protected]> Co-authored-by: Abir Abbas <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]> * session: task commits are authored by the bot account, not codeaf@localhost The author codeaf stamped on the commits it lands was `codeaf <codeaf@localhost>`, which no GitHub account can link, so every branch codeaf landed failed the CLA check. It now writes `codeaf <[email protected]>` - the identity the Co-Authored-By trailer already used - and keeps `codeaf@localhost` and `aforge@localhost` recognised as legacy by taskCommitIdentity. GLM 5.3's review caught an unmarked retired name in permissions.md that reddened the namelaw gate, and seven stale test fixtures; both fixed. Laws gate, session, exec and cmd are green. Co-Authored-By: codeaf <[email protected]> * README: show the pinned-version install line the release test requires (#1103) * README: show the pinned-version install line the release test requires The Install rewrite dropped the VERSION=<tag> pin example, and TestPublishedPinExamplesGiveVersionToBash reads every published install surface for `| VERSION=` because `VERSION=<tag> curl ...` is an easy mistake to copy — it sets the variable for curl instead of the install script. The pin goes back inline on the same host the section already uses, with the releases page still linked for tags. Co-Authored-By: codeaf <[email protected]> * docs: the change entry for the README pin example Co-Authored-By: codeaf <[email protected]> --------- Co-authored-by: codeaf <[email protected]> * telemetry: anonymous usage counts, off with CODEAF_TELEMETRY=off (#1095) * telemetry: the package behind anonymous usage counting, per the wire contract Four typed events (first_run, session_started, session_ended, fault) with the contract's allowlisted, bucketed props; the opt-out ladder with its off reasons; a hashed install identity at 0700/0600; a fault fingerprint over codeaf function names only; a JSON-lines spool with a deadline-bounded flush of up to 50 events per POST, 7-day age drops and a 1000-line cap; the notice constant with NoticeShown/MarkNoticeShown gating the flush; and Show() for a future codeaf telemetry show. A library only: nothing in cmd/codeaf, internal/session or internal/config reads it yet. Co-Authored-By: codeaf <[email protected]> * telemetry: tests, doc, and contract fixes for the usage-count package Adds the package's tests — bucketing edges, the opt-out ladder, install identity, the notice, fingerprinting, the spool against an httptest relay (cap, age drop, 50-per-POST splitting, a hard deadline against a hanging server, silence on failure) and the privacy law that no sentinel string reaches the wire. docs/TELEMETRY.md documents the notice, what is sent and how to turn it off, with a test that fails if the doc's property table drifts from the Go allowlist. Fixes four drifts from the wire contract found running those tests: the <1m duration bucket was missing, the fingerprint's argument stripping cut too much, the rc channel suffix must be a single integer, and under go test a config-off rung outranks the test rung in the reason reported. Co-Authored-By: codeaf <[email protected]> * telemetry: fix review defects 1-8 with tests Fingerprint stability (last-( cut, .go:/main./created-by frame rules), counted-batch flush, guarded and multi-process-safe spool, BucketDuration edges, Configure-gated write paths, O_EXCL install id, install.json preservation, buildinfo.Dirty accessor. Co-Authored-By: codeaf <[email protected]> * installer: record the install locally and print the telemetry notice Following the telemetry wire contract: a successful install now writes telemetry/install.json under the state root (dir 0700, file 0600) with the install method, channel and UTC timestamp, leaves any existing install_id alone, and makes no request the download steps did not already make. At the very end the installer prints the contract's notice to stderr after one blank line, or one line saying telemetry is off when CODEAF_TELEMETRY/DO_NOT_TRACK opts out. README gains a plain Telemetry section pointing at docs/TELEMETRY.md, and a new test/installer-telemetry.sh proves the marker, the notice and the opt-out without a network. Co-Authored-By: codeaf <[email protected]> * installer: four review corrections to the telemetry commit The review of 71ff95a6b found four things. Revert the one line that changed `if [[ -z "${TAG:-}" ]]; then` back to `${TAG:-}`: under set -u an unset TAG must reach api_problem, not crash. In write_install_marker the channel lands in JSON verbatim and CHANNEL can come from the environment, so only stable, rc, staging or dev is recorded and anything else becomes "unknown" — with test cases for a valid channel and for we"ird, both asserting the marker parses (python3 -m json.tool, or jq, else a strict channel check). Fence the README Telemetry notice in a ```text block so Markdown keeps its alignment, wording byte for byte. Clear the two shellcheck findings in test/installer-telemetry.sh with one block disable for SC2016/SC2034 — ok() evals those strings, so the quoting is deliberate — and export CODEAF_TELEMETRY/DO_NOT_TRACK where a subshell needs them, without weakening any assertion. Co-Authored-By: codeaf <[email protected]> * release-downloads: daily PostHog report of public GitHub release download counts A scheduled workflow reads the repository's releases from the public GitHub API and sends one codeaf:release_downloads event per binary asset (codeaf-<os>-<arch>[.exe]) — sidecars like checksums.txt are not reported. Each event carries release_tag, channel (stable or the prerelease suffix), prerelease, os, arch, the cumulative download_count and the UTC snapshot_date; the event id is derived from tag, asset and date, so a same-day rerun deduplicates instead of counting twice. No code in the binary; counts come only from public release data. Co-Authored-By: codeaf <[email protected]> * release-downloads: tests cover the workflow, docs and pagination The dry-run unittests now also assert the identifiers the wire spec spells out where the script and the workflow spell them: the schedule, dispatch, contents-read permissions, built-in token, project-key secret and host variable in .github/workflows/release-downloads.yml, the public-data paragraph in docs/rules/promotion.md, stdlib-only imports, pagination across API pages, the host override and the /batch/ endpoint, sidecar skipping, draft skipping, and the channel words stable, rc, dev and staging. Co-Authored-By: codeaf <[email protected]> * release-downloads: four review corrections to the script Channel detection now follows the tag grammar in cmd/codeaf-release/version.go: stable, rc, dev and staging tags match their four patterns and anything else reports "unknown", so dev-20260917-09299019bcdc is no longer mislabelled "stable". --dry-run works without CODEAF_POSTHOG_PROJECT_KEY, the local and test path: the batch prints with api_key "<unset>" and exits 0, and only the sending path stops with the notice. Every event carries "$geoip_disable": true next to "$process_person_profile": false, since the sender is a CI runner whose location is meaningless. The module docstring now names release-downloads.yml, the file that exists. The fixture holds one tag of each shape plus an unrecognised one, and the tests assert the channel for each, including the two real dev and staging tags. Co-Authored-By: codeaf <[email protected]> * release-downloads: test runs on Python 3.9 too ScriptSourceTest read sys.stdlib_module_names unguarded; the attribute arrived in Python 3.10, so the suite errored on macOS stock python3 (3.9.6). Guarded with getattr so the pinned import-set check stands on its own where the attribute is absent; 32 tests pass on 3.9, 3.10 and 3.14. Co-Authored-By: codeaf <[email protected]> * installer telemetry: the notice is read from docs/TELEMETRY.md The test read .telemetry-contract.md, a working note that is not in the repository and never will be, so it aborted with "telemetry contract is missing" in a clean checkout. It now extracts the fenced block under "## The notice" in docs/TELEMETRY.md — the same bytes as the Notice constant in internal/telemetry/notice.go — and holds the installer's TELEMETRY_NOTICE to it as before; a new assertion holds the README's telemetry fence to it too, byte for byte, so the invariant the suite existed to guard now has its third leg. Comments in scripts/install.sh, internal/telemetry/telemetry.go and this test now name docs/TELEMETRY.md as the source of the notice. No Go code changed and no Go tests were run. shellcheck is clean; the suite's 33 passing assertions include the two new notice checks, and the same two stat(1)-related assertions that already failed on this GNU machine before the change still fail with identical output. Co-Authored-By: codeaf <[email protected]> * release-downloads: the download-counts paragraph lives in docs/TELEMETRY.md docs/rules/promotion.md was the only home the paragraph had, and it came with a fallback pinning the branch to the state before the telemetry doc existed. The paragraph moves, byte for byte, into docs/TELEMETRY.md as a final "## Download counts" section beside the rest of the telemetry story, and promotion.md returns to its origin/dev content, so this branch now touches no release docs. test_no_telemetry_doc_on_this_branch asserted docs/TELEMETRY.md did not exist and is deleted. The two tests that read the paragraph read it where it now lives: both require a "## Download counts" section in docs/TELEMETRY.md naming .github/workflows/release-downloads.yml, scripts/release_downloads.py and the checksums.txt sidecar, and the promotion.md fallback is gone. No Go code changed and no Go tests were run; the property table in docs/TELEMETRY.md is untouched. The suite passes: 31 tests, OK. Co-Authored-By: codeaf <[email protected]> * installer telemetry: the mode check asks GNU stat first On Linux `stat -f` succeeds and reports the filesystem, so the BSD-first order never reached the GNU form and both permission checks failed. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01CqfhxLrrBNQxwPNvEgoBGR * telemetry: refuse to send to the production relay from a test binary Co-Authored-By: codeaf <[email protected]> * telemetry: testHome points the endpoint at a dead loopback Co-Authored-By: codeaf <[email protected]> * telemetry: the orphan-adoption test names the dead relay it now gets Co-Authored-By: codeaf <[email protected]> * telemetry: a test pins that no test binary reaches the production relay Co-Authored-By: codeaf <[email protected]> * telemetry: three tests pin the test-binary relay refusal Each asserts through real calls, not a re-implemented effect: the newRelay override lands after testHome and a flush reaches that recorder; a default-endpoint flush is refused like a dead relay (zero round trips, event still spooled); forcing the ladder on cannot reopen the path. Co-Authored-By: codeaf <[email protected]> * telemetry: allocation-free session counters Snapshot returns the SessionStats fields the SessionEnded constructor takes, so the wiring hands the struct straight over. Cost is stored as integer micro-dollars and divided back once, in Snapshot. Count* never ask whether telemetry is enabled and never allocate. Co-Authored-By: codeaf <[email protected]> * telemetry: gofmt the counters test One alignment fix in the many-goroutine test; no behaviour change. Co-Authored-By: codeaf <[email protected]> * config: telemetry setting row (CODEAF_TELEMETRY) Key "telemetry", on|off, default on, env pin CODEAF_TELEMETRY, in the interface group beside the history row. TelemetryAtIn walks the ladder — pin, project file, profile config, default — and TelemetryOffReason answers whether config turned the pipe off and names which rung did. The row sits in ProjectKeys so a repository may answer for itself. Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: the telemetry command, and the setting it writes Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: session lifecycle events at execute (work in progress) Configure, notice, first_run and session_started at the start of every session command, session_ended and a one-second flush at its exit. The end event does not yet carry the session counters. * provider: count answered model calls and their spend at the log door * session: count sealed turns and executed tool calls * cmd/codeaf: the session-ended event carries the run's counters telemetryEnd builds the end event from telemetry.Snapshot so turns, model calls, tool calls and cost reach the spool; the stop-reason switch becomes a map over the exit ladder; and both lifecycle constructors are gated on the ladder being on so a disabled run touches no state. Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: the counters test says the tally is process-wide The exact turn, call and cost assertions hold for one run of the package; a repeated run counts into the same atomic tally again. Co-Authored-By: codeaf <[email protected]> * guard: a fault hook Recover calls, for a reporter above this package Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: the fault event at both crash sites, off the current session Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: a test that the crash site spools a fault and not the panic text Co-Authored-By: codeaf <[email protected]> * docs: finish the anonymous usage counts contract and add the 1095 changelog entry * guard: the fault hook sits behind an atomic pointer A goroutine recovering a panic read the hook while a test on another goroutine wrote it, which the race detector reported. SetOnFault stores it once; Recover loads it. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: a task's interrupt word comes from the signal, not the cancelled context stopSignals cancels the signal context at the end of every errand, so the flag read from its Err said interrupted for a run that finished cleanly. Co-Authored-By: Claude Fable 5.1 <[email protected]> * tui3, installer: the telemetry row has a tab, and a custom install writes no marker TestEverySettingRowHasATab wants every registry row on the settings panel. TestCustomInstallOutsideTheStateRootDoesNotRunAdoption wants an install outside the state root to leave the login's state folders alone, so the install marker is written only when the root exists or the install is in it. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: the counters test zeroes the process tally first Other tests in the package drive model and tool calls through the doors that count, so the exact bands held only when the test ran alone. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: the version test drives the telemetry lifecycle, not execute execute starts writers under the state root that outlive the test, and the temp dir's cleanup raced them. The lifecycle alone is what the test pins. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: gofmt the lifecycle test Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: codeaf <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]> * session: the carry-ladder fixtures wait for the mark's drawing, not race the scheduler (#1104) * session: the carry-ladder fixtures wait for the mark's drawing, not race the scheduler TestASuccessfulHandoffJournalsTheRungThatSuppliedTheBrief failed once in a full make check at line 118: the worker's brief was the running model's draft, not the mastermind's written handoff. THE CAUSE IS NOT A STOLEN STEP. Reproduced under load (60 CPU burners, the fixture run 1500 times), every request the fixture makes is either the turn's own or one the aside answers: the queue carries only `round`, `draft` and `writer`, and the errands beside the turn (title, namer, the mark's drawing) never touch it. What moves is the ROUND COUNT — 41 to 54 across the runs — because the mark's drawing is a sidecar (sidecar.go) whose landing the scheduler places, and the turn is never held for it. On a busy machine the turn runs its rounds off faster than the drawing's goroutine is scheduled onto a core, the gap between the net firing and the drawing landing outruns the slack the script carries ([checkpointSlack] says so in its own words), the writer's ask lands PAST the end of the 53-step script, the scripted completer answers it with its past-the-end line `(unscripted)` — which is not prose — the handoff rung reads degenerate, and the carry ladder falls onto the draft. That is #392 exactly, one mechanism along. WHAT FIXES IT IS WAITING FOR THE READING. checkpointAgent now puts a watch on the turn's own context ([watchReadings]) and the handover fixtures submit through [watchedContext], so [answerWhenQuiet] holds each request that carries the belt until every reading beside it has landed — the order a real turn has, where a real model spends seconds on a step and the small readings land inside it. The gap is then one boundary whatever else the machine is doing, and a script long enough to cross the mark is long enough. THE REGRESSION TEST holds the drawing back by a fixed wall time — standing in for a scheduler that does not reach it in time — and insists on the behaviour: the turn does not spend its script racing the drawing, and the writer's rung still supplies the brief. It fails without the watch (the turn makes 54 rounds) and passes with it. Co-Authored-By: codeaf <[email protected]> * docs: the change entry for the carry-ladder drawing race Co-Authored-By: codeaf <[email protected]> --------- Co-authored-by: codeaf <[email protected]> * docs: the install proxy is live, and the manual says so (#1076) * docs: the install proxy is live, and the manual says so `https://agentfield.ai/get/codeaf` has served `scripts/install.sh` since 2026-09-16, the day the repository went public, so the compiled-in manual and docs/GUIDE.md stop saying it is "not serving yet" and stop calling the repository private. The proxied line goes first, as the README already has it; the raw GitHub line is described as the script under it. Both pages say to pipe into `bash`, not `sh`, because the script uses pipefail and `[[ ]]` and dash rejects them, and both state the channel path (`/dev`, `/staging`, `/rc`) beside the flags. The manual also says what the proxy refuses: a script without its channel line exactly once, or a body that is not a shell script, is a 502 rather than the wrong thing. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: entry for #1076 Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Fable 5.1 <[email protected]> * A launch says a newer codeaf is out, and /update installs it and restarts (#1060) * The release-tag grammar has one home, and it is internal/update Stable, rc, dev and staging tags are parsed, compared and bumped in exactly one place now. cmd/codeaf-release keeps its next, kind and prune behaviour and its tests unchanged; it reads the grammar from the new package rather than owning a second copy of it. A second parser is the thing that drifts: the updater about to land needs the same answer to "is this tag newer than that one" that the release tool gives, and one source of truth is the only way they cannot disagree. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * internal/update: look up a release, check it, and replace this binary with it The launch check answers only for a build that could sensibly be behind: a stable tag, or a release candidate whose stable line has since been published. A dev or staging build, a make build sha and an unstamped binary make no request at all, because a channel build is deliberately newer than stable and a source build belongs to whoever built it. The answer is cached for a day beside the profile, and every failure is silence. The install downloads into the target's own directory, matches the sha256 from checksums.txt, and only then renames over the running file, so a refused download, a wrong checksum or an unwritable directory all leave the original binary exactly where it was and no temp file behind. The API token never leaves the API host: the redirect policy strips it the moment a redirect changes host, which Go does not do on its own for another port or a subdomain. Windows has no atomic rename over a running image, so it goes through ReplaceFileW and puts the original back when Windows reports the one failure that moves it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * tui3: a launch says a newer codeaf is out, and /update installs it The launch line is one dim transcript note carrying both versions, /update, and the curl line, because the command is what the owner asked to be given. It arrives as a command rather than an opening read, so the first frame is drawn before the network is asked anything and a slow or refused answer draws nothing. /update — /upgrade is the same road — names the tag, then the checksum and where it landed, then quits with a restart plan for the door to carry out. Already newest says so and stays. It refuses while a turn or a task is running, and once it has started, one shared guard keeps a second /update and a new turn from beginning underneath it: the restart must never quit on top of live work, and the home page's Enter roads go through the same guard chat's does. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * codeaf update, and the door that restarts the same conversation codeaf update --check prints one line and exits 0 when this release is newest, 3 when a newer one exists, 1 when it could not ask. Without --check it installs stable, or whatever --rc, --dev, --staging or --version names, choosing a channel build by its own publish time the way the installer does. A binary built from source refuses in place and names its path rather than replacing something a developer is holding. The restart happens here and not inside Bubble Tea: the surface fills a slot, the door reads it once the frame is down and the terminal is back, and then execs the new binary with this launch's own arguments plus --session pointing at this transcript, so the conversation reopens where it was. A linked-local engine is asked to retire only after the surface has detached, and it still refuses while another window or any live work is there. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * remote: a window that says it is leaving needs no torn-link grace The twenty-second grace exists for a terminal that was killed without saying so, and a deliberate detach is the opposite of that — the window has just announced its departure. Carrying the grace anyway left a cleanly closed window looking attached for two more call deadlines, which kept a freshly installed codeaf waiting behind the engine the old one had already left. It clears only once the last view is gone. Turns, tasks, unanswered questions, other views and live work all still refuse retirement, and a refusal still never stops the work it protects. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * The installer and the updater agree on what a channel tag looks like Two roads now install codeaf, and they were reading the same release list by different rules: the shell accepted any dev-* or staging-* tag and semver parts with leading zeroes, while internal/update accepts only the shapes the release workflow actually publishes. A malformed tag newer than a real one would send the two roads to different builds. One helper carries the grammar to both channel selection and the line that names the channel, and an unrecognised tag for the asked-for channel now says so instead of installing whatever came back. The publish-time ordering #1056 added is untouched: only which candidates are eligible changed. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * The manual stops saying that nothing self-updates That sentence was true until this change and is now the opposite of true, so it goes, and a section written in the words people bring takes its place: is there a newer version, how do I update codeaf, why does it say this every time I start. It states who gets the launch line and who never does, the opt-out variable, the day the cached answer lasts, the shell exit codes, and both refusals — a build made from source and an executable nobody may write. The command table names /update and /upgrade with the argument they take. Four probes reach the new section, and the remote page keeps its own asker's words in its heading so the new section cannot take that question from it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * docs/changes: the update check and /update, for #1060 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * update: --check answers for the channel it was asked about, and a newer build is never downgraded Two things a hand verification caught. --check parsed whatever tag it had selected with the stable grammar alone, so --dev, --staging and --rc could never be "newer" and every one of them answered "you are on the newest codeaf" and exited 0 while a newer build sat in the list. The check now keeps its channel all the way through the decision and always names the tag it is talking about: stable and rc compare as semver, a dev or staging tag is the same tag or a different one, and --version is equal or it is not. And a build AHEAD of the newest stable was quietly installed backwards — the check said newest, the install downgraded it. Both roads refuse now, naming both versions and the deliberate way past: this codeaf is v0.3.0, ahead of the newest stable v0.2.0 — pass --version v0.2.0 to install it anyway An explicit tag IS that deliberate road, so --version and /update <tag> still install exactly what was named. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * update: a failure names the asset and the status, and ends with the curl line A download that failed printed the whole fallback URL, which put the retired product name on somebody's screen. The line names the asset it asked for and the status it got back, and nothing about which repository answered — the compatibility attempts still happen, they are just not the person's business. Every terminal failure now ends with the curl line, which D9 asked for and the download path had been missing. The / list declared no argument for /update while the command page documented one, so the list gains the second row the way /cache has one. The manual section now says what the code does about a build ahead of the newest stable, where it had said such a build "gets nothing" — true of the launch line, and false of the install until this wave. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * update: the curl line is agentfield.ai/get/codeaf, the supported road The launch line, the refusals and the terminal door offered the raw GitHub address of scripts/install.sh. The repository is public and agentfield.ai/get/codeaf has served that script from main since 2026-09-16, so the constant now spells the supported line, the manual's update section names it in place of "the curl line below", and the change entry says so. Asked for on the pull request by Santosh. Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * a run's own scratch note no longer fails the delivery gate (#1096) * codeaf: a run's own note is offered outside the tree it is judged in leafOutputHint invited a job root to write its overflow document at a workspace-relative name (exec.SuggestPathFor's task-2-x1-toolchain-checks.md shape), so a run working in a person's directory left that note untracked at the root of their working tree. The delivery gate holds the run's record — the artifact registry, joined by jobArtifacts, plus the delivered tree — against the request, read the note as part of what was handed over, and refused the delivery; the run then ended incomplete over complete work. There is no separate mechanical clean-tree check to exempt, so the fix is the writer's: where the workspace belongs to the person, the root's file invitation points at the run's scratch beside its recorders and job logs, and the message keeps carrying the deliverable. * codeaf: a person's own file still joins the record the gate reads TestARootLeafInAPersonsDirectoryPutsItsNotesInScratch baselined the tree after the note was already written, so its landing read could never have observed anything: the record stayed empty because of the ordering, not because of the address. The baseline now happens first, in the executor's own order, and a hint that ever points into the tree again fails on the observation, not only on the spelling. And the other half of the law is pinned down: a file that turns up in the person's tree while the leaf runs — even at a name wearing the run's own task-<n>-<slug>.md shape — is still observed and still lands in the record the delivery gate is held to. Only the run's own note moved; nothing else about what the tree says was loosened. Co-Authored-By: codeaf <[email protected]> * docs: the change note for the root's overflow file moving out of the tree --------- Co-authored-by: codeaf <[email protected]> * chat: the wordmark is drawn CodeAF, four rows, capitals on the d's cap line (#1106) `┌─┐ / ├─┤ / └─┘` is not an `a`, it is two closed bowls of equal size stacked on each other, and two equal closed bowls are an `8`. That was the second-to-last glyph of the product's own name on the first screen of every fresh install. The owner's answer is to have the two letters at the end stand up out of the word as capitals: `A` is an apex, a crossbar and two legs; `F` is the one letter whose case is told by its arms alone, so its top arm is the longer one. A CAPITAL'S TOP IS THE ASCENDER'S TOP, and three rows of box-drawing could not give it that. A bar is drawn at the middle of its cell and a stem reaches the cell's edge, so the `d` stood half a row over any capital however it was formed — and a stem in the bottom row hung half a row under the bowls' baseline the same way. The fourth row is that half a row made whole: the x-height letters live in the lower three and leave the top row blank; the capitals and the `d`'s ascender start in the top row, the ascender as the half-stroke `╷` so its top is the capitals' bar; and every stem that ends on the baseline ends as `╵`, which stops where `└─┘` does. A `│` in the bottom row is a descender and nothing else. THE WORD IS SPELLED `codeaf` AND DRAWN `CodeAF`. `product` is unchanged, the glyph table is still keyed by its lowercase letters, and a terminal that cannot draw boxes still gets the word `codeaf`. The greeting's centring test read the unit's left edge off the wordmark's first row, which is now the cap line the x-height letters leave blank; it reads the second row. The one manual page that draws the wordmark had been drawing the retired `aforge` letterforms under the label "the codeaf wordmark" — the name law walks text and cannot see a name spelled in box-drawing — and draws the shipped forms now. Co-authored-by: Claude Fable 5.1 <[email protected]> * A real release download finishes: the 3-second check clock no longer covers the asset (#1110) * update: a release download gets its own clock, not the check's The release client was built as http.Client{Timeout: 3s} because three seconds is right for the launch check, and Go's Client.Timeout covers the WHOLE exchange including every body byte. The same client then downloaded the release asset, so a 57 MB download on a healthy link — about eight seconds here — was cut off three seconds in and a person read `read the release response: context deadline exceeded`. Client.Timeout is gone. The transport bounds only what has made no progress: a 5 s dial, a 5 s TLS handshake, a 10 s wait for response headers. Every call now takes its deadline from its context. The launch notice and `--check` share the one CheckTimeout constant, install metadata gets 10 s per request, and the asset gets a 30-second no-byte stall window plus a 15-minute ceiling — a dead link fails with a sentence, a slow one finishes. No Go deadline text reaches a person. A stall says `downloading codeaf-linux-amd64 stalled — no bytes for 30 s`, the ceiling says `took longer than 15 minutes`, and late headers say `did not start arriving within 10 s`. The stall window, the ceiling and the metadata window are injectable, so the tests prove the clocks with real slow, silent and trickling servers rather than waiting out the shipped ones. Co-Authored-By: Claude Fable 5.1 <[email protected]> * update: both doors read the one check constant `codeaf update` and the chat surface each spelled `3*time.Second` when they built the release client, which is how a figure meant for one small request came to govern an install. Both now pass update.CheckTimeout, and the three seconds live in exactly one place. The terminal's `--check` takes the client's Check, which is the whole-exchange check deadline; a plain `codeaf update` keeps Select, so the metadata requests an install makes get the ten seconds they need. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: the update download's own clock (#1110) Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Fable 5.1 <[email protected]> * docs/changes: v0.2.1 rolled up into CHANGELOG.md (#1113) The 33 entries that landed on dev since the v0.2.0 roll-up are the ## v0.2.1 section of CHANGELOG.md now; docs/changes/unreleased/ keeps only this pull request's own entry. Stable v0.2.1 takes its notes from that section. Co-Authored-By: Claude Fable 5.1 <[email protected]> * README: telemetry folds under Docs (#1115) The 23-line Telemetry section between Install and the product tour becomes one collapsed block at the end of Docs: a plain summary line, the notice verbatim, one sentence and the link to docs/TELEMETRY.md. The notice block is unchanged, so it still matches the binary, the installer and docs/TELEMETRY.md. Replaces #1112. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01NoeSVN8nqmwNVRXExgoUNN * santos/dev lands on dev: crew family, Pareto crewing, the Model Pool, custom connections (#1194) Lands the integration branch santos/dev (#1108, head 6db5125b2, 152 commits over dev) on dev as one squash, plus two fixes that kept its touched-packages job red: the pool start-up test empties the CI word it is not about (649bb4bfd), and a zombie leader no longer keeps a job's process group alive on Linux, which had delayed every finished background job by the two-second termination grace since #1155 (053e6a90f). #1108 carries the full account; the 94 change entries under docs/changes/unreleased/ are the per-change record. The commits folded in, oldest first: 5c413ef7b Keep archived evidence readable while tasks finish 3705a0cfe Document recovery evidence retrieval change 7834cc7d0 tui3, manual: a question's own answer box answers to the whole caret vocabulary 99d66e98c task: Add open/all source toggle to crew config c1e4cb57f docs: the change entry for the crew model family toggle e63b43927 crew: round-1 review fixes 304a5a223 crew: round-2 review fix 65477c0c5 task: Add open/all selector to /crew TUI picker 9189ef764 Merge branch 'task/add-open-all-selector-to-crew-tu-9e8cc0' into feat/crew-open-all-toggle ba9c12d61 crew: reconcile the picker onto config's source helpers ea05bc0f5 crew: a chosen family counts as an answered crew e1a037e0a Merge remote-tracking branch 'origin/dev' into feat/crew-open-all-toggle f6c2924a7 crew: the open table takes the picks we landed on eff44b542 docs: the change entry carries the open-table move and the family gate 71ce9bec0 crew: the family reaches the fallback, the settings skin, and the row's line b8ca5f513 crew: round-1 review fixes on the new table 8db5708ef crew: round-2 review fixes ce9759ef4 crew: round-3 review fixes 956e1f514 crew: round-4 review fixes 37ad27f4e crew: fixes from the first Opus round 6ffb95813 crew: the fixes from the Opus confirmation round 72b027436 crew: the comments the atomic write left behind 70d0e205b crew: round-four fixes from the Opus review 234300e37 Merge branch 'dev' into feat/crew-open-all-toggle 894292f28 crew: round-five fixes from the Opus review fba77f92d An answered landing carries its answer's fate when it is raised again, and an in-flight settle holds the question down (#1077) e69445058 Changelog entry for the landing-answer fate (#1086) 64ab7eae0 crew: round-six fixes from the Opus review 070016419 crew: round-seven fixes from the Opus review af09aa852 The review round's four findings: claim ownership, decider changes, recordable answers, plain words c24af0248 crew: round-eight fixes from the Opus review 289d372b9 The tests the landing's answer carries: fate, hold-down, redraw, claim doors 7e38346a9 The take-down comes before every mint, and the tui3 walk reads the newest card dbe1be03e The review rounds' last word: the release owns its claim, and the docs say what the code does 4cc4945a7 The Opus review: a release owns its generation, and every failed round still says its word a5cce0dde The done card says who is deciding, so the clause is a duplication, not the fact 6bd276e6c Merge fix/1077-landing-reraise into santos/dev 271016938 Merge feat/crew-open-all-toggle into santos/dev b459399d3 Merge fix/question-answer-box-caret-keys into santos/dev a38492026 Merge codex/recovery-evidence into santos/dev dc22e6461 cmd/codeaf: the role-door tests read the shipped mastermind instead of a copy of it 39f528f70 release: the pin-example check reads the guide the examples moved to 6439d3cb8 session, tui3: gofmt the three files santos/dev merged unformatted 854037967 tui3: a question's answer box kills to the end of the line on ctrl+k d93ec61ea session: the late-attach proposal test holds the work until the replay is read a81ead4de session: the landing-fate tests read today's clock instead of a fixed date 8fe4fff38 provider: the retry-avoid list rides the call's context into the knobs a266da3e2 provider: the retry-avoid veto narrows the wire through one field law 197d89334 exec: a node retry asks the router to avoid the lanes that failed it 2d02cc0b9 provider: the set-servable law's doc comment keeps its paragraph break e1d0e7524 exec: the retry test names its helper and spells its wall in time units e7d65a517 docs: the change note for the retry that avoids the failed upstream 11decbd92 Merge fix/provider-failover into santos/dev c099a51c2 Merge dev into santos/dev e47d92bde provider, exec: the lane a failure names is a wire fact provider reads (#1105) 396be97be Merge dev into santos/dev 3b97f50c3 Merge dev into santos/dev ea3b5c9a0 telemetry: the send path drops events that cannot name their version 573b288e4 cmd/codeaf: keep smoke runs from sending usage counts e8d627c6b docs: the change note for the usage-count audit fixes 11bec8d80 chat: a hosted session's usage counts are read off the events it receives b9d75b39e chat: the hosted-count tee is tested against the tally it must produce 39fa08d3d telemetry: stamp a version in the lifecycle tests 681e2adf1 chat: count the hosted boot agent once, and conversations opened beside 825ef2c41 connect, settings: named, multiple, switchable custom connections (#1092) f4d3f9a1a Merge branch 'dev' into fix/telemetry-audit 76fec37e3 ci: the Model Pool mirror workflow and the signature check it runs 2fb296bf1 crew: Pareto crewing, the learned picker and the Model Pool (#1093) a065ebb1b Merge remote-tracking branch 'origin/dev' into santos/dev 80ac250a0 Merge remote-tracking branch 'origin/feat/pool-mirror-workflow' into santos/dev 6092393ab Merge remote-tracking branch 'origin/fix/telemetry-audit' into santos/dev ef808dda4 session: a decision card under --yolo takes its default (#1117) 70a9e1f6e session: a task's thread stops its parts before it closes, and a machinery cut says so (#1118) c4df8f364 crew: an auto seat's rung names the pick that ran, once, for both doors (#1119) a9fcf9bc8 crew: a bare auto row under picked from = catalog reads the catalog's figures alone (#1120) 13be0dce4 relay: accept the exec and run doors, not only task and do (#1121) 90f29aec1 changes: name the #1120 note by its PR and stamp the pr field 0b77926ca do: seat from the settings the run will use (#1122) 32148d87d changes: stamp pr: 1120 on the #1120 note 113ed628e pool: a launch's start-up errands stop when the process closes (#1124) 6c98ddca3 verify, codeaf: a launch compiles fewer patterns and a surface holds fewer Ps (#1125) 50fe6a3e4 pool: the min_installs floor counts installs on the client (#1127) 076cde8ae relay: fold a resubmitted row once by its nonce (#1128) 8339ae71b relay: carry the acceptable metric beside role_quality (#1129) 0367c441b outbox: a refused row leaves the outbox and the rest of its batch is sent (#1130) 09aecd2f1 relay: the index holds only the cells that meet the min_installs floor (#1131) ae7c05dcd outbox: a Send compacts the file to the rows it still holds (#1133) 9e24f72d8 pool: the errand tracker's critical sections unlock from a defer (#1134) 358a569aa relay: fold a submit batch with one read and one write per distinct cell and day (#1136) a1d2eb1f7 pool: judge landed-but-unjudged runs on the next chat start (#1132) 3c6722859 verify: take the finished-tree check at a project cloned into a subdirectory (#1135) 263625b63 exec: a headless run leaves a pending judge record at its tail (#1137) 8be373d39 run: the headless task door leaves a pending judge record (#1138) a336b246e do: leave a pending landing for the Model Pool's judge (#1139) 8820a5659 cmd/codeaf: one readPendingRows test helper, not two (#1140) 49760fb45 pool: show and verify print both metrics the index carries (#1141) 6eaeb25c9 pool: status shows the pending judge records and the last sweep (#1142) 7c00b5f2c codeaf: a test's crash fixture stays in a profile the test owns (#1145) fc2eb357a manual: the status row's ledger is the tree's, not the conversation's (#1143) a06b53a91 test: pin the delivery gate over a grown job root (#1147) 7231347eb resident: the wall refuses a first replan round it cannot hold (#1144) 5e257557f cmd/codeaf: the package's test floor clears a profile the environment named 4dd1c562f Revert "cmd/codeaf: the package's test floor clears a profile the environment named" 9075f863c pool: the seed index is regenerated from the relay by seedgen (#1148) a5c44f3d2 pool: show --cells lists the held index's cells with installs and dims (#1149) 825996739 cmd/codeaf: the package test floor clears a profile the environment named (#1150) 81568aa82 session: report gitignored build products a run leaves, without gating on them (#1152) da4910593 internal/tui3: the opening hint test owns its profile and pins both doors 72de3bca7 docs/changes: #1151 — the opening hint test owns its profile 499083d1c Revert "docs/changes: #1151 — the opening hint test owns its profile" beb31ecf7 Revert "internal/tui3: the opening hint test owns its profile and pins both doors" 25b8b7dea version: an unstamped binary names the condition, not a Makefile target (#1151) c833b423a pool: a dropped row keeps the relay's reason and status shows it (#1154) cbb7d6d9e processgroup: verify a job group's identity before signalling it (#1155) efe498ed0 internal/tui3: the opening hint test owns its profile and pins both doors (#1153) 17b3b0e40 do: a continuation continues the plan it has instead of re-planning (#1156) 22cf3ce17 changes: correct the #1155 and #1156 notes' pr fields (#1157) 8e85b0fe7 cmd/codeaf: a surface runs under a soft memory limit drawn from the machine (#1158) ef1e92756 task: status row accounting (#1159) 44f572e26 pool: status's index line says what this run's fetch did to the cache (#1161) 3600fc9a5 pool: the pool's copy of a seat's id is the bare vendor/id (#1163) a2ebd1397 cmd/codeaf: no test can push pool rows to the default relay (#1164) 4fb7f0546 docs: the road a chat door bash push took under --yolo (#1160) 69219a1e1 cmd/codeaf: the soft memory limit is the smallest real bound, not the host s memory (#1162) 2b155b4b4 relay: bound judge severity, clamp adjusted scores, publish mean and sd on one scale (#1165) 2fb55324a relay: purge fixture vendors and refuse them at the door (#1167) 57504187a exec: a job's shell cannot reach the tmux server hosting codeaf (#1166) eb7b46559 internal/session: an unattended run may not move a branch it did not create (#1168) 80f770639 pool: status says the identity, the judged total and that nothing has landed (#1169) 1cb7333fa exec: an exec run's worker spend reaches the usage ledger (#1170) 96bb9402e changes: the #1169 note's title parses and reads as one line (#1172) 627236d95 config: the task door honors a stored crew word, and a pin survives the learned pick (#1171) 593092be6 internal/tui3: a test may not read a profile it did not create (#1173) ad8be1ed7 session: a landing card under --yolo takes its default instead of parking the run (#1174) 03d49a678 gitignore: the .furrow ids the engine writes into a workspace (#1175) 46edbdd32 internal/tui3: gofmt the profile-law helpers from #1173 (#1176) 3179e3611 relay: ALLOWED_VENDORS names the catalog's vendors and codeaf (#1177) 397a145a6 docs: why a settled /task leaves commits on task/<slug>, not the worktree branch (#1178) 915ff3a76 pool: regenerate the seed index from the relay's first clean publish (#1180) d9b42430f cmd/codeaf: the model warm stops when the process closes (#1179) bd2dcf334 session: the auditor's calls say they are the auditor's and which node they check (#1181) c6ed47c5a task: json unverified branch (#1182) 360352ad4 session: a settle turn runs under the checker's own bound, not the run's wall (#1183) 814e1af0e session: the tasks text and record line name a failed/unverified node's kept branch and verdict (#1184) 7c25a26d9 internal/session: the identical-effects test stops riding the turn guard (#1185) 6e7d0ed44 cmd/codeaf: exec and run envelopes name a non-verified node's kept branch and verdict (#1186) f4079d716 session: bound a worker's park on a promoted command (#1187) 994689fe7 docs: the model pool runbook names the Workers Paid plan and what it costs (#1188) c315be13e docs: the runbook's plan line says metered, not capped, and nothing more (#1189) 2e80c60d8 internal/tui3: the status word says working while a task subtree turns (#1191) 99363ca8f session: bound a job subtree's CPU and process count (#1190) 6db5125b2 docs: what the audit check seat can execute, and where that boundary is set (#1192) 649bb4bfd cmd/codeaf: the pool start-up test empties the CI word it is not about 053e6a90f processgroup: a zombie leader does not keep a job's group alive b4e66f515 docs/changes: the entry for #1194 Co-Authored-By: Santosh kumar <[email protected]> Co-Authored-By: Claude Fable 5.1 <[email protected]> * ci: Model Pool mirror workflow (signed index onto the model-pool branch) (#1116) * ci: the Model Pool mirror workflow and the signature check it runs Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs: the change entry for the Model Pool mirror workflow --------- Co-authored-by: Claude Fable 5.1 <[email protected]> Co-authored-by: santoshkumarradha <[email protected]> * chat: the unconnected custom row on /connect keeps its vendored name (#1195) modelConnectionStatus renamed every custom-id row to the connection's Written word, and the catalog template's Written is the bare id, so a person who had connected nothing yet saw `custom` where the manual, the README and #1107 say `Custom OpenAI-compatible API`. Only a connected instance is called what the person called it now; the contract test draws both rows and is red without the fix. Found verifying the staging build of #1194. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: v0.3.0 rolled up into CHANGELOG.md (#1196) 95 loose entries — the crew family and Pareto crewing, the Model Pool and its relay, custom connections, the telemetry audit, the update door's download clock, and the fixes that followed — become the `## v0.3.0` section the stable release reads its notes from. Co-Authored-By: Claude Fable 5.1 <[email protected]> * ci: a changed directory in a nested module is not a package of the root module (#1332) The touched-packages job and the Makefile's test-touched target both derived the test set as every directory holding a changed .go file, and handed a directory under its own go.mod to go test, which answers "main module does not contain package" and fails the job as a setup error. Both walks now stop at the first go.mod above the directory and skip nested modules, so the bench fixtures under bench/bashloop/fixtures are left alone and make pr-ready derives the set the gate will. Verified on the 621-file diff that surfaced it: 43 directories to 36, the seven dropped are exactly the fixtures, and the two halves print the same list. Co-Authored-By: Claude Fable 5.1 <[email protected]> * santos/dev lands on dev: the worker harness, stopping and limits, the task page and rail, goroutine ownership at close (#1108) Integration branch santos/dev, held as a closed slice at d39a4e308 plus the empty-prompt guard for generate_image (3a1f80f9c). Everything through #1192 had already reached dev as #1194; this carries #1193 and #1203 through #1331. The worker harness: one loop under /task and codeaf do with a plan store per run, a plan seat, a work seat, a check seat and a review round after each piece of work, off unless CODEAF_TASK_BELT=bash is set, so the default road does not move. Stopping and limits: a person's stop reaches a run, a time or dollar limit ends a run and names itself, a run is handed what is left of the conversation's limits, a worker that stops making progress is told once and then ended. The task page and the rail: the plan as a tree, a run's row with its parts under it, step rows cut from the commands as they ran, a press on a run's row opens its page in under 0.2 seconds. The engine host and sign-in, the profile's composed writes across two processes, unread config keys said once. Nothing keeps writing after the process closes: the place sweep, the standing ticker, the usage writers, the pool judge sweep and the catalog warm are each owned, stopped and joined, and a law lists every goroutine a conversation process starts. The heavy-suite lock is a kernel file lock that follows the suite. The lazy lexer registry, one fuzzy matcher for every picker, the drafted-with footer on the CodeAF repository. Reviewed 2026-09-21: gates green locally and in CI once #1332 taught the touched-packages walk about nested modules; the default road verified live on both roads against a dev baseline; the one regression the slice introduced (generate_image had lost its empty-prompt guard) fixed on the slice with a contract test. Co-authored-by: Santosh kumar <[email protected]> Co-Authored-By: Claude Fable 5.1 <[email protected]> * a dev build installs beside codeaf as devaf and follows the dev channel (#1333) * install: --name installs the binary under another file name beside codeaf The installer takes --name WORD and CODEAF_INS…
santoshkumarradha
added a commit
that referenced
this pull request
Oct 25, 2026
* Honor chat-requested models for task workers and new conversations (#1935) Preserve explicit worker model selection for joined tasks and descendants. Add model-selected independent and teammate chats, atomic launch claims, updated tool guidance, and regression coverage. Validated all five live OpenRouter launch scenarios with DeepSeek v4.1 Flash and Kimi K3. All PR checks passed. Refs #1839. * Answer and verify the four skill capability questions (#1938) Add direct skill definition, capability and troubleshooting answers, including memory-independent behavior. Pin the four original queries and verify tool-result delivery through real hosted terminal chats with memory saving on and off. All eight live cases passed using exact deepseek/deepseek-v4.1-flash. All PR checks passed. Closes #1937. * Make All show the current conversation tabs (#1939) * Scope All to the current conversation tab strip * Keep screenshot launches guarded and use rendered count grammar * Guard the screenshot terminal option command * Expect current-tab scope in the All navigation hint * Scope the All wall's copy and empty state to open tabs The in-wall All chip now says the grid holds the tabs in this view rather than saved conversations, and an empty scoped grid says no conversations are open here instead of promising saved ones will appear. wallEmptyText is shared by the live grid and the currently unused wallEmptyRow, so the two stay in step. The dock test now proves the label and the mark each open the wall scoped to open tabs, and the render test pins the scoped empty line. Assisted-by: CodeAF (deepseek-v4.1-flash-1017) Co-Authored-By: CodeAF <[email protected]> * Make open tabs a property of the open wall closeWall now clears wall.openTabs with wall.on, so no reader after a close can mistake a closed scoped wall for an open one. wallOpen still reads the scope before it closes the wall, which is where the team is kept. Assisted-by: CodeAF (deepseek-v4.1-flash-1017) Co-Authored-By: CodeAF <[email protected]> * Open an overview unpicked A pick outlived a close that was not esc, so a card picked in the wall left the next overview in selection mode - and in the All scope it could be a card nobody had picked there. Every overview now opens with nothing picked. Assisted-by: CodeAF (deepseek-v4.1-flash-1017) Co-Authored-By: CodeAF <[email protected]> * Name the All door as the tabs in view in the manual places.md still promised all saved conversations from ▦ All, and keys.md listed alt+v, /wall and the strip door as one thing. They are two views since this change. Assisted-by: CodeAF (deepseek-v4.1-flash-1017) Co-Authored-By: CodeAF <[email protected]> --------- Co-authored-by: CodeAF <[email protected]> * Run the same program when connecting to another machine (#1940) * tui3, config: the gate row lands on the conversation you are in, and /status names the gate (#1063) The three Safety rows — `ask before running`, the tool exceptions and the shell command rules — wrote the profile and left the running gate alone, while the YOLO badge read that profile live. So the badge and the gate disagreed in both directions: `allow` lit the badge over a gate that kept asking, and `prompt` put it out over a gate that was still wide open, which is the false-safety claim #322 and #325 exist to prevent. `applySetting` now pushes those three rows through `ApplyApprovals` — the seam /permissions already drops a banked rule through — and refreshes the badge on the same keystroke, on the branch where the push landed. A rebuild that could not be done is said out loud on the panel's foot line in /permissions' own words, `saved · from the next session`, and the badge stays with the gate in force rather than following the file. And /status carries the posture it never carried: `approvals prompt`, `allow` or `deny`, in the `ask before running` row's own words, in the note, in --json and on the phone's status sheet, from the one posture reading the badge uses. The status row keeps its negative-space badge and the segment is no longer written into the page twice. The note's label column is measured from the widest label it carries, so three crew assertions that spelled `"\ncrew"` plus exactly five spaces were assertions about every other row on the page. They read the crew line by its label now. Co-authored-by: Claude Fable 5.1 <[email protected]> * attribution: the footer names CodeAF, and still links to agentfield.ai (#1075) * attribution: the footer names CodeAF, and still links to agentfield.ai The pull request, issue and comment footers read "Drafted with agentfield ai". They now read "Drafted with CodeAF"; the link, its utm parameters and the "reviewed and owned by the author" tail are unchanged. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01GNBScbyNAbbEQ5jn9G6auy * docs: the change entry for the CodeAF footer Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01GNBScbyNAbbEQ5jn9G6auy --------- Co-authored-by: Claude Opus 5 <[email protected]> * session, prompt, tui3: a wrong completion check is answered with [no change], and the answer stands (#1065 round 1) (#1067) * session, prompt: a wrong completion check is answered with [no change], and the answer stands (#1065 round 1) The end-of-turn reader saw 600 bytes of the last message, so a long table read as cut off; the carry-on told the model to explain itself, and the explanation became the only answer left in view under the fold. The reader now sees up to 8 KB of the last words, and a cut it still has to make ends with `[clipped by codeaf: N of M bytes]`, which its ask says is never evidence of a cut-off answer. The carry-on lead says who wrote the note and offers one exact reply, `[no change]`: it ends carrying on for the ask without another reading, the transcript keeps it for the model, and neither replay nor the live feed draws it — so the settled answer before it is what the fold finds. system.md trades `# Tone` and `# Delivery` for `# The answer`, `# Words or work`, `# When corrected` and `# Messages from codeaf`, and the two lines that pushed action on questions are qualified. The lean page keeps all four; the prefix waivers rise by the 1,705 bytes that cost, dated and named. Co-Authored-By: Claude Opus 5 <[email protected]> * docs: the change entry takes the pull request's own number Co-Authored-By: Claude Opus 5 <[email protected]> * session: a quiet landing is asked about the notes it was handed, not the page that names them The worker's system page now names [silent] and [stuck] under `# Messages from codeaf`, so a search of the whole request found the tag on the page. childWasHanded reads the conversation and leaves the page out. Co-Authored-By: Claude Opus 5 <[email protected]> * session, prompt: [no change] answers the note it follows, and a long ask leaves the last words cut by name (#1065 round 1) Self-review of #1067 found the token honoured on the wrong replies. The gate read the turn's carry-on count, so a model that made calls in answer to the note and then said [no change] ended the turn unread on an answer those calls may have made stale, and a token after a load or ask nudge counted too. It now reads the transcript: the token must be the very next reply to the reader's own lead (answeredNoteUnchanged), and the dead declined flag is gone. An ask up to the whole digest rides in its head, so eight kilobytes of last words behind a long ask reached the backstop clip and ended in a bare `…`. checkpointClipSaid takes the room that is left. A turn that ends on the token no longer starts the route judge or hands the token to the memory reflex, and a later reading's last words skip it. `# Messages from codeaf` named `[still asked]`, which only the reader ever receives, and left out `[stuck]` and `[held]`, which the conversation does; it now names the tags that arrive and says any other opening, such as `[image #1]`, is the person's. The waivers sit on the measured 1,779 bytes, and the manual and the change entry say what the gate actually honours. Co-Authored-By: Claude Opus 5 <[email protected]> * prompt: the new sections keep the rules the old two carried, and say what stays in view (#1065 round 1) Owner review of #1067. Replacing `# Tone` and `# Delivery` had dropped five rules; each is back inside the new sections: match the person's task and vocabulary, choose the safe option under uncertainty, evidence and blocking details complete, never a compiling scaffold or a narrowed test, never half-solved work. `# The answer` said only the last message reaches the person, which `# Planning` contradicts: the plan and the per-batch sentence are shown while a turn runs. It now says that once a turn ends only its last message stays in view. `# Words or work` sat beside `## Work or words`, which spends the same two words on hand-off sizing; it is `# Answer or change`, and it says an answer asked for in chat is written in the reply, not a file, unless the person asks for one. The waivers sit on the new measurement, 2,035 bytes over dev on both arms. Co-Authored-By: Claude Opus 5 <[email protected]> * prompt: the messages-from-codeaf list names every note codeaf writes The system prompt now distinguishes conversation user-role notes from private reader and tool-result markers. A structural test follows the production constants, and the byte waivers record the exact fixed and lean measurements. Co-Authored-By: Claude Fable 5.1 <[email protected]> * session: no change skips judgment only when it answers the reader The completion loop now uses the transcript context before suppressing the route judge or substituting the prior answer for memory. Tests cover the withdrawn and ordinary-token memory paths, and the manual separates counting from display. Co-Authored-By: Claude Fable 5.1 <[email protected]> * test: the model stub replays the no-change fold The OpenAI-compatible stub can now drive the real binary through eleven read rounds, a long table, a rejecting reader, and the exact token reply. The recipe records the tmux setup and the expected log and screen evidence. Co-Authored-By: Claude Fable 5.1 <[email protected]> * prompt: the standing-news tag stays with the event, not on the page The messages-from-codeaf list had named [something you set up fired], and TestTheSteeringLineReadsAsNewsAndNotAsARequest refused it: that line says under the news itself what it is and what not to do about it, so the page's copy is one law bought on every request of every turn for a turn most sessions never have. The list keeps the compaction tags, the structural test now files the standing frame with the private voices the page must not name, and the waivers fall to the new measurement (fixed 55,280, lean 47,055). Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Opus 5 <[email protected]> Co-authored-by: Abir Abbas <[email protected]> * Clean internal experiment records and revive test/ux for codeaf (#1068) * chore: clean internal experiment records and revive test/ux for codeaf Public-repository cleanup ahead of opening the docs to outside readers. - Remove four internal DOE/experiment record directories that reference private issue and pull-request numbers and are not current-product documentation: docs/design/pin-doe, plan-gate-doe, turn-wall-share-doe, and workspace-foundation. - Neutralize internal machine references in benchmark and design docs: the bench host ("spark"), its secrets.env path, and a personal working branch name, all now generic placeholders. - Revive test/ux/, the user-facing journey suite, for the renamed product: collapse the removed v1/v2 dual-surface logic into the single v3 surface, repoint the binary to cmd/codeaf and state to ~/.codeaf/CODEAF_*, and delete gate.sh whose premise was the v1-vs-v2 parity table. Co-Authored-By: codeaf <[email protected]> * chore: drop internal conversation-runtime wave records, keep the measurement contract The conversation-runtime directory was a local development wave: day-by-day status, /private/tmp paths, "owner authorized" process notes, draft PR numbers, and local change logs. None of it is current-product documentation a public reader needs. Keep PARETO.md, which is the benchmark's cited measurement contract, trimmed of its dangling calibration link and owner language. Co-Authored-By: codeaf <[email protected]> * chore: neutralize the remaining bench-host and work-machine references A wider sweep found the internal bench host ("Spark"), its secrets path (fleet/secrets.env), and a scratch ops directory still named in live docs, bench READMEs and bench scripts that the earlier redaction had not touched. Rename the host to "benchhost"/"the bench host", drop the secrets path, and replace "the laptop" as the owner's own machine with a neutral "work machine" where it meant the internal one. The manual's first-person "the laptop you are sitting at" is public-facing and left alone. Co-Authored-By: codeaf <[email protected]> * chore: fix review findings in the public-cleanup diff - PERF.md: drop a private tracker issue reference (#846). - PARETO.md: restore a complete sentence dropped when the calibration link was removed, and align tense with the remaining present-tense claim. - home-mission-control/DESIGN.md: drop the internal "fleet" system name and an owner-framing phrase, consistent with the secrets-path scrub elsewhere. Co-Authored-By: codeaf <[email protected]> * docs/design: the two records live code still cites stay in the tree plan-gate-doe/REPORT.md is the measured evidence behind the plan-gate default that twelve comments in cmd/codeaf, internal/config, internal/session and internal/splitgate point at, and turn-wall-share-doe is the run internal/session/turnwall.go says it was added from. CLAUDE.md keeps the record on purpose for exactly this reason, and neither folder names a machine, a secret or a private address. Co-Authored-By: Claude Fable 5.1 <[email protected]> * test/ux: the revived journey suite goes back out #991 removed it because it drove the v1 and v2 surfaces, and the revival did not change that: its journal verb reads graph.db tables (messages, nodes, usage, commands) that the v3 chat never writes, lib.sh still waits for the resident, nothing runs it from the Makefile or a workflow, and its only evidence was bash -n. docs/JOURNEY.md says internal/e2e is the one suite that drives the binary, and that stays true. A suite that has been run green against bin/codeaf can come back on its own pull request with a target that runs it. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: entry for #1068 Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: the #1068 entry says why the journey suite is out, correctly The first draft said the v3 chat never writes the graph.db tables the suite reads. Running the suite showed both message rows landing, so that sentence was wrong; what is true is that nothing runs the suite, it had never been run, and its first journey fails on its first screen check (#1072). Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: codeaf <[email protected]> Co-authored-by: Abir Abbas <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]> * session: task commits are authored by the bot account, not codeaf@localhost The author codeaf stamped on the commits it lands was `codeaf <codeaf@localhost>`, which no GitHub account can link, so every branch codeaf landed failed the CLA check. It now writes `codeaf <[email protected]>` - the identity the Co-Authored-By trailer already used - and keeps `codeaf@localhost` and `aforge@localhost` recognised as legacy by taskCommitIdentity. GLM 5.3's review caught an unmarked retired name in permissions.md that reddened the namelaw gate, and seven stale test fixtures; both fixed. Laws gate, session, exec and cmd are green. Co-Authored-By: codeaf <[email protected]> * README: show the pinned-version install line the release test requires (#1103) * README: show the pinned-version install line the release test requires The Install rewrite dropped the VERSION=<tag> pin example, and TestPublishedPinExamplesGiveVersionToBash reads every published install surface for `| VERSION=` because `VERSION=<tag> curl ...` is an easy mistake to copy — it sets the variable for curl instead of the install script. The pin goes back inline on the same host the section already uses, with the releases page still linked for tags. Co-Authored-By: codeaf <[email protected]> * docs: the change entry for the README pin example Co-Authored-By: codeaf <[email protected]> --------- Co-authored-by: codeaf <[email protected]> * telemetry: anonymous usage counts, off with CODEAF_TELEMETRY=off (#1095) * telemetry: the package behind anonymous usage counting, per the wire contract Four typed events (first_run, session_started, session_ended, fault) with the contract's allowlisted, bucketed props; the opt-out ladder with its off reasons; a hashed install identity at 0700/0600; a fault fingerprint over codeaf function names only; a JSON-lines spool with a deadline-bounded flush of up to 50 events per POST, 7-day age drops and a 1000-line cap; the notice constant with NoticeShown/MarkNoticeShown gating the flush; and Show() for a future codeaf telemetry show. A library only: nothing in cmd/codeaf, internal/session or internal/config reads it yet. Co-Authored-By: codeaf <[email protected]> * telemetry: tests, doc, and contract fixes for the usage-count package Adds the package's tests — bucketing edges, the opt-out ladder, install identity, the notice, fingerprinting, the spool against an httptest relay (cap, age drop, 50-per-POST splitting, a hard deadline against a hanging server, silence on failure) and the privacy law that no sentinel string reaches the wire. docs/TELEMETRY.md documents the notice, what is sent and how to turn it off, with a test that fails if the doc's property table drifts from the Go allowlist. Fixes four drifts from the wire contract found running those tests: the <1m duration bucket was missing, the fingerprint's argument stripping cut too much, the rc channel suffix must be a single integer, and under go test a config-off rung outranks the test rung in the reason reported. Co-Authored-By: codeaf <[email protected]> * telemetry: fix review defects 1-8 with tests Fingerprint stability (last-( cut, .go:/main./created-by frame rules), counted-batch flush, guarded and multi-process-safe spool, BucketDuration edges, Configure-gated write paths, O_EXCL install id, install.json preservation, buildinfo.Dirty accessor. Co-Authored-By: codeaf <[email protected]> * installer: record the install locally and print the telemetry notice Following the telemetry wire contract: a successful install now writes telemetry/install.json under the state root (dir 0700, file 0600) with the install method, channel and UTC timestamp, leaves any existing install_id alone, and makes no request the download steps did not already make. At the very end the installer prints the contract's notice to stderr after one blank line, or one line saying telemetry is off when CODEAF_TELEMETRY/DO_NOT_TRACK opts out. README gains a plain Telemetry section pointing at docs/TELEMETRY.md, and a new test/installer-telemetry.sh proves the marker, the notice and the opt-out without a network. Co-Authored-By: codeaf <[email protected]> * installer: four review corrections to the telemetry commit The review of 71ff95a6b found four things. Revert the one line that changed `if [[ -z "${TAG:-}" ]]; then` back to `${TAG:-}`: under set -u an unset TAG must reach api_problem, not crash. In write_install_marker the channel lands in JSON verbatim and CHANNEL can come from the environment, so only stable, rc, staging or dev is recorded and anything else becomes "unknown" — with test cases for a valid channel and for we"ird, both asserting the marker parses (python3 -m json.tool, or jq, else a strict channel check). Fence the README Telemetry notice in a ```text block so Markdown keeps its alignment, wording byte for byte. Clear the two shellcheck findings in test/installer-telemetry.sh with one block disable for SC2016/SC2034 — ok() evals those strings, so the quoting is deliberate — and export CODEAF_TELEMETRY/DO_NOT_TRACK where a subshell needs them, without weakening any assertion. Co-Authored-By: codeaf <[email protected]> * release-downloads: daily PostHog report of public GitHub release download counts A scheduled workflow reads the repository's releases from the public GitHub API and sends one codeaf:release_downloads event per binary asset (codeaf-<os>-<arch>[.exe]) — sidecars like checksums.txt are not reported. Each event carries release_tag, channel (stable or the prerelease suffix), prerelease, os, arch, the cumulative download_count and the UTC snapshot_date; the event id is derived from tag, asset and date, so a same-day rerun deduplicates instead of counting twice. No code in the binary; counts come only from public release data. Co-Authored-By: codeaf <[email protected]> * release-downloads: tests cover the workflow, docs and pagination The dry-run unittests now also assert the identifiers the wire spec spells out where the script and the workflow spell them: the schedule, dispatch, contents-read permissions, built-in token, project-key secret and host variable in .github/workflows/release-downloads.yml, the public-data paragraph in docs/rules/promotion.md, stdlib-only imports, pagination across API pages, the host override and the /batch/ endpoint, sidecar skipping, draft skipping, and the channel words stable, rc, dev and staging. Co-Authored-By: codeaf <[email protected]> * release-downloads: four review corrections to the script Channel detection now follows the tag grammar in cmd/codeaf-release/version.go: stable, rc, dev and staging tags match their four patterns and anything else reports "unknown", so dev-20260917-09299019bcdc is no longer mislabelled "stable". --dry-run works without CODEAF_POSTHOG_PROJECT_KEY, the local and test path: the batch prints with api_key "<unset>" and exits 0, and only the sending path stops with the notice. Every event carries "$geoip_disable": true next to "$process_person_profile": false, since the sender is a CI runner whose location is meaningless. The module docstring now names release-downloads.yml, the file that exists. The fixture holds one tag of each shape plus an unrecognised one, and the tests assert the channel for each, including the two real dev and staging tags. Co-Authored-By: codeaf <[email protected]> * release-downloads: test runs on Python 3.9 too ScriptSourceTest read sys.stdlib_module_names unguarded; the attribute arrived in Python 3.10, so the suite errored on macOS stock python3 (3.9.6). Guarded with getattr so the pinned import-set check stands on its own where the attribute is absent; 32 tests pass on 3.9, 3.10 and 3.14. Co-Authored-By: codeaf <[email protected]> * installer telemetry: the notice is read from docs/TELEMETRY.md The test read .telemetry-contract.md, a working note that is not in the repository and never will be, so it aborted with "telemetry contract is missing" in a clean checkout. It now extracts the fenced block under "## The notice" in docs/TELEMETRY.md — the same bytes as the Notice constant in internal/telemetry/notice.go — and holds the installer's TELEMETRY_NOTICE to it as before; a new assertion holds the README's telemetry fence to it too, byte for byte, so the invariant the suite existed to guard now has its third leg. Comments in scripts/install.sh, internal/telemetry/telemetry.go and this test now name docs/TELEMETRY.md as the source of the notice. No Go code changed and no Go tests were run. shellcheck is clean; the suite's 33 passing assertions include the two new notice checks, and the same two stat(1)-related assertions that already failed on this GNU machine before the change still fail with identical output. Co-Authored-By: codeaf <[email protected]> * release-downloads: the download-counts paragraph lives in docs/TELEMETRY.md docs/rules/promotion.md was the only home the paragraph had, and it came with a fallback pinning the branch to the state before the telemetry doc existed. The paragraph moves, byte for byte, into docs/TELEMETRY.md as a final "## Download counts" section beside the rest of the telemetry story, and promotion.md returns to its origin/dev content, so this branch now touches no release docs. test_no_telemetry_doc_on_this_branch asserted docs/TELEMETRY.md did not exist and is deleted. The two tests that read the paragraph read it where it now lives: both require a "## Download counts" section in docs/TELEMETRY.md naming .github/workflows/release-downloads.yml, scripts/release_downloads.py and the checksums.txt sidecar, and the promotion.md fallback is gone. No Go code changed and no Go tests were run; the property table in docs/TELEMETRY.md is untouched. The suite passes: 31 tests, OK. Co-Authored-By: codeaf <[email protected]> * installer telemetry: the mode check asks GNU stat first On Linux `stat -f` succeeds and reports the filesystem, so the BSD-first order never reached the GNU form and both permission checks failed. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01CqfhxLrrBNQxwPNvEgoBGR * telemetry: refuse to send to the production relay from a test binary Co-Authored-By: codeaf <[email protected]> * telemetry: testHome points the endpoint at a dead loopback Co-Authored-By: codeaf <[email protected]> * telemetry: the orphan-adoption test names the dead relay it now gets Co-Authored-By: codeaf <[email protected]> * telemetry: a test pins that no test binary reaches the production relay Co-Authored-By: codeaf <[email protected]> * telemetry: three tests pin the test-binary relay refusal Each asserts through real calls, not a re-implemented effect: the newRelay override lands after testHome and a flush reaches that recorder; a default-endpoint flush is refused like a dead relay (zero round trips, event still spooled); forcing the ladder on cannot reopen the path. Co-Authored-By: codeaf <[email protected]> * telemetry: allocation-free session counters Snapshot returns the SessionStats fields the SessionEnded constructor takes, so the wiring hands the struct straight over. Cost is stored as integer micro-dollars and divided back once, in Snapshot. Count* never ask whether telemetry is enabled and never allocate. Co-Authored-By: codeaf <[email protected]> * telemetry: gofmt the counters test One alignment fix in the many-goroutine test; no behaviour change. Co-Authored-By: codeaf <[email protected]> * config: telemetry setting row (CODEAF_TELEMETRY) Key "telemetry", on|off, default on, env pin CODEAF_TELEMETRY, in the interface group beside the history row. TelemetryAtIn walks the ladder — pin, project file, profile config, default — and TelemetryOffReason answers whether config turned the pipe off and names which rung did. The row sits in ProjectKeys so a repository may answer for itself. Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: the telemetry command, and the setting it writes Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: session lifecycle events at execute (work in progress) Configure, notice, first_run and session_started at the start of every session command, session_ended and a one-second flush at its exit. The end event does not yet carry the session counters. * provider: count answered model calls and their spend at the log door * session: count sealed turns and executed tool calls * cmd/codeaf: the session-ended event carries the run's counters telemetryEnd builds the end event from telemetry.Snapshot so turns, model calls, tool calls and cost reach the spool; the stop-reason switch becomes a map over the exit ladder; and both lifecycle constructors are gated on the ladder being on so a disabled run touches no state. Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: the counters test says the tally is process-wide The exact turn, call and cost assertions hold for one run of the package; a repeated run counts into the same atomic tally again. Co-Authored-By: codeaf <[email protected]> * guard: a fault hook Recover calls, for a reporter above this package Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: the fault event at both crash sites, off the current session Co-Authored-By: codeaf <[email protected]> * cmd/codeaf: a test that the crash site spools a fault and not the panic text Co-Authored-By: codeaf <[email protected]> * docs: finish the anonymous usage counts contract and add the 1095 changelog entry * guard: the fault hook sits behind an atomic pointer A goroutine recovering a panic read the hook while a test on another goroutine wrote it, which the race detector reported. SetOnFault stores it once; Recover loads it. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: a task's interrupt word comes from the signal, not the cancelled context stopSignals cancels the signal context at the end of every errand, so the flag read from its Err said interrupted for a run that finished cleanly. Co-Authored-By: Claude Fable 5.1 <[email protected]> * tui3, installer: the telemetry row has a tab, and a custom install writes no marker TestEverySettingRowHasATab wants every registry row on the settings panel. TestCustomInstallOutsideTheStateRootDoesNotRunAdoption wants an install outside the state root to leave the login's state folders alone, so the install marker is written only when the root exists or the install is in it. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: the counters test zeroes the process tally first Other tests in the package drive model and tool calls through the doors that count, so the exact bands held only when the test ran alone. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: the version test drives the telemetry lifecycle, not execute execute starts writers under the state root that outlive the test, and the temp dir's cleanup raced them. The lifecycle alone is what the test pins. Co-Authored-By: Claude Fable 5.1 <[email protected]> * cmd/codeaf: gofmt the lifecycle test Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: codeaf <[email protected]> Co-authored-by: Claude Fable 5.1 <[email protected]> * session: the carry-ladder fixtures wait for the mark's drawing, not race the scheduler (#1104) * session: the carry-ladder fixtures wait for the mark's drawing, not race the scheduler TestASuccessfulHandoffJournalsTheRungThatSuppliedTheBrief failed once in a full make check at line 118: the worker's brief was the running model's draft, not the mastermind's written handoff. THE CAUSE IS NOT A STOLEN STEP. Reproduced under load (60 CPU burners, the fixture run 1500 times), every request the fixture makes is either the turn's own or one the aside answers: the queue carries only `round`, `draft` and `writer`, and the errands beside the turn (title, namer, the mark's drawing) never touch it. What moves is the ROUND COUNT — 41 to 54 across the runs — because the mark's drawing is a sidecar (sidecar.go) whose landing the scheduler places, and the turn is never held for it. On a busy machine the turn runs its rounds off faster than the drawing's goroutine is scheduled onto a core, the gap between the net firing and the drawing landing outruns the slack the script carries ([checkpointSlack] says so in its own words), the writer's ask lands PAST the end of the 53-step script, the scripted completer answers it with its past-the-end line `(unscripted)` — which is not prose — the handoff rung reads degenerate, and the carry ladder falls onto the draft. That is #392 exactly, one mechanism along. WHAT FIXES IT IS WAITING FOR THE READING. checkpointAgent now puts a watch on the turn's own context ([watchReadings]) and the handover fixtures submit through [watchedContext], so [answerWhenQuiet] holds each request that carries the belt until every reading beside it has landed — the order a real turn has, where a real model spends seconds on a step and the small readings land inside it. The gap is then one boundary whatever else the machine is doing, and a script long enough to cross the mark is long enough. THE REGRESSION TEST holds the drawing back by a fixed wall time — standing in for a scheduler that does not reach it in time — and insists on the behaviour: the turn does not spend its script racing the drawing, and the writer's rung still supplies the brief. It fails without the watch (the turn makes 54 rounds) and passes with it. Co-Authored-By: codeaf <[email protected]> * docs: the change entry for the carry-ladder drawing race Co-Authored-By: codeaf <[email protected]> --------- Co-authored-by: codeaf <[email protected]> * docs: the install proxy is live, and the manual says so (#1076) * docs: the install proxy is live, and the manual says so `https://agentfield.ai/get/codeaf` has served `scripts/install.sh` since 2026-09-16, the day the repository went public, so the compiled-in manual and docs/GUIDE.md stop saying it is "not serving yet" and stop calling the repository private. The proxied line goes first, as the README already has it; the raw GitHub line is described as the script under it. Both pages say to pipe into `bash`, not `sh`, because the script uses pipefail and `[[ ]]` and dash rejects them, and both state the channel path (`/dev`, `/staging`, `/rc`) beside the flags. The manual also says what the proxy refuses: a script without its channel line exactly once, or a body that is not a shell script, is a 502 rather than the wrong thing. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: entry for #1076 Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Fable 5.1 <[email protected]> * A launch says a newer codeaf is out, and /update installs it and restarts (#1060) * The release-tag grammar has one home, and it is internal/update Stable, rc, dev and staging tags are parsed, compared and bumped in exactly one place now. cmd/codeaf-release keeps its next, kind and prune behaviour and its tests unchanged; it reads the grammar from the new package rather than owning a second copy of it. A second parser is the thing that drifts: the updater about to land needs the same answer to "is this tag newer than that one" that the release tool gives, and one source of truth is the only way they cannot disagree. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * internal/update: look up a release, check it, and replace this binary with it The launch check answers only for a build that could sensibly be behind: a stable tag, or a release candidate whose stable line has since been published. A dev or staging build, a make build sha and an unstamped binary make no request at all, because a channel build is deliberately newer than stable and a source build belongs to whoever built it. The answer is cached for a day beside the profile, and every failure is silence. The install downloads into the target's own directory, matches the sha256 from checksums.txt, and only then renames over the running file, so a refused download, a wrong checksum or an unwritable directory all leave the original binary exactly where it was and no temp file behind. The API token never leaves the API host: the redirect policy strips it the moment a redirect changes host, which Go does not do on its own for another port or a subdomain. Windows has no atomic rename over a running image, so it goes through ReplaceFileW and puts the original back when Windows reports the one failure that moves it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * tui3: a launch says a newer codeaf is out, and /update installs it The launch line is one dim transcript note carrying both versions, /update, and the curl line, because the command is what the owner asked to be given. It arrives as a command rather than an opening read, so the first frame is drawn before the network is asked anything and a slow or refused answer draws nothing. /update — /upgrade is the same road — names the tag, then the checksum and where it landed, then quits with a restart plan for the door to carry out. Already newest says so and stays. It refuses while a turn or a task is running, and once it has started, one shared guard keeps a second /update and a new turn from beginning underneath it: the restart must never quit on top of live work, and the home page's Enter roads go through the same guard chat's does. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * codeaf update, and the door that restarts the same conversation codeaf update --check prints one line and exits 0 when this release is newest, 3 when a newer one exists, 1 when it could not ask. Without --check it installs stable, or whatever --rc, --dev, --staging or --version names, choosing a channel build by its own publish time the way the installer does. A binary built from source refuses in place and names its path rather than replacing something a developer is holding. The restart happens here and not inside Bubble Tea: the surface fills a slot, the door reads it once the frame is down and the terminal is back, and then execs the new binary with this launch's own arguments plus --session pointing at this transcript, so the conversation reopens where it was. A linked-local engine is asked to retire only after the surface has detached, and it still refuses while another window or any live work is there. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * remote: a window that says it is leaving needs no torn-link grace The twenty-second grace exists for a terminal that was killed without saying so, and a deliberate detach is the opposite of that — the window has just announced its departure. Carrying the grace anyway left a cleanly closed window looking attached for two more call deadlines, which kept a freshly installed codeaf waiting behind the engine the old one had already left. It clears only once the last view is gone. Turns, tasks, unanswered questions, other views and live work all still refuse retirement, and a refusal still never stops the work it protects. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * The installer and the updater agree on what a channel tag looks like Two roads now install codeaf, and they were reading the same release list by different rules: the shell accepted any dev-* or staging-* tag and semver parts with leading zeroes, while internal/update accepts only the shapes the release workflow actually publishes. A malformed tag newer than a real one would send the two roads to different builds. One helper carries the grammar to both channel selection and the line that names the channel, and an unrecognised tag for the asked-for channel now says so instead of installing whatever came back. The publish-time ordering #1056 added is untouched: only which candidates are eligible changed. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * The manual stops saying that nothing self-updates That sentence was true until this change and is now the opposite of true, so it goes, and a section written in the words people bring takes its place: is there a newer version, how do I update codeaf, why does it say this every time I start. It states who gets the launch line and who never does, the opt-out variable, the day the cached answer lasts, the shell exit codes, and both refusals — a build made from source and an executable nobody may write. The command table names /update and /upgrade with the argument they take. Four probes reach the new section, and the remote page keeps its own asker's words in its heading so the new section cannot take that question from it. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * docs/changes: the update check and /update, for #1060 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * update: --check answers for the channel it was asked about, and a newer build is never downgraded Two things a hand verification caught. --check parsed whatever tag it had selected with the stable grammar alone, so --dev, --staging and --rc could never be "newer" and every one of them answered "you are on the newest codeaf" and exited 0 while a newer build sat in the list. The check now keeps its channel all the way through the decision and always names the tag it is talking about: stable and rc compare as semver, a dev or staging tag is the same tag or a different one, and --version is equal or it is not. And a build AHEAD of the newest stable was quietly installed backwards — the check said newest, the install downgraded it. Both roads refuse now, naming both versions and the deliberate way past: this codeaf is v0.3.0, ahead of the newest stable v0.2.0 — pass --version v0.2.0 to install it anyway An explicit tag IS that deliberate road, so --version and /update <tag> still install exactly what was named. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * update: a failure names the asset and the status, and ends with the curl line A download that failed printed the whole fallback URL, which put the retired product name on somebody's screen. The line names the asset it asked for and the status it got back, and nothing about which repository answered — the compatibility attempts still happen, they are just not the person's business. Every terminal failure now ends with the curl line, which D9 asked for and the download path had been missing. The / list declared no argument for /update while the command page documented one, so the list gains the second row the way /cache has one. The manual section now says what the code does about a build ahead of the newest stable, where it had said such a build "gets nothing" — true of the launch line, and false of the install until this wave. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> * update: the curl line is agentfield.ai/get/codeaf, the supported road The launch line, the refusals and the terminal door offered the raw GitHub address of scripts/install.sh. The repository is public and agentfield.ai/get/codeaf has served that script from main since 2026-09-16, so the constant now spells the supported line, the manual's update section names it in place of "the curl line below", and the change entry says so. Asked for on the pull request by Santosh. Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]> * a run's own scratch note no longer fails the delivery gate (#1096) * codeaf: a run's own note is offered outside the tree it is judged in leafOutputHint invited a job root to write its overflow document at a workspace-relative name (exec.SuggestPathFor's task-2-x1-toolchain-checks.md shape), so a run working in a person's directory left that note untracked at the root of their working tree. The delivery gate holds the run's record — the artifact registry, joined by jobArtifacts, plus the delivered tree — against the request, read the note as part of what was handed over, and refused the delivery; the run then ended incomplete over complete work. There is no separate mechanical clean-tree check to exempt, so the fix is the writer's: where the workspace belongs to the person, the root's file invitation points at the run's scratch beside its recorders and job logs, and the message keeps carrying the deliverable. * codeaf: a person's own file still joins the record the gate reads TestARootLeafInAPersonsDirectoryPutsItsNotesInScratch baselined the tree after the note was already written, so its landing read could never have observed anything: the record stayed empty because of the ordering, not because of the address. The baseline now happens first, in the executor's own order, and a hint that ever points into the tree again fails on the observation, not only on the spelling. And the other half of the law is pinned down: a file that turns up in the person's tree while the leaf runs — even at a name wearing the run's own task-<n>-<slug>.md shape — is still observed and still lands in the record the delivery gate is held to. Only the run's own note moved; nothing else about what the tree says was loosened. Co-Authored-By: codeaf <[email protected]> * docs: the change note for the root's overflow file moving out of the tree --------- Co-authored-by: codeaf <[email protected]> * chat: the wordmark is drawn CodeAF, four rows, capitals on the d's cap line (#1106) `┌─┐ / ├─┤ / └─┘` is not an `a`, it is two closed bowls of equal size stacked on each other, and two equal closed bowls are an `8`. That was the second-to-last glyph of the product's own name on the first screen of every fresh install. The owner's answer is to have the two letters at the end stand up out of the word as capitals: `A` is an apex, a crossbar and two legs; `F` is the one letter whose case is told by its arms alone, so its top arm is the longer one. A CAPITAL'S TOP IS THE ASCENDER'S TOP, and three rows of box-drawing could not give it that. A bar is drawn at the middle of its cell and a stem reaches the cell's edge, so the `d` stood half a row over any capital however it was formed — and a stem in the bottom row hung half a row under the bowls' baseline the same way. The fourth row is that half a row made whole: the x-height letters live in the lower three and leave the top row blank; the capitals and the `d`'s ascender start in the top row, the ascender as the half-stroke `╷` so its top is the capitals' bar; and every stem that ends on the baseline ends as `╵`, which stops where `└─┘` does. A `│` in the bottom row is a descender and nothing else. THE WORD IS SPELLED `codeaf` AND DRAWN `CodeAF`. `product` is unchanged, the glyph table is still keyed by its lowercase letters, and a terminal that cannot draw boxes still gets the word `codeaf`. The greeting's centring test read the unit's left edge off the wordmark's first row, which is now the cap line the x-height letters leave blank; it reads the second row. The one manual page that draws the wordmark had been drawing the retired `aforge` letterforms under the label "the codeaf wordmark" — the name law walks text and cannot see a name spelled in box-drawing — and draws the shipped forms now. Co-authored-by: Claude Fable 5.1 <[email protected]> * A real release download finishes: the 3-second check clock no longer covers the asset (#1110) * update: a release download gets its own clock, not the check's The release client was built as http.Client{Timeout: 3s} because three seconds is right for the launch check, and Go's Client.Timeout covers the WHOLE exchange including every body byte. The same client then downloaded the release asset, so a 57 MB download on a healthy link — about eight seconds here — was cut off three seconds in and a person read `read the release response: context deadline exceeded`. Client.Timeout is gone. The transport bounds only what has made no progress: a 5 s dial, a 5 s TLS handshake, a 10 s wait for response headers. Every call now takes its deadline from its context. The launch notice and `--check` share the one CheckTimeout constant, install metadata gets 10 s per request, and the asset gets a 30-second no-byte stall window plus a 15-minute ceiling — a dead link fails with a sentence, a slow one finishes. No Go deadline text reaches a person. A stall says `downloading codeaf-linux-amd64 stalled — no bytes for 30 s`, the ceiling says `took longer than 15 minutes`, and late headers say `did not start arriving within 10 s`. The stall window, the ceiling and the metadata window are injectable, so the tests prove the clocks with real slow, silent and trickling servers rather than waiting out the shipped ones. Co-Authored-By: Claude Fable 5.1 <[email protected]> * update: both doors read the one check constant `codeaf update` and the chat surface each spelled `3*time.Second` when they built the release client, which is how a figure meant for one small request came to govern an install. Both now pass update.CheckTimeout, and the three seconds live in exactly one place. The terminal's `--check` takes the client's Check, which is the whole-exchange check deadline; a plain `codeaf update` keeps Select, so the metadata requests an install makes get the ten seconds they need. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: the update download's own clock (#1110) Co-Authored-By: Claude Fable 5.1 <[email protected]> --------- Co-authored-by: Claude Fable 5.1 <[email protected]> * docs/changes: v0.2.1 rolled up into CHANGELOG.md (#1113) The 33 entries that landed on dev since the v0.2.0 roll-up are the ## v0.2.1 section of CHANGELOG.md now; docs/changes/unreleased/ keeps only this pull request's own entry. Stable v0.2.1 takes its notes from that section. Co-Authored-By: Claude Fable 5.1 <[email protected]> * README: telemetry folds under Docs (#1115) The 23-line Telemetry section between Install and the product tour becomes one collapsed block at the end of Docs: a plain summary line, the notice verbatim, one sentence and the link to docs/TELEMETRY.md. The notice block is unchanged, so it still matches the binary, the installer and docs/TELEMETRY.md. Replaces #1112. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01NoeSVN8nqmwNVRXExgoUNN * santos/dev lands on dev: crew family, Pareto crewing, the Model Pool, custom connections (#1194) Lands the integration branch santos/dev (#1108, head 6db5125b2, 152 commits over dev) on dev as one squash, plus two fixes that kept its touched-packages job red: the pool start-up test empties the CI word it is not about (649bb4bfd), and a zombie leader no longer keeps a job's process group alive on Linux, which had delayed every finished background job by the two-second termination grace since #1155 (053e6a90f). #1108 carries the full account; the 94 change entries under docs/changes/unreleased/ are the per-change record. The commits folded in, oldest first: 5c413ef7b Keep archived evidence readable while tasks finish 3705a0cfe Document recovery evidence retrieval change 7834cc7d0 tui3, manual: a question's own answer box answers to the whole caret vocabulary 99d66e98c task: Add open/all source toggle to crew config c1e4cb57f docs: the change entry for the crew model family toggle e63b43927 crew: round-1 review fixes 304a5a223 crew: round-2 review fix 65477c0c5 task: Add open/all selector to /crew TUI picker 9189ef764 Merge branch 'task/add-open-all-selector-to-crew-tu-9e8cc0' into feat/crew-open-all-toggle ba9c12d61 crew: reconcile the picker onto config's source helpers ea05bc0f5 crew: a chosen family counts as an answered crew e1a037e0a Merge remote-tracking branch 'origin/dev' into feat/crew-open-all-toggle f6c2924a7 crew: the open table takes the picks we landed on eff44b542 docs: the change entry carries the open-table move and the family gate 71ce9bec0 crew: the family reaches the fallback, the settings skin, and the row's line b8ca5f513 crew: round-1 review fixes on the new table 8db5708ef crew: round-2 review fixes ce9759ef4 crew: round-3 review fixes 956e1f514 crew: round-4 review fixes 37ad27f4e crew: fixes from the first Opus round 6ffb95813 crew: the fixes from the Opus confirmation round 72b027436 crew: the comments the atomic write left behind 70d0e205b crew: round-four fixes from the Opus review 234300e37 Merge branch 'dev' into feat/crew-open-all-toggle 894292f28 crew: round-five fixes from the Opus review fba77f92d An answered landing carries its answer's fate when it is raised again, and an in-flight settle holds the question down (#1077) e69445058 Changelog entry for the landing-answer fate (#1086) 64ab7eae0 crew: round-six fixes from the Opus review 070016419 crew: round-seven fixes from the Opus review af09aa852 The review round's four findings: claim ownership, decider changes, recordable answers, plain words c24af0248 crew: round-eight fixes from the Opus review 289d372b9 The tests the landing's answer carries: fate, hold-down, redraw, claim doors 7e38346a9 The take-down comes before every mint, and the tui3 walk reads the newest card dbe1be03e The review rounds' last word: the release owns its claim, and the docs say what the code does 4cc4945a7 The Opus review: a release owns its generation, and every failed round still says its word a5cce0dde The done card says who is deciding, so the clause is a duplication, not the fact 6bd276e6c Merge fix/1077-landing-reraise into santos/dev 271016938 Merge feat/crew-open-all-toggle into santos/dev b459399d3 Merge fix/question-answer-box-caret-keys into santos/dev a38492026 Merge codex/recovery-evidence into santos/dev dc22e6461 cmd/codeaf: the role-door tests read the shipped mastermind instead of a copy of it 39f528f70 release: the pin-example check reads the guide the examples moved to 6439d3cb8 session, tui3: gofmt the three files santos/dev merged unformatted 854037967 tui3: a question's answer box kills to the end of the line on ctrl+k d93ec61ea session: the late-attach proposal test holds the work until the replay is read a81ead4de session: the landing-fate tests read today's clock instead of a fixed date 8fe4fff38 provider: the retry-avoid list rides the call's context into the knobs a266da3e2 provider: the retry-avoid veto narrows the wire through one field law 197d89334 exec: a node retry asks the router to avoid the lanes that failed it 2d02cc0b9 provider: the set-servable law's doc comment keeps its paragraph break e1d0e7524 exec: the retry test names its helper and spells its wall in time units e7d65a517 docs: the change note for the retry that avoids the failed upstream 11decbd92 Merge fix/provider-failover into santos/dev c099a51c2 Merge dev into santos/dev e47d92bde provider, exec: the lane a failure names is a wire fact provider reads (#1105) 396be97be Merge dev into santos/dev 3b97f50c3 Merge dev into santos/dev ea3b5c9a0 telemetry: the send path drops events that cannot name their version 573b288e4 cmd/codeaf: keep smoke runs from sending usage counts e8d627c6b docs: the change note for the usage-count audit fixes 11bec8d80 chat: a hosted session's usage counts are read off the events it receives b9d75b39e chat: the hosted-count tee is tested against the tally it must produce 39fa08d3d telemetry: stamp a version in the lifecycle tests 681e2adf1 chat: count the hosted boot agent once, and conversations opened beside 825ef2c41 connect, settings: named, multiple, switchable custom connections (#1092) f4d3f9a1a Merge branch 'dev' into fix/telemetry-audit 76fec37e3 ci: the Model Pool mirror workflow and the signature check it runs 2fb296bf1 crew: Pareto crewing, the learned picker and the Model Pool (#1093) a065ebb1b Merge remote-tracking branch 'origin/dev' into santos/dev 80ac250a0 Merge remote-tracking branch 'origin/feat/pool-mirror-workflow' into santos/dev 6092393ab Merge remote-tracking branch 'origin/fix/telemetry-audit' into santos/dev ef808dda4 session: a decision card under --yolo takes its default (#1117) 70a9e1f6e session: a task's thread stops its parts before it closes, and a machinery cut says so (#1118) c4df8f364 crew: an auto seat's rung names the pick that ran, once, for both doors (#1119) a9fcf9bc8 crew: a bare auto row under picked from = catalog reads the catalog's figures alone (#1120) 13be0dce4 relay: accept the exec and run doors, not only task and do (#1121) 90f29aec1 changes: name the #1120 note by its PR and stamp the pr field 0b77926ca do: seat from the settings the run will use (#1122) 32148d87d changes: stamp pr: 1120 on the #1120 note 113ed628e pool: a launch's start-up errands stop when the process closes (#1124) 6c98ddca3 verify, codeaf: a launch compiles fewer patterns and a surface holds fewer Ps (#1125) 50fe6a3e4 pool: the min_installs floor counts installs on the client (#1127) 076cde8ae relay: fold a resubmitted row once by its nonce (#1128) 8339ae71b relay: carry the acceptable metric beside role_quality (#1129) 0367c441b outbox: a refused row leaves the outbox and the rest of its batch is sent (#1130) 09aecd2f1 relay: the index holds only the cells that meet the min_installs floor (#1131) ae7c05dcd outbox: a Send compacts the file to the rows it still holds (#1133) 9e24f72d8 pool: the errand tracker's critical sections unlock from a defer (#1134) 358a569aa relay: fold a submit batch with one read and one write per distinct cell and day (#1136) a1d2eb1f7 pool: judge landed-but-unjudged runs on the next chat start (#1132) 3c6722859 verify: take the finished-tree check at a project cloned into a subdirectory (#1135) 263625b63 exec: a headless run leaves a pending judge record at its tail (#1137) 8be373d39 run: the headless task door leaves a pending judge record (#1138) a336b246e do: leave a pending landing for the Model Pool's judge (#1139) 8820a5659 cmd/codeaf: one readPendingRows test helper, not two (#1140) 49760fb45 pool: show and verify print both metrics the index carries (#1141) 6eaeb25c9 pool: status shows the pending judge records and the last sweep (#1142) 7c00b5f2c codeaf: a test's crash fixture stays in a profile the test owns (#1145) fc2eb357a manual: the status row's ledger is the tree's, not the conversation's (#1143) a06b53a91 test: pin the delivery gate over a grown job root (#1147) 7231347eb resident: the wall refuses a first replan round it cannot hold (#1144) 5e257557f cmd/codeaf: the package's test floor clears a profile the environment named 4dd1c562f Revert "cmd/codeaf: the package's test floor clears a profile the environment named" 9075f863c pool: the seed index is regenerated from the relay by seedgen (#1148) a5c44f3d2 pool: show --cells lists the held index's cells with installs and dims (#1149) 825996739 cmd/codeaf: the package test floor clears a profile the environment named (#1150) 81568aa82 session: report gitignored build products a run leaves, without gating on them (#1152) da4910593 internal/tui3: the opening hint test owns its profile and pins both doors 72de3bca7 docs/changes: #1151 — the opening hint test owns its profile 499083d1c Revert "docs/changes: #1151 — the opening hint test owns its profile" beb31ecf7 Revert "internal/tui3: the opening hint test owns its profile and pins both doors" 25b8b7dea version: an unstamped binary names the condition, not a Makefile target (#1151) c833b423a pool: a dropped row keeps the relay's reason and status shows it (#1154) cbb7d6d9e processgroup: verify a job group's identity before signalling it (#1155) efe498ed0 internal/tui3: the opening hint test owns its profile and pins both doors (#1153) 17b3b0e40 do: a continuation continues the plan it has instead of re-planning (#1156) 22cf3ce17 changes: correct the #1155 and #1156 notes' pr fields (#1157) 8e85b0fe7 cmd/codeaf: a surface runs under a soft memory limit drawn from the machine (#1158) ef1e92756 task: status row accounting (#1159) 44f572e26 pool: status's index line says what this run's fetch did to the cache (#1161) 3600fc9a5 pool: the pool's copy of a seat's id is the bare vendor/id (#1163) a2ebd1397 cmd/codeaf: no test can push pool rows to the default relay (#1164) 4fb7f0546 docs: the road a chat door bash push took under --yolo (#1160) 69219a1e1 cmd/codeaf: the soft memory limit is the smallest real bound, not the host s memory (#1162) 2b155b4b4 relay: bound judge severity, clamp adjusted scores, publish mean and sd on one scale (#1165) 2fb55324a relay: purge fixture vendors and refuse them at the door (#1167) 57504187a exec: a job's shell cannot reach the tmux server hosting codeaf (#1166) eb7b46559 internal/session: an unattended run may not move a branch it did not create (#1168) 80f770639 pool: status says the identity, the judged total and that nothing has landed (#1169) 1cb7333fa exec: an exec run's worker spend reaches the usage ledger (#1170) 96bb9402e changes: the #1169 note's title parses and reads as one line (#1172) 627236d95 config: the task door honors a stored crew word, and a pin survives the learned pick (#1171) 593092be6 internal/tui3: a test may not read a profile it did not create (#1173) ad8be1ed7 session: a landing card under --yolo takes its default instead of parking the run (#1174) 03d49a678 gitignore: the .furrow ids the engine writes into a workspace (#1175) 46edbdd32 internal/tui3: gofmt the profile-law helpers from #1173 (#1176) 3179e3611 relay: ALLOWED_VENDORS names the catalog's vendors and codeaf (#1177) 397a145a6 docs: why a settled /task leaves commits on task/<slug>, not the worktree branch (#1178) 915ff3a76 pool: regenerate the seed index from the relay's first clean publish (#1180) d9b42430f cmd/codeaf: the model warm stops when the process closes (#1179) bd2dcf334 session: the auditor's calls say they are the auditor's and which node they check (#1181) c6ed47c5a task: json unverified branch (#1182) 360352ad4 session: a settle turn runs under the checker's own bound, not the run's wall (#1183) 814e1af0e session: the tasks text and record line name a failed/unverified node's kept branch and verdict (#1184) 7c25a26d9 internal/session: the identical-effects test stops riding the turn guard (#1185) 6e7d0ed44 cmd/codeaf: exec and run envelopes name a non-verified node's kept branch and verdict (#1186) f4079d716 session: bound a worker's park on a promoted command (#1187) 994689fe7 docs: the model pool runbook names the Workers Paid plan and what it costs (#1188) c315be13e docs: the runbook's plan line says metered, not capped, and nothing more (#1189) 2e80c60d8 internal/tui3: the status word says working while a task subtree turns (#1191) 99363ca8f session: bound a job subtree's CPU and process count (#1190) 6db5125b2 docs: what the audit check seat can execute, and where that boundary is set (#1192) 649bb4bfd cmd/codeaf: the pool start-up test empties the CI word it is not about 053e6a90f processgroup: a zombie leader does not keep a job's group alive b4e66f515 docs/changes: the entry for #1194 Co-Authored-By: Santosh kumar <[email protected]> Co-Authored-By: Claude Fable 5.1 <[email protected]> * ci: Model Pool mirror workflow (signed index onto the model-pool branch) (#1116) * ci: the Model Pool mirror workflow and the signature check it runs Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs: the change entry for the Model Pool mirror workflow --------- Co-authored-by: Claude Fable 5.1 <[email protected]> Co-authored-by: santoshkumarradha <[email protected]> * chat: the unconnected custom row on /connect keeps its vendored name (#1195) modelConnectionStatus renamed every custom-id row to the connection's Written word, and the catalog template's Written is the bare id, so a person who had connected nothing yet saw `custom` where the manual, the README and #1107 say `Custom OpenAI-compatible API`. Only a connected instance is called what the person called it now; the contract test draws both rows and is red without the fix. Found verifying the staging build of #1194. Co-Authored-By: Claude Fable 5.1 <[email protected]> * docs/changes: v0.3.0 rolled up into CHANGELOG.md (#1196) 95 loose entries — the crew family and Pareto crewing, the Model Pool and its relay, custom connections, the telemetry audit, the update door's download clock, and the fixes that followed — become the `## v0.3.0` section the stable release reads its notes from. Co-Authored-By: Claude Fable 5.1 <[email protected]> * ci: a changed directory in a nested modu…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/modellists 600 models. You can't scan it. This makes it scannable.Before
Every figure correct. No two rows put the same fact in the same place.
After
Real renders, owner's live catalog, 108 cols. Opens alphabetical:
alt+ssorts by the next column,alt+shift+swalks back. Every column is twopresses — its own direction, then reversed — so one key reaches every order:
→opens a model's providers — two levels, their own table, their own sort:Narrow frames fall back to the old tail — it's better per row, only worse down the
page.
What else moved
Columns, not verbs.
sees/hears/watches/draws/films/speakswere six invented words each carrying a side and a thing. Now the catalog's own
nouns under
inputs/outputs. Blank = text in, text out.Enter no longer closes the list. It applies and stays open, so you can compare
two models and change back.
esccloses.autoandopenroutersit together — they're the two things you're choosingbetween, and under
simplerouting they send the same thing. Dropped the bullets(they claimed a distinction the wire doesn't make) and the dim paragraph that
re-printed each row's own numbers in prose.
enteronopenrouteropens it andlands on
default, which reads as "these exist, and you've chosen not to pick".The filter box searches names. Only names. It used to also take
@cloudflare,<1s,>50t/s,$<0.3,fp8,tools,fast,cheap— a query language you hadto read a manual page to know existed. Those were questions about facts, and the
facts are columns now, so you can just look. Type
$<0.3and you get an empty list,not a silent reinterpretation.
→/←stop fighting the caret. They're the tree's keys unless you're mid-typing(within 600ms of the last change to the box). Leaving an open fold used to cost one
press per character typed. Any edit takes the caret back, and
ctrl+b/ctrl+fdo itwithout changing your query.
One order for the foot, at every level — grouped by what each key moves:
Four things were plain broken.
→ providersandctrl+tdid nothing on home'smodel list while the UI advertised both. The provider heading was drawn but not
counted, so the fold could overflow.
←ondefaultclosed two levels at once.And
openrouterdidn't name→ providerswhen nothing was measured, though the keyworked.
Two bugs worth calling out
The sort read the wrong lane.
via,firstandt/scells come from the lane arow names; the sort asked
bestLaneinstead. So rows with blank cells carriedreal numbers into the sort and the blanks didn't group. One reading now serves both.
An alphabetical default buried the best match.
gptreturnedanthropic/claude-gpt-echoabovegpt-5-classic— the search itself going wrong.The name column now orders by relevance first, alphabetically only inside a tier.
Both found by trying it against the real 521-row catalog rather than a fixture.
Proof
make pr-ready+make test-lawsgreen. 51 new tests, 30 new manual probes.Manual updated, including a page that says the filter grammar is gone and points at
the columns instead — the old keystrokes are in its heading so they still retrieve.
Also fixes two
cmd/codeafupdate tests that failed on every macOS laptop andpassed in CI (
t.TempDirgives/var/..., which the update door resolves to/private/var/...on purpose). Product untouched.Still red on clean
origin/dev, not mine:TestTheOpeningHintNamesBothDoors,internal/release's ledger test (#1060).🤖 Generated with Claude Code