workspace/trvm › bots

Bots

A Bot is a persistent conversational role over the world — not the model, not the engine, and not the authority. It explains; Nav organizes; Runtime proves. An utterance here is not world truth — it is a cited derivation from one coherent frame, and every claim in it is bound to an object that frame actually contained. The world moving does not falsify the derivation; it makes the snapshot claims inside it stale, and only those.

ask

Each utterance names the projection it derives from. Sampling a cursor after the content is not enough — two claims read either side of a mutation get one label and the frame is torn. So the frame is built once, under a stability check, and the reasoning happens against it. A claim citing an object that frame did not contain is refused unobserved-citation, which is why a Bot cannot assert something it was never shown.

The board is not hand-drawn UI. It is bot-projection@1 rendered by this Bot's own program, and it can show nothing outside it — no global grant count, no other actor's approval queue, and no digest over authority the Bot may not see. What the person may inspect about a Bot is a different view on a different channel.

Delegation

A Bot may delegate only a capability it holds, and the child must narrow or equal every dimension of the parent — resource, duration, workspace, run, placement, budget, policy. Capability-and-duration alone is not enough: a delegation that keeps both can still widen the resource from one repo to every repo, or turn human_approval_required into auto. Delegation is not a second way to be authorized. Revoking the parent takes its children in the same operation.

workspace/trvm

Mission Control

The society at a glance. In the production runtime this surface is projected from the running supervisors — never held as UI state. This prototype simulates that projection; its figures are read from the proof artifact.

3

lanes live

7

agents

5

fleet nodes

—

gates green

—

cert streak

Goal

EMISSION_CONFORMANCE-v1

Next with nothing before it. B5.1 argument boundary sealed: parse defect + two siblings fixed, options ruling taken, MAXPATH mechanism built.

spec ✓in_tree ✓live_local ✓live_deployed —external —

Lanes on this goal

Obligations due

obligationConfirm split: film-budget-negative vs film-budget-invalid

obligationAdmit tenth harness species: stale-literal expectations

obligationEMISSION_CONFORMANCE-v1 — merge blocked until film conformance obligations discharge

Latest evidence

film church_exp_2_2 · 21 frames · NORMAL_FORM · replayed on 2 runtime classes

claim overflow case returns refusal film-budget-invalid, never a 21-frame answer to a different question

ruling argv is a transport type, not a capability type → options schema is the authority

workspace/trvm › LaneSupervisor

Lanes

Three independent attacks on EMISSION_CONFORMANCE-v1, each in its own worktree with its own budget. Kill one — the supervisor owns the failure semantics, and identity, worktree, and evidence survive.

compare

Supervision policy

LaneSupervisor strategy: one_for_one · max_restarts 3 / 60s · harness exit → restart child, preserve worktree · evidence · identity · budget
A dead harness is a lifecycle event, not an incident. Incidents are when the ledger disagrees.

workspace/trvm › AgentSupervisor

Agents

Identities, not processes. An agent's engine is a replaceable child under its supervisor — swap it and watch what survives.

kestrelag_kestrel

Lane A · 214 claims · 0 open obligations

claude-code

magpieag_magpie

Lane B · 96 claims · 1 open obligation

codex

shrikeag_shrike

Lane C · verifier · runs the batteries, forges on purpose

test-harness

kestrel — supervision tree

AgentSupervisor (ag_kestrel · one_for_one) ├─ AgentIdentity the part that cannot die ├─ Harness · claude-code animating the identity right now ├─ Memory episodic + ledger citations ├─ Budget 62% of 40k ceiling ├─ Heartbeat 1.6s · silence is supervised ├─ Authority 4 capabilities · snapshot-at-entry ├─ Worktree wt/lane-a @ 4f21c99 ├─ EvidenceCollector emits claims with receipts └─ ObligationTracker what must be proven before merge

Engine ≠ identity: replacing Harness restarts one child. Everything else keeps its pid, its state, and its history.

workspace/trvm › capabilities

Capabilities

Installable abilities, governed. A pack is something you install; a capability is something you're allowed to exercise. Install grants nothing — and every pack here is simulated until ampd exists; the authority model is what's real.

GitHubv1.4.2INSTALLED

MCP · Skill · UI · secret: gateway-only · conformance 42/42 (simulated)

granted to kestrel · scope traaviis/trvm

github.repo.readOBSERVErepo scope

github.issue.readOBSERVErepo scope

github.pr.draftLOCAL MUTATEworktree only

github.pr.createAPPROVALevery effect

github.pr.mergeDENYdefault

duration

placement: LOCAL · FLEET · CLOUD denied (private-source) · receipts: required
secret github.oauth · gateway only · engine-visible: never

github 1.4.2 → 1.5.0 · 14 files changed
+ github.issue.write NEW AUTHORITY
+ api.linear.app NEW EGRESS
+ CLOUD PLACEMENT WIDENED
STATUS: UPDATE HELD — authority surface widened

BrowserINSTALLED

Native · MCP App · egress allowlist

browser.public.navigateOBSERVEany node

browser.inspect · screenshotOBSERVEreceipted

browser.form.submitAPPROVALallowlisted domains

placement: LOCAL · FLEET · CLOUD

PostgresAVAILABLE

Native adapter · destructive SQL refuses by name

pg.schema.read · query.readOBSERVE

pg.query.writeDENIED BY DEFAULT

placement: LOCAL · FLEET · data policy: source stays home

MCP ImportBUILT-IN

Bring any MCP server into Super

Tools become requested typed capabilities — nothing is granted by connecting. UI resources render sandboxed. Super supplies the authority; MCP supplies the transport.

workspace/trvm › fleet

Fleet

Remote machines are just more places for supervisors to live. Moving a lane is placement, not a different mental model.

Placement

LOCAL FLEET CLOUD — three placements, one world. Sites, not copies.

lane-a → travis-desktop (LOCAL) · lane-b → ms02 (FLEET) · lane-c (verifier) → ms02

routine nightly-gate-replay → gpu01 · browser research fleet → cd-west (CLOUD · ComputeDriven)

drag-to-move lands in Rev B; today: ⌘K → "move lane"

Placement is a governed computation

task: synthesizer-training
requires: gpu.cuda
may_run_on: [gpu01, computedriven-gpu]
source_data: denied_remote
artifacts: allowed · max_cost: $5.00

derived placement → gpu01  (source policy excludes cloud)

Not a "Run in Cloud" button — eligibility is computed from capability, cost, and data policy, and the derivation is citable.

workspace/trvm › editor › wt/lane-a

Editor

Your hands on the worktree. The agent gutter says who touched what and links each region to the claim made about it — hover line 121's block.

wt/lane-a @ 4f21c99

governance/
  bridge/
    ic32_film.c ●
    film_check.mjs
  round-11-ledger.md
  negative_battery.sh
runtime/c/ic32.c
verify.sh

114/* strict budget parse — endptr AND errno; they catch different things */

115static int parse_budget(const char *s, long *out) {

kestrel 118 if (*s == ' ' || *s == '+') return FILM_BUDGET_INVALID; /* strtol skips in silence */

kestrel 119 errno = 0; long v = strtol(s, &end, 10);

kestrel 120 if (errno == ERANGE) return FILM_BUDGET_INVALID; /* consumed, didn't fit */

kestrel 121 if (*end != '\0') return FILM_BUDGET_INVALID; /* not consumed */

kestrel 122 if (v < 0) return FILM_BUDGET_NEGATIVE; /* a number; the policy is wrong */

claim — kestrel, cites B-12 · §324
Overflow now refuses by name instead of returning a complete 21-frame answer to a different question. -1 keeps its own refusal: fix a value, not a spelling.

evidence: negative battery — · 3 revert-cases fail the gate

workspace/trvm › EvidenceLedger

Evidence

The ledger. Claims cite evidence; rulings cite the claims they settle; films carry their frames. Select a row — the Inspector shows the frozen record.

epistemic ladder · spec → in_tree → live_local → live_deployed → external — a claim states where it was earned, never higher

kind	epistemic	asserts	emitted by	cites	ref
film	live_local	church_exp_2_2 · 21 chained frames · APP-LAM…DUP-VAR · terminal NORMAL_FORM, replayed on both runtime classes with remaining_work re-derived	ic32 native	45/45	§317
claim	in_tree	Overflow (ERANGE) refuses as film-budget-invalid — no longer a confident complete answer to a different question	kestrel	3	§324
claim	in_tree	Trailing --budget and unknown flags refuse by name: film-budget-missing-value · film-unknown-flag · film-multiple-terms	kestrel	3	§325
ruling	spec	argv is a transport type, not a capability type → emit(term, family, {budget?}) owns the spelling; diagnostics inexpressible through the authority	arbiter	2	§326
obligation	spec	Confirm film-budget-negative stays distinct from film-budget-invalid — value-fault vs spelling-fault	kestrel	1	§327
obligation	spec	Tenth harness species: assertions whose expectation is a literal the round could make stale — mechanically detectable, would have caught 3 of 5	kestrel	5	§328
film	live_local	6 budgets over the same 21-frame computation seal 5 partial films + 1 complete; finishing exactly on budget is NORMAL_FORM	ic32 native	6	§318
ruling	spec	MAXPATH stays a defensive ceiling, not a semantic refusal — witnessed by a -DMAXFRAMES=4 limits build; --limits answers configuration, not the #define	arbiter	2	§329
claim	live_local	No term tried reaches the frame array, because MAXPATH binds first on every one of them — the bounded phrasing, not the unproven universal	shrike	2	§323

workspace/trvm › TRVM

Gates

Green means measured this run. Counts below are produced by replay, never remembered — the app refuses to transcribe a number.

cert — · replay to measure declared-open boundaries listed as declared-open — witnesses, not gaps

$ ./verify.sh
# press Replay — every line below will be produced by this run

workspace/trvm › the bench

Rulings

You are the arbiter. Questions agents flag arrive here instead of dying in transcripts. A ruling is recorded to the ledger, citable forever, and pushed to the agent that asked.

awaiting rulingfrom kestrel · §327

Keep film-budget-negative distinct from film-budget-invalid?

For: −1 is a number and the caller's policy is out of range; 3junk is not a number and the caller's intent is unrecoverable. One code hands a reader a refusal that can't say whether to fix a value or fix a spelling. Against: the strict regex folds both; one fewer code.

awaiting rulingfrom kestrel · §328

Admit the tenth harness species?

An assertion whose expectation is a literal that the round could make stale — version strings, revision numbers, bare polarities. Mechanically detectable in the battery; would have caught 3 of the last 5 defects. Against: governance machinery without a forcing workload.

Ruled

ruling argv = transport, not capability → schema owns the spelling · §326

ruling MAXPATH is a resource ceiling, not a semantic refusal · §329

ruling C-side replay re-filed as verifier diversity, behind EMISSION_CONFORMANCE-v1 · §322

workspace/trvm › RoutineScheduler

Routines

Recurring work as supervised schedules. A failing routine is an event with evidence, never a silent skip.

routine	owner	node	cadence	last	next
nightly-gate-replay	shrike	gpu01	daily 03:00	—	in 7h
ledger-compaction	magpie	travis-desktop	weekly sun	ok	in 3d
stale-literal-sentinel	shrike	ms02	every round	awaiting ruling	—
dependency-sweep	magpie	cloud-west	weekly wed	ok	in 6d

workspace/trvm › AuthorityGraph

Authority & Budgets

What each identity may do and may spend — typed, snapshotted at entry, revocable. If the schema can't express it, the fault is inexpressible, not caught.

kestrel — capabilities

capability	schema	issued
film.emit	emit(term, family, {budget?: nonneg int})	arbiter · snap b51.0
worktree.write	write(path ⊂ wt/lane-a, patch)	arbiter · snap b51.0
claim.emit	claim(assertion, cites[≥1])	arbiter · snap b50.2
gate.replay	replay(gate_id) → evidence	arbiter · snap b50.2

Not present, on purpose: --measure, --probe-whnf, --limits, -v — diagnostic modes are unreachable through agent authority, not forbidden by it.

Budgets

kestrel

24.8k / 40k

magpie

33.6k / 40k

shrike

7.4k / 24k

Refusal log — every refusal by name

film-budget-invalid · "99999999999999999999" · fix a spelling — was: a complete 21-frame answer

film-budget-negative · "-1" · fix a value

film-unknown-flag · "--budjet" · fix a spelling

authority-revoked · magpie → worktree.write(runtime/) · fix a permission

workspace/trvm › settings

Settings

The machine room.

Engines

claude-code · connected
codex · connected
test-harness · local
Keys live in the Rust body's keychain; the brain never sees them.

Sandbox

worktree-jail: on · network: allowlist · pty: recorded
Enforced by the Rust body; policy is a capability schema.

Fleet enrollment

token: amp-node-•••••••• · epmd over tailnet
A node is adopted, not configured.

ComputeDriven

account · travis — plan: Fleet
sync: encrypted, selective WRL state · restore point r-0847
hosted capacity: 0/8 runners attached
The cloud is a control plane, not a copy — one world, placed.

Journal

retention: forever (it's the truth) · export: review pack
SQLite now; WRL records at Rev C.