Preserve Joseph Steuer Jr's original contribution and adapt it to current
answer-first delivery, owner replies, cold continuation and forced exits.
Reviewed by Claude Code Opus, Codex Astra and GLM (CODE and coupling).
Product blobs match the reviewed subject; private QA evidence stays external.
Final composition: 83 scoped tests pass; full/native QA is not claimed.
A wake's own turn can opt into finish_task(silent=true), retaining a durable wake_silent result without a final chat/outbox row. Owner turns and wake-started tasks cannot use the door. A later fresh unselected response, even empty, replaces a held silent candidate rather than publishing its previously hidden content; explicit/resumed silence remains available. Adapted from local evolution commit 8ee570e4f and fixed against independent reviewers' held-candidate findings. Prompt bytes 1421 -> 1573 (+152); release carriers unchanged. Focused 17+48 tests green; four Windows artifact-identity failures reproduce on clean base.
Wake prompt (prompts/CONSCIOUSNESS.md) opens with judgment and continuity instead of
budget and a closed menu; cash, subscription quota and time are named separately.
Observe autonomy keeps research, internal memory, task artifacts, project notes and
read-only children (argument-narrowed at dispatch) while every world-mutating verb,
patch disposition and publication route is withheld (OBSERVE_WORLD_MUTATION_TOOLS).
Schedules gain an audited owner-governed lifecycle (manage_schedules tool +
POST /api/schedules/{id}/action): disable/delete/restore with intent-then-outcome
audit rows, durable suppression of skill-manifest rows keyed by schedule id (restore
lifts it only into an extant manifest), consumed one-shots as collapsed history in
Activity, typed lock-timeout and unreadable-store refusals; the owner lifecycle lives
in supervisor/schedule_lifecycle.py beside the store in queue_schedules.py.
Version-neutral contribution; release carriers untouched.
A consciousness wake-up is an ordinary Main turn, but it was built only from the
wake envelope, so it carried no host routing manifest. On the live stand the
first wake chose a predecessor and got AUTHORITY_SOURCE_UNAVAILABLE twice: the
authority check reads the predecessor off `main_routing_manifest`, which only an
owner message's decision turn ever produced, so every id the wake named was "not
an addressable result" and the work it had decided on never started.
`main_lane_routing_metadata` is one seam over the owner path
(`_decision_turn_metadata` with no client message), so a wake and an owner turn
can never drift apart in what the host makes addressable. The supervisor binds it
to the same routing context the owner path uses and hands it to the alarm clock,
which merges the facts under the wake's own markers. A failing seam is disclosed
and the wake still starts fresh work with `predecessor_task_id=""`. The wake-up
template now says which of the two it is passing.
The same stand showed the second half: the wake's route DID mint a root, with
empty metadata and the ordinary `task` ledger category. Only
`promote_chat_to_task` put the consciousness origin on its event, while
`route_to_project` builds its own promote-shaped event, so the single admission
door never saw that root as consciousness-started. It now inherits the origin by
value through the same helper and the same supervisor read.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
A consciousness wake-up is now an ordinary Main direct turn nobody typed
(owner decisions В13/В15): the same system prompt, memory, tools and loop as
an owner's message, started through handle_wake_direct with the wake's
origin/authority envelope and a rendered user message. ouroboros/consciousness.py
is rewritten as the alarm clock only (1533 -> 289 lines): tick(now) runs from
the supervisor loop beside publish_direct_roots — disabled -> live wake ->
live owner turn -> not due -> rolling-24h allowance (allowance_unknown is a
disclosed skip, never a silent block) -> owner chat bound -> launch; the next
wake is last finish + the model's set_next_wakeup interval (or
WAKE_DEFAULT_SEC), clamped into the owner's bounds, doubling on a runner
failure; notify(reason) pulls the next wake to max(now, last wake + min)
(arithmetic debounce) from a finished root task (any outcome, never a
consciousness-origin one), a project digest and the orphan-heal sweep; an
owner message no longer wakes it. Liveness is the DirectActivityRegistry
alone; /bg stop and toggle_consciousness(stop) arm a graceful stop of a live
wake off-thread; the legacy observation inbox is moved once to archive/
without being read. The health WARNING/CRITICAL trigger is not implemented
(no producer exists) and says so in the docstring.
prompts/CONSCIOUSNESS.md is now the wake's USER message template, rendered by
the new ouroboros/consciousness_wake.py (events since the last wake from
task_results, open owner cards and owner-message count, truncated with an
explicit "(+N more; see recent_tasks)" line; wake_task_metadata builds the
envelope). set_next_wakeup becomes an ordinary registry tool in
tools/control.py.
Gone with the loop: BACKGROUND_DELEGATION_ROLE and its consumers
(owner_delivery deferred frames, the _escalate refusal), the bg model-wait
twins and get_background_model_wait plumbing, BG_CONTEXT_*/BG_OBSERVATIONS
budget constants and the inbox hot-store tripwire, the CONSCIOUSNESS.md
whitelist drift check, the startup inbox fold, the consciousness pause/resume
around owner turns and both "Message from my human" injections. The
OUROBOROS_BG_WAKEUP_MIN/MAX keys leave the restart-required set (read at each
alarm decision); docs/architecture/07 and the Settings note say so.
server._describe_bg_consciousness_state projects honest statuses (disabled /
stopped / thinking / sleeping until HH:MM / waiting_for_first_conversation /
allowance_exhausted / allowance_unknown / wake_rejected / wake_failed);
Activity and Evolution render the new snapshot; api_types documents it.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
SYSTEM.md `## Memory` now says knowledge holds understanding of every kind — the
people I work with included — kept apart as told / observed / inferred, dated,
sourced and revised in place; a correction is situated evidence, not a standing
rule; the authored summary is a note's resident face; the global overview is the
shared orientation loaded into every context. `## Environment and My Human`
describes my human as a relationship, not a role, and how a person is learned.
CONSCIOUSNESS item 3 and the hygiene paragraph cover what I believe about people.
The knowledge tool schemas own the operational contract: scope guidance, no topic
prefixes, the summary-in-frontmatter rule, and GLOBAL_ONLY_TOPICS (backlog,
overview) resolved to the global shelf from any room, for Light nominations too.
The reflection tail nominates learning about people; its docstring states the
real project-root contract (knowledge only, explicit global allowed).
Prompt bytes: SYSTEM.md 23084 -> 24071; CONSCIOUSNESS.md 6895 -> 7154.
Triad + scope gate batch (bea77440 receipts):
- A divergent install applies an official target as a synthetic merge commit
(supervisor/update_merge.py), so HEAD never equals the target it consumed.
project_letter now takes the check's own zero-behind fact (`consumed`) and
reads such a letter as `applied`; the panel payload and the Runtime fact
both pass it. No git on the hot context path.
- A letterless record written by an up-to-date check now carries the official
target's VERSION, so the Runtime fact can name the version "up to date"
means (target.version was empty on that path).
- A concurrent fetching check waits for the in-flight write (bounded by the
letter timeout) and shares its result for the same key instead of paying
for a second letter or returning a stale one.
- OUROBOROS_UPDATE_LETTER_TIMEOUT_SEC is read through a typed, clamped
config.py getter (DEVELOPMENT "Timeout & Wait Control"); config.py stays
under its 1600-line pin by re-wrapping three docstrings.
- prompts/CONSCIOUSNESS.md: the official_update guideline is one sentence in
the neighbours' voice, and the two wakeup-length bullets that said the same
thing are one; 6682 -> 6895 bytes against the official tip (6927 before).
- The letter is exercised on the real Dashboard -> Updates flow in a real
browser at a phone width (tests/test_ui_smoke_update_letter.py, ui_browser
lane; a sibling file because test_ui_smoke_playwright.py sits at its byte
gate): named section under the single action, above Recovery, sanitized,
verdict untouched, no horizontal scroll. Inspected with vision on the live
isolated install as well (screenshots in the PR).
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
A fetching managed-update check (boot, and the Updates panel's Check for updates) now
also writes an update letter: one accounted LIGHT-slot call with the ordinary task
context (build_llm_messages routed at the light model), fed the first-parent commits
between the running base and the official target plus the README Version History rows
those commits added, recovered from the commit diffs because the table is capped and
untagged releases have no tag to look up.
The letter lives in state/update_letter.json under its exact (base, target, channel,
ref) key and is never deleted after the update lands; one projection relates it to the
live HEAD (pending / applied / superseded / other) for both the Updates payload
(`letter`) and the Runtime context, whose new `official_update` fact tells every task
and every consciousness cycle whether the body is current with its official source as
of the last check. No wake is forced, no new endpoint or WebSocket type, no model
substitution when the light slot has no credentials (typed failure instead), the last
good letter survives a failed rewrite, and cost stays in the ledger by attempt id.
CONSCIOUSNESS.md gains one guideline (6682 -> 6927 bytes): mentioning an update is the
mind's judgment, not a duty.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
SYSTEM.md (69,760 -> 24,743 bytes) now carries only what no other resident
surface carries: identity and tone, the decision loop, cross-tool policy,
prohibitions and safety invariants stated once, and the memory contract.
Tool schemas are sent on every round to every profile
(tool_policy.initial_tool_schemas -> registry.schemas()), so every paragraph
that restated a tool's parameters, signature, recipe or typed outcome was a
second copy that drifted; per-turn runtime blocks (Available subagents,
capabilities/queue, receipts, health invariants) and the resident BIBLE /
ARCHITECTURE carried the rest. A rule-by-rule gap check classified each
removed sentence as schema-covered, runtime-covered, doc-covered, or
load-bearing; the load-bearing residue stays as single sentences.
The text before the first "## " heading (1,477 bytes) is the local-model
compaction floor (llm.py keeps only the preamble plus the BIBLE section for
the static block): identity, the one-routing-decision rule, the owner-only
supervision rule, panic, honesty and secrets. Stale facts fixed: identity
timers, model_lane / executor / effort fields, may_delegate, Immutable Safety
Files heading, the frozen/release path list (now a pointer to
runtime_mode_policy), the schedule_followup one-shot claim, the crash-rollback
claim, the SAFETY_UNAVAILABLE cause (429 only), which calls reach the LLM
supervisor, scope review under the owner's context mode, branches/remotes
(managed), evolution waits, request_restart, the import-failure vs Capability
Acquisition contradiction.
SAFETY.md (8,623 -> 6,610): platform-neutral wording; the protected-path list
is an exact mirror of runtime_mode_policy PROTECTED_RUNTIME_PATHS (+ the
contracts/ prefix) and is pinned by a test; the seven owner-control bullets
are one directional matrix (control, forbidden direction, channels incl. the
dedicated owner endpoints, read carve-out, legitimate owner path); the Note
names MCP tools, which reach the supervisor with no deterministic pre-scan,
and the POLICY_CHECK roster.
CONSCIOUSNESS.md (7,570 -> 6,682): the hand-maintained "You can" tool catalog
is gone (the visible schemas are the complete set for the mode); dropped the
automated-consolidation checklist item, the identity UpdatedAt/24h claims,
the plan_task reference and "Be economical".
Tests: test_packaging_sync re-pins the "## Safety-critical files" section as
an exact set equal to SAFETY_CRITICAL_PATHS and adds the SAFETY.md mirror
test; the delegate_start recipe test treats SYSTEM.md as tolerant (recipes
live in the schema); a new test pins that the real SYSTEM.md keeps its floor
rules under local compaction within 1,536 bytes.
Co-authored-by: Ouroboros <311266734+ouroboros-agent@users.noreply.github.com>
C2 Phase 2 of cross-task self-evolution. The durable improvement backlog stops
losing signal:
- A recurrence: a repeat bumps count + last_seen in place (and re-opens a closed
item) instead of being dropped.
- B ranking: digest sorts by priority (high/med/low) then recurrence count then
last_seen recency, so an important older item outranks a junk burst.
- C close-on-commit: close_backlog_items flips items to done+closed_at; a promoted
item is closed only when its reviewed self-mod commit is restart-verified and
ABSORBED (apply_pending_request records a backlog_id validated against the open
backlog; verify_restart closes it on absorb, clearing the stale link in both
absorb branches).
- D grooming + idea intake: groom_backlog (light model) merges near-dupes, marks
resolved, caps the list on a size-triggered non-error-gated schedule. It grooms
only auto-generated (fingerprinted) items, passes hand-added no-fingerprint items
through verbatim (lossless _raw re-serialize), never invents/over-drops survivors,
and aborts on a concurrent change (no lost updates). Reflection nominations gain
optional priority + kind (bug/improvement/capability_idea). CONSCIOUSNESS.md
backlog upkeep points at the automated grooming.
Additive schema; existing items remain valid. Reviewed: 3 adversarial models +
triad+scope (clean). Tests: tests/test_improvement_backlog.py (+ post_task_evolution
link validation + startup close-on-absorb).
The fifth release-candidate pass removes ~3k LOC of verified duplication without weakening the immune system or regressing governance docs.
Group A (12 direct dedup wins): test_run_shell_string_cmd_is_hard_error duplicate, Python-port tests for never-landed JS helpers (stripPlanPrefix, extractRecallEntries), README prose pins, marketplace.js default export, four web helpers (safeExternalHrefAttr, renderMarkdownSafe, boundedText, fetchJson) consolidated into utils.js SSOT, four copies of _emit_live_log to ouroboros/utils.py::emit_log_event, onboarding IIFE escapeHtml SSOT-mirror with byte-equivalence guard test, three inline style display:none to HTML hidden attribute, _now_iso to utc_now_iso, _write_json_atomic thin wrapper inlined, _CHECKLISTS_PATH duplicate path walk and dead re-exports removed.
Group B (11 doc/prompt redundancy reductions): SYSTEM.md duplicate Versioning sections consolidated AND active git-tag-collision bug removed (previous "Create annotated git tag" instruction conflicted with auto-tag in repo_commit and broke auto-push), BIBLE-doctrine restatements compressed to short pointers, commit/obligation flow narrative compressed to 6-bullet in-loop reminder, CONSCIOUSNESS.md duplicate Tech Radar section removed, README.md ASCII tree + philosophy table + Layered Safety essay + TRUST_NONLOCAL_BIND triple all collapsed into pointers, CREATING_SKILLS.md skill-review enum points back to CHECKLISTS.md (SSOT), two narrow ARCHITECTURE.md "Prior to v4.36.1" historical narratives rewritten as "Why warning-only:" rationale that preserves the *why* under P6.
Group C (4 SSOT consolidations): 850K token budget moves to tools/review_helpers.py::REVIEW_PROMPT_TOKEN_BUDGET (consumed by scope_review/plan_review/deep_self_review); _load_bible / _load_dev_guide_text / _load_architecture_text route through load_governance_doc(..., on_missing="explicit") so missing core docs surface explicit OMISSION markers instead of silent empty strings — fixes a DEVELOPMENT.md "No silent truncation" violation; SETTINGS_FALLBACK_MODELS in settings.js gets a guard test against config.py SETTINGS_DEFAULTS (caught real anthropic/claude-sonnet-4.6 drift); _record_commit_attempt (20-arity, violates DEVELOPMENT.md "<8 parameters") gets @dataclass CommitAttemptRequest while a backward-compat kwargs adapter keeps all 47 existing call sites intact.
Group D (4 frontend cleanups): dead hostPage='settings' defaults in logs/costs/evolution/updates.js flip to 'dashboard' (Dashboard sub-tab migration v5.7+); .dashboard-tabs/.skills-tabs CSS verbatim duplicates of .app-tab-strip/.app-tab deleted; 50 hardcoded rgba(201,53,69,X) literals collapse into nine --accent-* tokens (after dry-run #2 caught a self-reference cycle in :root, test_accent_tokens_have_concrete_rgba_values pins the fix); 30 border-radius: Npx; literals adopt --radius-* tokens with new --radius-md: 10px (added to docs/DEVELOPMENT.md Border radius scale table per advisory).
Group E (5 test dedup; E1/E2/E3 deferred to follow-up RCs): test_review_models_configured (dup with test_settings_effort), test_settings_ui_js_exists + test_render_settings_page_function_present (subsumed by stronger backtick-balance tests), two TestReviewInCommitPipeline tests (strict subsets of test_scope_review), test_imports_after_bughunt_dont_raise (pytest collection already imports), and chat_logs_ui plan-mode JS tests (canonically in test_chat_js_contracts).
Group F (module splits) deferred entirely to follow-up RCs because the plan classifies F1-F4 as "move not delete" (~250 LOC moved, not reduced) and the regression risk in repo_commit's monkeypatch surface outweighs the value of mid-flight architectural splits when A-E already delivered the line-count target.
VERSION bumped 5.8.3-rc.4 -> 5.8.3-rc.5; pyproject.toml carries the PEP 440 5.8.3rc5; README badge + changelog row + ARCHITECTURE.md header all in sync.
Note on changelog rolloff: the v5.8.1 and v5.8.2 patch rows were rolled off to respect the P9 5-patch-row cap; their full bodies remain at git tags v5.8.1 and v5.8.2.
Review process: full local pytest green; visual UI smoke through MCP browser confirmed Chat/Skills (My/ClawHub/OuroborosHub tabs) / Widgets/Settings/Dashboard render and switch. Real triad+scope dry-run via scripts/run_external_review.py converged after four rounds: round 1 preflight-blocked on missing VERSION (expected), round 2 caught CSS self-reference cycle (4 critical findings + 2 advisories — all fixed), round 3 caught residual resultEl.style.display + unused dataclass.field import (2 critical — both fixed), round 4 PASSED with critical_findings empty. Scope review downgraded to non-blocking advisory due to ~975K-token repo pack exceeding 850K budget — documented BIBLE P3 architectural pressure that further dedup passes will need to address.
