System architecture

Initial root publication prepares the exact card directories and all configured root-session indexes, then the global Analyst index, before selecting the root head. Oversight stays lazy. The final initial-card publisher does not create or adopt directories; child creation likewise prepares its exact namespace before publishing records/artifact/head. Direct CLI mutation composition awaits its callback under lifecycle exclusion; publication uncertainty retains the lock even when a test fatal boundary throws.

The native-hybrid evidence contract distinguishes real activation ownership from root-only bootstrap commissioning. Init/reset own one managed process registry/runner and a lifecycle-scoped container; signals cancel that initializer without releasing exclusion. Ordinary release follows callback and process settlement. Startup creates its one application registry before bootstrap and passes that same registry/runner into server services and Supervisor. During startup signals abort initialization, not a terminal cleanup that would join itself.

Fresh bootstrap qualifies clean explicit delivery D and absence of the exact private ref before generated namespaces. After configured root sessions and Analyst exist, the managed commission step reconsumes D/absence, creates only that ref, and verifies unchanged checkout/source. Its truthful bootstrap finish precedes authored records, initial card artifact and selecting head with completed source facts/policy digest. Strict generated-state admission follows. Retained roots must match ON/OFF and exact compiled source policy; they never replay commissioning. Reset preflights clean delivery and unused provisioning before any generated-root deletion. The provision-required classic-git bundle now compiles and materializes through public init; validation records functional constituent qualification and known aggregate/security limits. Structural bootstrap tests alone are not CLI rollout or first-Run evidence.

Native Git dependent implementation boundary

Card6 gives CardService a strict runtime-only source-fact publication path. Ordinary/tombstone payloads require nullable root/child git facts, with immutable root policy/branch ownership and retained original correction provenance. New OFF bootstrap, child and repair cards initialize null; commissioned ON root publication selects completed source facts. Safe read models project detached source refs/OIDs and redact ref text; no source bytes, approval or helper phase is stored there. Supervisor owns runtime source sequencing and activation frontiers; held or mismatched source blocks further execution.

Workflow5 adds the correction participant to the existing compiled state table, not another engine. Structural declaration compilation selects actual task/feedback prompts and named agent sessions; runtime compilation and binding enforce ON eligibility. Generated native transitions distinguish entry, verified saved-entry return and blocked/failed reporting from authored product edges. Node purpose is explicit in the compiled contract and graph projections, never inferred from historical text. The actor excludes correction from product accepted-result promotion; urgent continuation waits for source settlement and refuses continuation on held source.

Eligible ON workflows use Supervisor/CardService integration. In-process GitWorkflow's failed-rebase preservation uses two separate invocations: capture final eligible source leaves without changing the real index, then (only after the owning caller successfully publishes the snapshot) normalize the real index, abort once, restore the snapshot and checkpoint/return. Original replay history and current source selection remain distinct. No saved phase authorizes restart or adoption.

Every Git argv runs directly in its own existing ProcessRunner-managed group. The coordinator awaits the saved whole-group/capture settlement and reconsumes current owner authority before continuing. An exited-zero leader with a killed descendant is containment, never command success. Finite naturally exiting hook children remain supported; their effects are consumed at the next source check. The runner owns exact optional binary/NUL stdin and rejects incomplete/broken input. Publication uncertainty crosses the fatal boundary before cleanup or another read.

Capture treats directories as containers, not retained leaves. Exact native-start and current-index membership retain now-ignored tracked source; unrelated ignored data is not captured. Before destructive transitions, only threatened selected prefixes are checked for uncaptured obstructions. After index-writing hooks settle, final observations compare bytes, modes, links and index entries without refresh or index writes, then proceed directly to abort or restore. A hook-created ignored obstruction means known normalization but held source, not successful return. Real-index conflict stages may be lost after snapshot selection even when return later fails. Native-domain qualification alone does not establish complete actor integration, product acceptance, UI or full native-hook qualification.

The Supervisor's native foundation now enters commissioned root/child source before provider admission, joins the parked parent's command writers and publishes its checkpoint before child entry, and returns failed/cancelled/interrupted source before terminal publication or child-lease delivery. A Supervisor-owned source task outlives cancellation of the failed agent, but is aborted and joined by the existing runtime halt. Parent command scopes remain usable after child return; only their exact node-owned processes are settled at handoff. Snapshot publication and its N/Q continuation remain within that same live source owner, not restart state. Urgent source failure requests halt without awaiting the halt that joins the urgent task, and reports queued/suppressed rather than a successor. Whole-workflow ON remains rejected until commissioning and bundle integration are complete; successful product settlement is not substituted with an unreviewed source return.

NodeExecution carries the prepared source tuple and node ordinal only in the same-activation AcceptedNodeResult map. Preparation precedes handoff, record close and successful emit_result; every await reconsumes current owner/node control and the applicable record, descendant, review and notification gates. Joining actual writers leaves the node scope available for ordinary corrective rearm. Reviewer entry prepares before snapshot/provider admission; approved review verifies that exact clean selection. Root reviewed completion verifies the promoted tuple without preparing later source, while retaining assessment exports separately from review authorship/summary. No approval is serialized into card Git facts.

The processor passes its terminal promoted tuple to Supervisor settlement. Supervisor joins the processor and delivers on the real parent index, verifies files/index/refs and publishes parent then child facts before terminal outcome or lease release. A no-change squash leaves the parent commit unchanged. Later dirt refuses rather than checkpointing under old approval. Git effects and the two fact publications are not transactional; a failure leaves a stopped mismatch, not a retry or automatic return path.

Global workspace mutation and delayed Webfetch save contexts carry the Supervisor's final source-file admission callback through internal and external Analyst composition. ON construction requires it. File owners resolve the destination or its existing ancestor and invoke it synchronously before any mkdir/read-for-edit/ write; multi-file patches classify all destinations before effects. The gate uses existing status, run identity, prepared launch, active owners and halt/transition state, plus strict root facts and read-only Git inspection of exact delivery. Starting ownership is reserved before the first asynchronous entry operation. There is no whole-Analyst-turn join, source lease or cached admission.

Synchronous Git queries share a finite five-second remaining deadline, disable optional locks and lazy fetching, and never use status, diff/textconv, refresh, filters or index/object writes. Unsupported fsmonitor/transform/sparse state refuses. Real index entries are compared with the selected tree, and actual file bytes, executable modes and symlink bytes are compared directly with blob hashes. Missing local objects refuse rather than fetching. Normal mutating Git continues only through the existing asynchronous managed-command owner.

Frozen ON global capability validation checks canonical provider identity at declaration and binding. Unknown command-backed/quality/MCP writers cannot be selected; observation and process containment are unchanged. MCP composition receives the frozen mode and refuses dynamic capability enlargement at the owning manager, including HTTP lifecycle calls and persisted reconciliation. Config setters still validate their complete candidate and require restart; they cannot replace the current bound surface or weaken the manager's frozen mode.

The compiled correction Executor now runs in its ordinary configured card session and state table. Native verification joins its command writers without closing the scope needed for corrective feedback. A refused source_ready follows the ordinary result-correction route; successful verification publishes the actual rewritten tip before the node returns to its saved entry. Correction results never populate the product accepted-result map. If correction blocks after a completed rewrite, the owner verifies/publishes the new tip while retaining the original task and snapshot provenance for explicit reentry. Snapshot return keeps original C, current O, native N and detached Q distinct across repeated interruptions. Surviving urgent correction joins only its retiring node, preserves/returns/reenters source, then releases the guarded correction successor before ordinary STOPPED continuation. An entry refusal can publish runtime-owned Git BLOCKED only when the native owner established the clean exact parent and performed no mutation. Partial transfer or unqualified source remains held; no provider or compensating checkout is admitted.

Quality tool binders depend on the contract-layer QualityToolPort, not runtime implementation. Runtime/application composition binds the selected agent's frozen configuration and actual owner process scope to executeFiniteOperation, using the same compiled definitions as actions. The external Analyst surface uses the configured Analyst policy, independent of credential attribution. It supplies no card binding, execution-log observer or record publisher. Shared cleanup completes before private report bytes become a tool result. Outbound configuration excludes provisioning.

Observed source query ownership

contracts/observed-collections.ts declares the backend-neutral two-operation RetrievalPort. Runtime composition loads strict logical/private inputs once and passes one query owner through Supervisor/card execution and both Analyst surfaces. Tool binding uses the existing observational result policy and caller VFS reader; custom configured ceilings still decide which operations exist. Oversight remains unchanged. The private transport is never exposed through show_config or results.

retrieval/xerj-retrieval.ts owns authenticated loopback HTTP, redirect refusal, bounded bodies and request-local catalog/mapping/search projections. Dataset run_id joins native run metadata to the exact adopted root and prefix before selection; a prefix or guessed destination alone is insufficient. Known native text carriers (body, impl, text, plus lexical name/title) and actual inferred semantic mappings select channels, not a remembered inventory or universal embedding promise. observed-collections.ts owns logical filtering, ordinary-reader admission, same-content alias projection, redaction-before-caps and ordinal reciprocal-rank fusion (constant60; weights1:1, 1:2 or2:1). No original-source body reread or independent content mirror is added. Excerpts select string impl then body then text; arbitrary inferred columns are withheld. Native line-window text can join/cap lines, so coordinates remain unavailable. Availability is aggregated across destinations; successful metadata never hides another destination's metadata_unavailable limitation, and failed metadata never overwrites available evidence. Metadata loss keeps coverage unknown.

The offline prepare owner emits engine/watch argv and systemd units. Deployment alone owns native lifetime, credentials, assets and automatic observation. App Stop/close and query cancellation do not stop it. No ingestion API, index/mapping provisioner, custom watcher, capability registry or periodic rebuild exists. Native persistence is external derived tool state; Saivage adds only the two strict operator input families recorded in the durable format reference.

Saivage supports autonomous software development through a card-centered runtime: configured Planner, Executor and Reviewer nodes separate coordination, engineering and assessment. Configuration compiles the workflow, Supervisor owns dispatch and activation lifetimes, domain owners publish ordinary files, and read models expose selected evidence. The browser observes those owners; it is not a scheduler or persistence authority. This is the canonical architecture explanation. System requirements, exact UI contracts and operating procedures have separate owners.

Ownership and dependency direction

Owner	Owns	Does not own
schemas, contracts	Strict identities/data, pure validation, operation-indexed transport and execution contracts	Filesystem, provider execution, scheduling or application lifecycles.
config	Selected YAML/effective input, registered init templates and structural candidate validation	Live replacement of installed workflows or compatibility detection.
cards / direct persistence owners	Current linked cards, named record mutations, exact selectors/history and file publication	Dispatch, generic stores, transactions or orphan adoption.
runtime	Compile/bind, Supervisor, CardProcess, NodeExecution, conversation phases, context/compaction	Provider transport implementation or an independent durable runtime-state file.
agents	Registry/Router, request plans, protocol adapters, attempts, credentials and exchange projection	Card dispatch or runtime actor topology.
tools, workspace, mcp	Scoped invocation, resource admission, transport/discovery and owned effects	Inferred role authority, remote restart guarantees or historical replay.
application	Composition ports, Analyst operation surface, read models, mutations, Oversight schedule and freshness effects	Generic repository/store lifecycle or a second Supervisor.
server, boot, cli	Auth/contract transport, process startup/exclusion/terminal coordination, command composition	Browser-side authority, automatic migration or implicit Run.
web	Accepted REST resources, exact subscriptions, ephemeral selection and safe presentation	Durable currentness, mutation admission, provider context or inferred liveness.

Deployment supplies external LXC isolation; Saivage neither creates nor verifies it. Trusted in-container agents may run commands as root. Internal controls simplify work, prevent accidents and preserve explicit API/data invariants, not contain that principal. External authentication and outbound confidentiality remain real boundaries. Ordinary deployments use bearer auth; disabled auth requires deployment-owned trusted-origin isolation. Wildcard CORS is not authentication. Bearer tokens remain header-only, never URLs; the UI has no token-login surface.

Published package boundaries

Cross-package backend code uses owner-published roots or exact public entrypoints; implementation imports within an owner stay local. Contracts/schemas retain their bottom-layer prohibitions even through a public surface. Agents and runtime do not import one another; workspace does not import runtime; server does not import boot. Only boot imports server across packages, still through an admitted public surface. Redaction primitives depend across packages only on schemas/contracts.

The exact reviewed leaf set is in scripts/check-import-boundaries.cjs: agents/{execution,tool}-api, cards/{status,store}-api, contracts/tool-api, mcp/{manager,tool}-api, persistence/session-api, server/server-api, tools/{execution,prompt,tool}-api, utils/prompt-api, the sole runtime entry runtime/runtime-api, and exact server-only schemas/round-id-server. Terminal .ts/.js identify the same entry, not arbitrary neighboring/nested API leaves. The round-ID generator is not exported from the browser-safe schema root.

application/index.ts publishes composition/read models/preparation; shared freshness/intervention/lifecycle declarations belong to contracts. Agent execution ports publish routing/invocation/exchange projection, tool ports the audited runner; cards status ports expose pure lifecycle/permission predicates without loading CardService. Runtime remains one consumption-curated aggregate, not newly split facades. The boundary baseline is zero offending occurrences and an empty-array digest. The shared scanner selects one rule per import/export occurrence, in precedence contracts, schemas, redaction, agents→runtime, runtime→agents, workspace→runtime, server→boot, server import, cross-package deep import; the digest uses sorted path/rule/target tuples, retaining duplicate occurrences. It is not an acyclic-module or complete-JavaScript-syntax proof. Type-only imports erase; value reexports create evaluation edges. Residual application/runtime/tools cycles are accepted and tested at relevant first entries, not promised universally safe.

Startup: select, compile, admit, bind, listen

CLI StartInputs → canonical root + bound lifecycle exclusion
  → selected environment/YAML → structural workflows
  → optional first publication + strict current generated-state admission
  → server composition/live bindings → owned services + terminal registrations
  → bounded configured-global settlement
  → Supervisor startup card-chain settlement (execution stays stopped)
  → outbound MCP reconciliation/install → external Analyst listener
  → operator HTTP listen → published lock control endpoint

src/cli.ts parses command-specific options once, rejects duplicate singletons and passes typed StartInputs; boot does not reparse argv. Root precedence is CLI, environment, cwd; config is CLI, environment, selected-root default; host/port are CLI, environment, YAML, defaults. Each chain selects the raw source before validating it. Token, log level and Node environment remain environment-owned. boot/app.ts::startApp creates the terminal coordinator and acquires exclusion before environment and generated effects, narrows the lock to immutable {pid,startedAt} and injects it. A post-listen TCP observation supplies the announced bound address, not delegation authority or proof of reachability; lock endpoint publication is separate.

The early coordinator/lock cleanup registration is not live service composition. After optional publication and canonical admission, createServerServices binds workflows, creates Fastify and application/integration owners and registers their admission/cleanup hooks. It settles configured globals, starts Supervisor recovery, reconciles/installs outbound MCP, then listens on optional external Analyst MCP. Server composition registers operator routes/live sync before HTTP listen; boot publishes the lock endpoint afterward. This is not an all-validation-before-writes transaction: the lock, first-root prefix, permitted admission tail truncation or earlier settlement can remain after a later failure. No rollback or speculative restart loop follows. Startup diagnosis distinguishes the failing boundary.

Structural compilation and live binding

ResolvedConfigAuthority reads and parses YAML, interpolates its ordinary values (preserving literal data), then strictly decodes source config, resolves omitted card_types to the complete classic map (no per-key merge), validates the required effective map and calls compileProjectWorkflows. Deleted selectors and old model shapes fail, not normalize. The same decoder serves mutation preconditions without compiling current graphs; a correcting candidate is fully compiled before replacement. Reconfigure publishes next-start YAML and returns requires_restart:true, never installs it into this process. Load warnings are immutable advisory strings; boot/offline CLI own redacted stderr output, REST its warning array, without diagnostic reload or probes.

Compilation has no credentials, network, MCP, process or generated-state effects. It resolves named agents/tool references/model order, records/globs/gates, prompts/initializers, entry/node/edge declarations, child permissions and descendant context. It validates reachability, terminal paths, source requirements for exports, promotion reachability and transitive child context closure, then publishes one immutable semantic state table per type. States are ready, lifecycle entry, node and terminal; each transition has one target ID and semantic variant, not a duplicate destination/node index. Entries are BACKLOG/CHANGED/BLOCKED/STOPPED; terminals DONE/FAILED/BLOCKED. Result outcomes and runtime execution failure/block edges remain distinct. A card selects by immutable type, not init profile or role.

After canonical admission, bindRuntimeWorkflows binds the specified participant set. It installs bindings beside the same tables, using local structural Router/Registry ports, preserving ordered candidates and complete capability requests. It retains maximum positive usable input floor(U*C)-O for capacity-eligible candidates without credential/network probes. External-only mode omits internal Analyst model binding, not its policy/index/evidence requirements or card participation. Invocation later binds scopes, not source configuration.

Templates and prompt closure

config/system-templates/registry.ts explicitly registers classic, classic-typed and paad-typed complete frozen configs. There is no scan/loader/manifest. createClassicConfig constructs fresh typed declarations then freezes once; OVERSIGHT_ALLOWED_TOOL_NAMES is the shared contracts-owned allowlist. PAAD reuses typed config, not runtime inheritance. Config-absent init materializes the selected complete prompt closure/marker and YAML last; existing config preserves them. Runtime follows the instance, not the selected init-profile label. The default bundled prompt/card-type source remains classic where the instance omits overrides.

The compiler exact-selects project-card/project-shared/bundled-card/bundled-shared hosts and direct fragments. Global scope uses shared tiers only. It freezes role tokens and eagerly renders process text; a typed global card is not a global host. Packaging compiles each template standalone and checks exact physical source/package closure, classic-family shared bytes and PAAD's five explicit differences. Compiled composition runs through build, not routine alone. Prompt handling owns host tokens, declaration retention, customization and prepared-versus-historical explanation.

Canonical admission before readiness

First publication requires all four generated roots absent. Existing state is admitted through exact project head/selected ordinary artifact and bootstrap record selection; partial/old/mixed state fails, never probes or reconstructs. Init validates/compiles and binds identity/exclusion before generated admission; the bootstrap owner publishes complete root/card sessions and then required global Analyst index. Failure can leave a strict partial publication, not an implicit reset.

current-generated-graph.ts traverses linked current cards, validates active dependencies and compiled parent/type membership, and stops at retained tombstones before workflow/session/record admission. It reads required Analyst and each card's distinct configured-agent indexes deterministically, then app log, required session evidence, optional established Oversight evidence, current conversations and configured records. Bootstrap authority is required; optional record heads are not created. Empty valid indexes pass; missing required indexes fail. No old card predecessors or unrelated namespaces are scanned. Current JSON documents have no torn-tail permission. Broader consumed stopped-card JSONL remains strict, with owner-local validated current-tail truncation where permitted. Server composition separately consumes established Oversight current history before readiness.

Selected configuration is not a record of the previous graph. Required indexes detect some identity changes, not same-agent node removal or every reused index. Reached active cards, including non-tombstoned DONE/FAILED, still participate in identity adoption. Never-used unpublished Oversight is different from replacing known published Oversight. State adoption owns the operator decision, not a startup fingerprint or session scan.

Activation and node execution

explicit Run / exact parent-bound child activation
  → Supervisor owner + lease → running publication → ready CardProcess activation
  → NodeExecution common resources → AgentExecutor OR invokeOperation
  → common acceptance/record close → accepted edge or terminal winner
  → natural card outcome publication → optional advisory hook → join/release/delivery

Supervisor and exact authority

Supervisor owns one activation map, singular halt identity and guarded synchronous ownershipTransition. Plain CardActivationOwner phases are prepared_root, child_admission, active and settling. The transition changes in-memory phases, relationships, currentness, run/gate/leaf/winner state and coherent invalidation; I/O, abort delivery and joins occur outside it with exact identity checks after awaits. Durable running without an exact live owner fails. No owner repository, factory, queue, generation or second authority exists.

Each processor is ready before owner visibility and starts only after known running publication. Run installs prepared root before recovery/publication; startup has no activation owner. Child work enters only through an exact-parent PlannerChildControlPort and invocation lease; provider code cannot choose parent authority. Same-lease joins perform no target I/O. Dependency/status denial precedes owner/processor creation. Natural release removes the exact relationship/map owner before caller delivery. Root natural settlement requires no owned children and the strict durable chain [project] before publication, with no post-publication scan.

CardProcessActor is the one narrow BaseActor micro-actor and owns graph position, accepted-by-node activation memory and task/consumer joins. Unexpected nonterminal events/start-entry/actor-main invariants latch InternalActorError, reject waiters and notify the exact Supervisor owner once, never restart the pump. Ordinary task failure instead uses code-owned execution:failed. Node ordinals begin at 0 and accepted re-entry increments once. Tracker and consumer ownership remain distinct from provider invocation lifecycles; joins snapshot current work/deliveries, and failure precedence is pre-join cleanup, LLM order, tracker, lifecycle.

Agent path and shared acceptance

NodeExecution owns record preparation, descendant snapshots, promotion, notifications and terminal claim. AgentExecutor owns selected role/tools/full node/parent preparation, the real conversation loop, corrections and finalization. Record modes/globs remain conjunctive: clean, continue/updated and selected initializers require direct write; edit/Webfetch does not substitute. Entry performs initializer/clean/continue work then captures actual head UUID/revision baselines. Updated acceptance requires a different UUID and greater revision; effective baseline0/draft0/empty content is ineligible.

Reviewer context/snapshot uses one call-local root-inclusive subtree projection, preserving each card and record head UUID/revision plus accepted entry/version. Acceptance independently rereads it. A stale review discards written drafts, reprepares clean requirements, captures refreshed context and corrects the same node under original entry baselines. This is not an atomic filesystem snapshot or remembered admission. The one joint 16-rearm budget covers malformed/plaintext results, pending notifications, stale context, record and other corrective causes.

Acceptance checks records/descendants/freshness/promotion before terminal claim, then closes required records in declaration order and other activation-written records by sorted name. Only returned immutable close projections supply URLs, transition evidence and exports. Nonaccepted graceful finalization discards owned drafts; correction retains them. First finalization failure stops at committed prefix; uncertainty permits no next close/cleanup. Crash-lost free-draft ownership is not recovered by discovery. Result promotion (current/reachable latest_node) is separate from terminal-source record exports; no prior activation memory is recreated on STOPPED.

Shipped project assessment uses ordinary graph edges and status continue/updated gates: classic-shared specializes project plan/recover/review into assess-completion; goals retain notification handling. Reviewed completion can promote Reviewer result while exporting Planner assessment status and immutable review citation. It is not a natural-language objective checker. Typed architecture likewise uses component then system review as clean cycles of the same record, passing immutable accepted URLs; successful system review promotes accepted draft. Typed test coverage-ready routes to verify, the sole successful terminal owner. Other typed retries/research/data distinctions are selected instructions, not template-aware runtime branches or persisted phase machines.

Action path, output and advisory hooks

The explicit code-quality plugin supplies three contract1 actions through the same finite owner. One packaged child imports native analyzer/config code; it emits complete JSON to the host-owned capture and writes no artifact files. The owner admits source paths for the actual caller, consumes only the settled host-selected capture, then publishes fresh exact invocation artifacts synchronously. Publication uncertainty reaches the existing fatal boundary; no child-side publication protocol, registry or cleanup is added. Returned-text report bytes remain private until normal NodeExecution output acceptance. Native tool grants are not implied by registration.

operation-contract.ts explicitly compiles builtins or declared plugins with qualified identity/contract version and reserved namespace checks. It is not a dynamic plugin service. The shared schema-level operation identity owns the same qualified grammar for compilation, lifecycle, execution evidence and API projections.

Execution envelope3 also has logical native start/finish and sequential command start/finish rows owned by GitWorkflow. These carry actual native bindings and completed observations, not action descriptors or provider turns. The existing complete execution reader validates associations and selects exact captures/private-index paths for work GC. Incomplete attempts authorize no continuation. Evidence publication uncertainty crosses the application fatal boundary before native follow-up or cleanup. This contract does not enable ON before Supervisor lifecycle integration is complete. Operation declarations select null, command-stdout or returned-text output and exact artifact paths from validated configuration plus host invocation UUID. The private run result separates completed bytes from flat routable values; it does not confer record-write authority. operation-routing.ts resolves literal/factual/typed predecessor inputs and validates strict bounded fields; first matching case owns routing. It does not evaluate expressions, merge sources or replay log values. The card invokeOperation wrapper appends entry/spawn/finish evidence. The shared finite execution body owns the direct scope, actual process attribution, path admission, return validation, exact declared artifact observations and completed output. It takes no workflow binding or required card identity; a non-card caller does not fabricate a card log or activation. Invalid post-effect results are engine failures, not retry/no-effect outcomes. Actions have no fake agent/session/tool call. Ordinary continue/exists uses accepted records.

Only a compiled output-declaring action node's output_record grants direct acceptance into its one declared nonbootstrap continue/updated record. Entry rejects drafts/captures head baseline; after direct cleanup, command-stdout requires absent group+EOF+no stdout error before one exact host-selected capture read (at most 1 MiB + 1 byte). Returned-text uses separately validated copied bytes, never a plugin-selected capture path or invented process. Strict UTF-8 preserves BOM/CRLF/trailing bytes; NUL, empty/whitespace, oversized/nonregular capture fails. Cancellation/currentness is checked before synchronous ordinary acceptRecord. Accepted format 4 embeds independent content and exact action/output provenance; equal text may advance version. Shell nonzero, signalled or timed-out complete captures can publish factual reports; later gate failure does not undo them or turn them into workflow approval. Current/history/VFS read the accepted artifact, not capture/log. The shared author union includes agent, external-agent, runtime bootstrap/repair and action-output; typed observations remain author-free and draft/baseline content_author is null.

after_activation_commit runs only after natural done/blocked/failed publication and owner/halt recheck. Supervisor passes the returned committed snapshot/artifact, not reread state or cleared node input. The tracked advisory run joins its matching consumer before release. Ordinary hook failure preserves outcome; containment and storage failures retain failure authority. Recovery/Stop/cancel/reopen/record edits do not dispatch hooks. Actions/hooks share one processor-local nonagent in-flight binding through raw operation, finite cleanup and matching delivery. Stop/cancel selects cancel-and-settle before abort, even after process exit; no successor runs.

Caller-specific tools and Analyst operations

Names do not grant authority. Provider-owned catalogs define immutable identities, descriptions and scope-aware schema factories; compilation preserves ordered references, real binding supplies vocabulary/parent/process context. Effective node selection removes create only when no permitted child creation remains. The bound surface supplies actual definitions/capabilities; generated strict emit_result is appended separately. Exact object/schema rejection enters the shared correction loop; terminal settlement parses accepted, error or pending-notification variants.

invokeToolForLlm is the required complete LLM-context boundary; only ConversationLLMActor.toolInvocationContext constructs that context. External execution has its own invocation UUID/principal/owned signal, never a fake lease or conversation. Direct non-LLM invocation may be context-optional. Expected input/discovery errors convert only at their owning boundary; exact cancellation is identity with signal.reason, while returned results remain known facts. Unclassified I/O, canonical/invariant failures, missing MCP installation and publication uncertainty escape unchanged.

Analyst natural-turn completion is distinct from caller delivery and shutdown. The session retains the actual tracked consumer promise, then awaits the original producer and joins that exact naturally closed turn tracker, accepting only a joined outcome. Consumer projection and delivery finish before this boundary; handled producer failures still reject it. The runtime's wait creates no absent session and does not cancel work or close the reusable LLM lifetime admission. The latest completion remains observable until the next accepted turn replaces it; publication uncertainty is observed through the fatal port even without a waiter.

Work-GC maintenance uses one private Supervisor hold, not a new public runtime status or lifecycle lock. Entry requires the same existing running/paused run; independent HTTP MCP lifecycle or reconciliation activity refuses before pause. The hold denies new Analyst ingress and Start/Resume, while accepted tools finish under their existing owners. Collection awaits actual gate parking, Analyst consumer completion, external operations including receipts, and the cancelled Oversight check. Unresolved activation/interruption ownership refuses collection. The collecting phase denies activation and notification mutation; it never opens the gate. Cancellation stops waiting, not accepted Analyst work. Stop, close, restart and natural run settlement defeat restoration. An ordinary Pause, including an accepted Analyst tool's Pause, withdraws restoration even if already paused. Only the hold owner may restore its own pause on the same run; a cancelled pending pause cannot leave a late parking callback behind. Maintenance is bounded to one minute and collector loops must honor cancellation before further file effects.

The application owns the single in-flight GC task across inventory and maintenance; application shutdown cancels and joins it within runtime cleanup. The server's MCP lifecycle ingress counts complete returned manager promises, including post-stop continuations and cleanup, and delivers publication uncertainty before decrement. Manager/runtime continuation admission is unchanged. Surviving MCP handles or unexplained activity refuse collection. Process protection observes the existing group registry independently of presentation retirement: any uncontained group requires retaining all work; remaining presentation capture directories are protected even when only stream drainage remains. These observations neither scan processes nor certify effects of external programs.

Inner MCP runtime operation sets and reconciliation tails are settlement-only, not evidence of complete lifecycle success: restart may still start after its stop, and failed startup may still be doing final cleanup. The whole HTTP ingress count therefore remains active through the actual returned manager result, including disconnect; GC refuses that overlap before pause rather than joining the inner set. Accepted Analyst/card/external continuations remain allowed during settling and are covered by their enclosing owners. Residual activity refuses collection; a structured failed tool result does not prove containment or a safe write footprint.

The collector in src/workspace/work-garbage-collector.ts performs yielding synchronous work-only inventory and one shared preview/delete selection loop. Under the hold, persistence owners inspect the fresh linked graph, all indexed segments, selected records (including baseline/draft and accepted predecessors), pending messages and execution evidence without initialization or torn-tail repair. Only GC may discover names one level deep in reached active-card record roots; exact head grammar/round-trip precedes strict owning reads. Previous slots, accepted siblings and reserved publication temporaries are not inspected. Exact alias metadata may protect work without outside-work discovery. Fresh candidate identity, size, timestamps and protection checks immediately precede the final effect switch: would-delete attribution or unlink plus directory durability. All directories stay. No persistent inventory/report, new durable family or format bump is introduced.

POST /api/runtime/gc-work is an operator-session operation; CLI delegation uses only the verified live lock endpoint/auth, with no offline/config fallback. Default and explicit preview require the same hold as deletion but no backup prerequisite or collector writes. Known effects and accounted estimates are bounded response data, not whole-work or physical-space guarantees. Deletion uncertainty reaches the nonreturning fatal boundary before report, cleanup or hold release. The runbook owns explicit preview-first adoption and cancellation.

Structure and records

Planner create/edit/cancel/activate/reopen/reorder is exact-parent scoped; Analyst global maintenance is different. Shared reopen_card spelling has different input (card_id versus cardId), readiness, result and propagation. Planner reopening proves active/open parent before target I/O, permits ownerless done/failed direct child and publishes changed once, without ancestor propagation, audit, notification or activation. Analyst intervention-ready reopening uses ordinary changed propagation. Planner dependencies are existing immediate siblings; Analyst creation uses active card dependencies and rejects running parent. Activation requires dependencies done, not creation. Planner owner-first cancel differs from Analyst subtree/root/status preflight; deletion publishes tombstones with surviving-dependency checks, not cancel. No-op metadata/reorder emits no publication/propagation; real Analyst reorder does changed propagation while Planner reorder remains parent-only.

Pure cards status predicates serve precise operations, not a universal terminal taxonomy: create/notifications admit backlog/changed/running/blocked/stopped; cancel excludes done/cancelled; Analyst record edits preserve backlog/changed/ running/stopped, reopen blocked/done/failed and reject cancelled. Descendant completion is done-or-cancelled; dependency completion is done. Projected operator actions do not substitute for caller admission.

Record mutation first proves active reached card and cross-card/name-glob/required- tool/lifecycle authority before record definition/state reads. Later writes prove authority afresh. Card agents own drafts/framework close; Analyst directly accepts with open-draft conflict. Webfetch-to-record requires Webfetch+write admission before network and fresh readiness/resolver/mutation afterward, not retained preflight authority. Invalid/historical mutation targets return content-free typed rejection. Current URLs are reusable mutation targets; immutable accepted URLs are evidence. Record-specific changed propagation and generic reopen remain distinct: target/ ancestor reopening and notices depend on precise source status and stop at the first running ancestor. Fresh sanitized 1000-character summaries become ordinary card_changed notices; no dedup/retry or delivery guarantee is introduced.

Internal and external Analyst callers

application/analyst-operation-surface.ts composes one shared policy surface, independent of AnalystSession. Required-tool conjunctions use the actual selected subset; omitted external tools cannot be borrowed. The application bundle invokes owners once under audited lifecycle timing: ordinary intervention mutations assert readiness immediately before mutation; prepared mutations prepare first; record Webfetch uses the two admission boundaries above; runtime cancellation, normal notifications and permitted nonrecord write/edit do not require intervention-ready runtime. No post-effect cancellation/readiness check repeats known effects. Best-effort propagation failure retains principal success/audit ok with partial report; no-op reorder has none. Audit coverage excludes shell/patch/nonrecord Webfetch effects and is not every filesystem change.

config/analyst-mode.ts freezes internal(default), external or both startup choice. External uses a separately authenticated loopback project-digest endpoint in server/analyst-mcp-server.ts with request-local stateless SDK transports. The application external-operation owner holds in-flight joins and an app-lifetime direct process scope across calls, not request-socket lifetime. Disconnect does not cancel/replay; project Stop leaves listener alive, App close contains it. Both permits concurrent operations, not shared chat or lease. External-only preserves strict internal history and disables internal submission before ingress/provider. Principal identifies credential use, not verified client identity. External images return call-local normalized bytes; only real LLM settlement publishes PNG selections. Known settled body-free app-log receipts contain no args/results/start journal or provider transcript and prove neither complete audit nor delivery. Full protocol, headers/tool subset and restart confirmation recipe belong to inbound MCP.

Conversations and settlement

Stable session identity is agent:<name>:global or agent:<name>:<card-id>; activation and source-input UUIDs are separate. Every logical call/repair/ continuation uses a fresh source UUID S; tool rows derive ${S}:tool-call:${T} and ${S}:tool-result:${T} from provider call T. Repeated T across source inputs is not one exchange. Persisted invocation/source sessions must agree before hooks and provider use. Internal summary is the explicit nonpersisting exception with distinct invocation/evidence identity and canonical source attribution.

ConversationLLMActor is a direct purpose-discriminated phase owner, not BaseActor, topology/event pump or actor lifecycle. Only autonomous card purpose owns the RuntimeGate. Its deferred raw callback checks captured lease at entry before supplier/compaction, not only when scheduled. Provider completion, canonical writer, tool parking/result, child lease and terminal handoff each retain exact owning input/currentness; no mutable latest-input registry exists.

Privately tokened nominal tool outcomes cross one settlement owner which projects, redacts, constructs strict success/failure (optional ordered success content) and serializes exact canonical bytes. Domain applied/rejected maps once; Webfetch write data does not nest a second envelope. Corrective continuation builds result plus fresh-input continuation rows in one append; only post-append callbacks remove notifications or install refreshed Reviewer context. The result retains old parked source/call identity. Live Analyst transport receives that complete settled result unchanged; current/history readers use strict wire values, not nominal producer outcomes. Arbitrary old result data remains opaque.

conversation-file.ts strictly validates the selected complete consumed segment through the single canonical reducer before any bounded suffix/cursor/public filter. Tool results require exact earlier calls; only a sole final unmatched call is valid, without liveness meaning. Private/visible pairing, row policies/hashes, rounds, source-prefix atomic boundaries, protection and facts derive together. Incoming append validates schema/session/batch IDs after current consumption, not a second prospective replay. Bounded tails may start with a result whose call lies earlier; they never expand to recover a mate. Initial/global markers bind actual identity/ timestamp/input and preparation; unmarked/mixed histories fail without inference.

Global ingress, disposal and reuse

Internal Analyst is one serial live-turn owner: REST overlap returns busy, not a server queue. Ordinary ingress appends marker/user together, then reads canonical context; confirmed restart uses accepted-ID marker/confirmation without model work. The accepted submission ID differs from every provider continuation UUID. One pending restart-confirmation capability transfers into admitted operation ownership; only successful schedule consumes it, while specified reusable nonscheduling outcomes restore it. REST response finish acknowledges scheduled restart; sockets cannot. Server composition derives immutable available/unavailable restart capability from auth and boot port, passing it unchanged; missing required port fails.

Disposal closes admission and joins exact ownership, not a fabricated cancel/result. An entered result writer completes its exact row even if disposal reenters; it admits no continuation/confirmation. Entered provider-error completion retains error row, mandatory exchange evidence, terminal handoff and required notice; only later optional UI projection suppresses. Ordinary ingress disposal preserves the committed batch but rejects before reread/provider. Confirmed restart disposal before schedule suppresses it; after schedule entry preserves its known response. Failures do not authorize retry or compensation.

Pure focus/orientation/static-capacity pre-ingress rejections are reusable; strict state/config invariants poison. Primary-local exact capacity rejection is reusable only under its typed provenance after inner lease/progress settlement; confirmation clears, and prior tools/results are not replayed. A nonpublication invoked-tool await error is reusable only after successful parked-turn abandonment without disposal. Summary/configuration/result/observer/cleanup failures retain poisoning precedence; authoritative provider failures retain ordinary evidence/notice/reuse. No nested- cause/message classification, drain protocol or actor recreation supplies reuse.

Control, notifications and recovery

Supervisor alone derives runtime status, current leaf and intervention admission. Public reads project injected process identity/observation clock, never enumerate cards/sessions or infer runtime from files. Intervention requires initialized stopped or settled paused; uninitialized/starting/running/pausing/closing/error rejects. Pause gates only autonomous provider entry; admitted tools/processes/actions/backoff continue and global agents do not use that gate. Resume opens that same Run frontier.

Notifications and urgent joins

Mailbox selection belongs to current card head. Only the compiled designated recipient delivers/removes selected UUIDs, append-before-remove; interruption can duplicate delivery. Normal enqueue acknowledges admission, never delivery. At recipient terminal arbitration, pending context receives a failed paired result/ bodies/correction in one append before exact-ID removal. Nonrecipient DONE has a source-declared pending alternative to recipient in the same table; it performs normal acceptance before testing presence, without exposing the queue. BLOCKED, cancel/refusal/failure may clear undelivered context. Ordinary queries expose no queue count/IDs/membership; generic version changes may still reveal activity.

Urgent selection enqueues target first, then eligible ancestor notes bottom-up to nearest eligible live owner, skipping terminal/blocked ancestors only for synthesized notes. Each note describes original descendant/immediate child as observed when queued. No eligible owner means no interruption, activation or Run. Claim captures exact suffix, node ordinal, winners, leases and one settlement before abort.

Join edge	Purpose
Old boundary consumer → successor tracker	Installs derived interruption event/new guarded task without awaiting Supervisor.
New task → captured urgent settlement	No record/session/process/provider preparation before settlement and authority checks.
Urgent settlement → descendant + retiring boundary joins	Never joins surviving boundary lifecycle/current guarded task.
Halt → current/retiring owners + same urgent settlement	Urgent work never waits on its encompassing halt.

Descendants stop leaf-to-root; boundary retains activation/parent direction. Urgent root replacement stops root last, retires it and installs one STOPPED replacement in the same Run/gate, transferring settlement through map swap. Pause-before-claim suppresses; Pause-after-claim parks successor provider frontier. Stop/close suppresses replacement. No old call/result is reconstructed from child status or replayed.

Stop, application close and cancellation

Result/cancel compete for one terminal winner. Cancel claims exact active suffix, preserves already-done descendants, publishes deepest-first and joins cached settlement. Controlled interruption preserves parked calls and known evidence for truthful no-continuation settlement. App teardown directly disposes/freeze-joins; it can take over that same settlement, never revive work.

Project Stop is one non-domain halt, not cancel or full-chain durable settlement. It freezes owner graph, closes admissions/gate, interrupts leases and rejects owners before awaits, aborts/disposes all then joins. This settlement-before-join breaks LLM→child lease→activation cycles. Success clears authority to stopped; failure retains halt/graph in error and blocks Run. Stop writes no card outcome. App close, Stop and actor-main containment converge there; publication uncertainty bypasses it.

Boot's terminal coordinator synchronously tries every admission closer before its first await, then reverse-registration bounded cleanup leaves. Runtime cleanup awaits the same halt, not duplicate Stop/root termination. Fixed component/code reports record timeout/rejection without skipping later leaves. App.stop returns report; process adapters own warnings/exit. Confirmed restart exits 75 after acknowledgement/ cleanup, not proof of replacement boot. Bodyless Pause/Resume/Stop reject any defined body before runtime; Restart requires exact confirmation and authenticated capability. See runtime control for operational decisions.

Startup and Run recovery

After strict admission but before usable stopped/readiness, composition settles the configured Analyst and established Oversight's sole valid final unmatched call via shared conversation-recovery.ts, with one permanent uncertainty-only failed mate. Absent Oversight stays absent; no notice/new ingress/provider/tool/check is started. Init does not gain this server-only correction. Separate actual-use owners may do the same for only imminent configured card activation or a new explicit internal Analyst submission. Malformed/nonfinal/multiple-unmatched history always fails.

Supervisor's one broader card-chain loop is shared by startup and explicit Run. It selects all committed linked running cards, rejects branching/discontinuity, then for each leaf-to-root card stabilizes distinct configured agent sessions in graph order and immediately publishes stopped before next ancestor. Card recovery owns classification/recovery notice, not globals. Clean/system-only/settled-terminal/ exact recovered sessions are read-only; tool-pending gets uncertainty mate+notice, provider/text-pending notice only. Notice binds latest valid activation and exact deterministic source, not child outcome. Actions/logs grant no replay.

Startup is ownerless and stays stopped; Run installs prepared root and uses its publish/currentness checks, then STOPPED root launch. First failure ends loop; a known partial stopped-descendant prefix is valid for a genuinely new attempt. Ordinary Stop can leave durable running for later Run recovery. No multi-card transaction, actor reconstruction, graph-position recovery or automatic Run exists.

Ordinary conversations/evidence write only under durable running card ownership; urgent recovery joins summary/evidence before stopped publication. Thus running chain/configured globals/app log explain interruption-suspect writers, not a narrower startup read scope or host/storage-loss completeness proof. Strict existing stopped-session reads still occur; they do not gain corrective appends. Recovery is loss-tolerant, not exactly-once effects or semantic completeness.

Oversight schedule and check ownership

application/project-oversight.ts owns one monotonic deadline or one runtime OversightSession, not a persisted schedule. Each eligible Run epoch waits the full configured interval; check completion re-arms only if still running. Long deadlines use bounded chained timeouts, not interval/catch-up ticks. Pause/Stop/close disarms and cancels current check; retained timestamps describe only this service epoch. Enabled or disabled configuration still compiles its selected global policy.

Each check creates a fresh global-purpose ConversationLLMActor over the retained configured session, renders generated vocabulary and appends ordinary marker/ingress. No-action may succeed. Known returned tools settle truthfully on cancellation before continuation suppresses. The session clears task/controller before membership hint, so next executing snapshot cannot retain a completed check. Expected attempt failure settles failed; unexpected owner/protocol failure closes App admissions, joins bounded cleanup and exits 1. Publication uncertainty bypasses that cleanup at the fatal port.

Oversight's allowlist has no command/MCP/skill/record-write/child/lifecycle authority. Its only intervention is the shared notification input/result port, admitted under the exact active check signal, for a card with compiled child-capable designated recipient. Another participant cannot borrow that signal. Observation/materiality guidance compares recurring delivery gaps with objectives and inspected earlier/current evidence even when local progress exists, favoring useful bounded advice or successful no-action rather than micromanagement or new strategy ownership. This convergence policy adds no detector or scheduling guarantee. Analyst uses the same notification contract under its own audited runtime- cancellation admission, never an agent-name-inferred fallback.

Canonical graph and direct persistence

Identity derives parent/depth, never membership. CardService exact target traversal proves only committed root-to-target membership and reached heads/selections; subtrees follow committed order. Narrow relationship reads do not validate unrelated dependencies. Disposable full active projections validate dependency references/ cycles when required by list/delete; they are discarded after call.

Creation starts parent-local segment a every time and exclusively mkdir-claims each forward-derived candidate; only that mkdir's EEXIST advances spreadsheet sequence. No candidate/sibling inspection or allocation from history. Exact parent read comes first, then overdepth rejection; in-limit workflow/lifecycle/child permissions and depth-twelve leaf check precede dependency work/claim/publication. Complete child bootstrap, configured sessions, artifact/head precede one parent snapshot/head adding both monotonic membership and complete active order. Failed claimed namespaces stay consumed and ignored. Tombstones retain membership/order and terminate traversal.

File owners and selection

Owner	Canonical data and consuming scope
card-files.ts	Card head selects ordinary/tombstone predecessor document plus current-only mailbox UUIDs; exact current read does not traverse old history.
authored-record-files.ts	Record head selects sole draft/baseline/latest acceptance; exact accepted predecessors are consecutive documents, independent of mutable revision.
conversation-file.ts	Exact cumulative index selects self-contained ordinary/compacted segments; shared loader distinguishes growing current from immutable historical.
app-log.ts	Complete strict event/control/external-receipt union and duplicate-ID validation before query filtering.
provider-exchange-log.ts	One strict stream per canonical session across segments; validates primary/internal-summary IDs, then latest primary by time/attempt, earlier physical tie.
card-execution-log.ts	Lazy execution format 2 entry/spawn/known finish/output associations and exact declared captures/artifacts; incomplete not live/replay state, no startup scan.
config-file.ts, auth-profile-file.ts, project-identity.ts	Exact configuration/credentials/identity files under their owning contracts.
runtime/lock.ts	Exceptional process exclusion, not durable application state coordination.

Current family labels are card ordinary/tombstone 6, head/mailbox 1, accepted 5, record-head 3, conversation 12 and shared app/provider rows 2. Versions are change labels, not revisions, segment ordinals, currentness or whole-project compatibility. The format reference owns complete baseline/history; equal-number historical incompatibilities stay historical.

Current projections pair exact fresh head UUID with mutable revision. Historical accepted selections have null current identity/revision, not fabricated old heads. Queue-only changes advance card revision without ordinary history; current draft and pending pointers have no predecessor history. Ordinary cards have sparse historical revisions; accepted documents are consecutive. Each reached predecessor/ selection/link is strict at use; current reads certify neither unconsumed history nor future write authority. Live mutation grammar owns immutable type/fields, membership/order, exact lifecycle companions and provenance, not fictional queue replay. commitActivationOutcome is sole running-to-done/failed/blocked publisher; recovery stop and STOPPED activation retain separate exact branches.

Record initialization is absence-only current baseline0; opening consumes it into draft0/target1, changed nonempty mutation becomes target document, later drafts target accepted n+1. Baseline/draft0/empty is ineligible even with accepted backing. Root bootstrap/repair use exact runtime authors; child bootstrap actual creator. Direct Analyst acceptance has no transient workflow draft. No head/version catalog, free-draft recovery or seed-provenance inference exists.

Publication primitives and uncertainty

Immutable documents/segments publish before selector. Fresh exact-target lstat refuses every present object, accepts only ENOENT and never inspects it. Owner- established initial head absence needs no extra probe. Replacement uses one fresh random same-directory UUID temporary opened O_CREAT|O_EXCL|O_WRONLY once, write/fsync/ close, rename target, fsync parent. No retry/alternate name/temp cleanup. All creation uses Node defaults/umask, no mode/chmod/probing.

Head/index publication first unlinks exact prev (ENOENT only), links established current to prev, syncs parent, then fresh-replaces current. Initial absence clears prev/syncs without link; failed link never chooses initial mode. Normal reads/writes never read previous bytes. Prev can be absent/equal-current and share inode damage; it is neither transaction nor guaranteed recovery. Each card/record publication creates a fresh head UUID including queues/drafts/discard/restoration.

Growing JSONL append is one newline physical strict versioned envelope with nonempty ordered rows. Plain append-open missing alone permits owner's first publication. Clean app/provider tail admission validates final envelope; ordinary reads validate complete stream semantics. Torn tail requires full retained-prefix validation then exact ftruncate/fsync/close, returning validated projection without reread. Complete malformed data, empty/no-valid-prefix and immutable old segments fail unchanged. Conversation writer already consumes current and validates incoming batch/session IDs, not a prospective second fold. No writer retains validation authority.

PublicationOutcomeUnknownError is direct owner signal; injected fatal port writes synchronously to fd 2 and exits 1 before any next read/write/retry/log/response/halt/ cleanup/lock release. Rename/parent sync, append writes/fsync/close and current-tail ftruncate onward are potentially uncertain. Direct unlink/link/open errors retain their owner classification. The policy-free exact-write loop advances only positive short-write unsent suffix; no JavaScript thrown-write retry or unknown resend. CardProcess raw callback catches uncertainty even after wrapper cancellation; read- owned truncation preserves it through all projection/tool/HTTP catches. Primitive failure never becomes model failure/no-smaller/Doctor issue/containment success.

Layout, reset and repair

Card publication establishes history/mailbox/records/accepted/conversations and each distinct configured card session root/versions/empty index. Bootstrap establishes global container and required Analyst. Existing empty indexes require established parents at actual publication; no preflight repairs missing directories. Children, Oversight, app log and work/stash paths remain owner-local lazy. Successful file reads/readiness do not certify all future parents or require every lazy root.

Reset owns exactly cards/agents/logs/work wholesale and publishes fresh project under exact lock; source, target outputs, search-ignore, identity, credentials, prompts/skills/instructions, diagnostics, repair-attic and locks remain outside. Every pre-existing lock blocks; no siblings/orphans are discovered. Noncanonical temps/unlinked namespaces remain ignored forever during normal operation.

repair-target.ts is pure exact candidate inspection, shared with CLI consent/ byte-absence recheck. Previous selectors are whole candidates; indexed rollback is only immediate wholly valid predecessor, never historical tail truncation. Current tail is reported truncation; restoring index publishes first then truncates its now-current reported suffix. Eligible separate discard needs both unusable card selections, strict ancestor/type/depth proof and distinct loss consent; record damage alone is insufficient. Six exact own roots move wholesale to fresh attic without children/inventory; fresh synthetic runtime:repair FAILED1/placeholders/empty indexes do not invent old facts. Later healthy-ancestor Run may let Planner reopen it. First failure stops, no compensation; uncertainty is fatal before report/descriptor or prompt/lock release. Full adoption procedures require stopped exclusion, successful complete preserved backup, report/consent and separate restart. Repair is not old-format conversion. External migration is only explicitly requested, offline and outside product/packaged utilities. No detector, dual reader, normalization, automatic rollback/reset or binary-only downgrade exists.

Processes, workspace and tool evidence

Server composition creates one ManagedProcessGroupRegistry, disjoint runtime-card, Analyst and MCP roots, then ProcessRunner. Registry owns scope/category authorization and group truth; runner owns output/presentation, not roots or raw registry access. Spawn installs error listener before leader-PID inspection. Dynamic direct scopes retire only after exact positive absence; unverifiable groups remain retained. This is ordinary lifecycle correctness, not containment of trusted root agents.

Group tracked/absent/unverifiable, native leader exit/error and each stream EOF/ closed/open/not-captured/capture failure remain independent. First authority loss marks unavailable and rejects waits without probing again, manufacturing exit/EOF or restoring authority on later exit. Wait timeout is observation, not containment. Terminal wait/kill/cleanup captures records before await, forms call-local results and retires only eligible exact presentations; entered overlapping consumers keep their captures. Scope cleanup joins only report-stopped groups/drains, retains failed and unavailable scopes and propagates ordinary failure after selected joins. Process logs append synchronously per callback, no retained WriteStream lifecycle; uncertain output writes are fatal before retirement/evidence/cleanup.

command-policy.ts::sanitizedCommandEnv owns inherited allowlist including optional four Git author/committer variables; no default identity or arbitrary credentials. Stdio MCP applies explicit configured env afterward. Ordinary run_command sends one unchanged bash -c argument; shell.run has its own compiled script/argv/env/time/artifact contract. Card tools alone derive SAIVAGE_CARD_WORK_ROOT; globals/MCP receive none. Native absolute/system cwd selects system destinations; relative/project paths stay contained and scoped schemes retain their own admission. The card work root is the organizational default for disposable command work, not a ban on task-justified external clean-install, relocation or dependency-isolation checks within authorized scope. Captures remain project-owned regardless cwd.

Process result owner reads captures once, normalizes valid UTF-8 prefix/redacts then selects certified 2048-byte/30-line heads, raw counts/completeness and fallback URLs. Strict successful run/wait/kill envelope is at most 32768 canonical bytes; generic historical list data is not backfilled to today's ProcessView. Primary-only URL omission happens after strict successful result validation; durable/history/summary source keep original bytes. Missing output is not completion or containment.

Agent read/glob/grep use native absolute or project-relative paths via workspace/agent-read-path.ts, distinct from contained mutations/images/operator Files. Explicit ordinary aliases may read external targets; secrets/internal namespaces remain excluded before content/enumeration. Discovery skips fixed build/cache/dependency/.git directories and does not recursively follow directory symlinks. Project recursive search reads strict .saivage-search-ignore once per invocation, before directory traversal; explicit files/external roots/nonproject schemes do not load it. This is pruning, not confidentiality or permission. One fresh deterministic traversal computes total and requested window; no snapshot, index or stash. Record search reads effective declared logical records, not physical head files. Current reads are observations; immutable version tools alone emit retained locators/hashes.

Shared collection packing measures final settled envelope, with stateless continuation and lowercase-hex JSON byte slices for complete projected items. Scalar summary/ workflow rejects position; historical children page stored carrier without live-child claims. Plain text/diffs use their own slices. Process/MCP/session/diagnostic/control surfaces do not join that paging API. Bounded webfetch owns one reader; metadata GET discards bodies by awaited cancellation. Only successful no-save text overflow can retain normalized raw source to exact stash and return certified redacted head/count/ pointer under final-envelope budget. Binary/non-2xx/save paths fail max bytes. Webfetch itself performs no stash discovery/GC/retry; only explicit work GC may collect eligible unreferenced stashes. Write/edit admission distinguishes lexical tmp capability from normalized destination identity; a plain/system alias to protected .saivage does not acquire tmp authority. URLs redact userinfo/query/fragment before output.

Provider context and compaction

Contracts own pure provider/context/request/failure/validation declarations; runtime owns source selection and context; agents own actual request/admission/attempts; persistence owns successor publication. composeContextProjection orders stable and fresh record blocks, one provenance boundary when non-dynamic context exists, accumulated history, newest recovery/refusal facts, retained instructions and uncovered suffix, then the nonempty latest record descriptor snapshot as a final system block. Its provenance remains observational, not present freshness or write authority; ordinary refreshed reads do not change the preceding retained history. The separately labeled summarizer source retains facts before history. Structural preparation snapshots never reenter context. Summary source is validated then projected one-way; transformed range text is not a durable row. Prompt handling explains retention and prepared/current/historical distinction.

Self-contained successor and sequential construction

Compacted genesis contains summaryText, ordered protectedPrompts, newest recovery/ refusal slots and descriptor-only latestRecordObservations, exact source/cutoff and between-rounds or inherited-open continuation. It is sole prior-history input; current projection never opens old bodies. Required facts grow with actual keys, not fixed-memory eviction. Strict fresh source consumption proves candidate prefix, atomic tool/private bundles, exact protections/facts and physical suffix. No checksum lineage/retained-row inventory certifies prose edits. Successor UUID is allocated once for candidate/publication; segment publishes before cumulative index selection. Freshness/cursors compare UUID and ordinal, including rollback/recompaction.

One compact call chooses at most two positive endpoints: backward-tail preferred safe prefix and furthest legal fallback. Whole fitting rounds use configured snap; oversized newest round permits row-level suffix target snapped backward to atomic boundary. The target is preference, not guaranteed tail/fit. One sequential refine accumulator advances disjoint source ranges, transporting new projected source once. Structural-only advances use no provider and no fake accumulator; local state commits only after whole advance. Latest genuine fold recipe and one correction bit share 16 logical calls, no pool/cache/candidate table. Whole-component geometric probes/ bisection precede code-point refinement of next text component; images stay atomic. Wrappers/escaping/prepared blocks/accumulator and 2000 output tokens enter actual summary serializer admission. Cancellation checks do not interrupt synchronous serialization mid-step. There is no universal linear-cost or fit guarantee.

Preventive strategy seeks strict estimated-token reduction within hard budget, choosing smallest qualifying candidate; trigger is a target. Local-exact uses strict image-aware accounting-byte reduction, tie furthest; authoritative accepts first token reduction. Only complete prospective-valid candidates qualify. No-smaller publishes nothing. Soft summary targets 12000/6000 bytes do not reject complete long prose. Empty/tool/Chat length output may receive one source-faithful correction; protocol/infrastructure/invariant/cancellation/evidence failures do not become size rejection. Ordinary completed candidate precedes eligible declared omission.

First real summary policy refusal publishes source-session exchange evidence once, then forbids more summary calls for that invocation. Without ordinary candidate, eligible local declared omission may discard inherited compactable prose/covered narrative at the same strict endpoints, retaining protections/facts/context/ continuation/suffix. Partial folds supply no coverage; no extra image/history/provider read is used. Concrete days of narrative may be lost. If no candidate succeeds, card compaction-summary-blocked/global safe failure retains original primary evidence and summary ownership. SummaryEvidencePublicationError cannot authorize fallback; unknown publication remains fatal. Last-chance summary-unavailable marker carries no route/attempts and prevents duplicate/reidentified primary/summary evidence.

Request plans and exact admission

Actor weights and provider wire admission are separate. Candidate builder maps ordered projection once, serializes canonical body, hashes and estimates ceil(UTF8bytes/4) plus each emitted image raster reservation. Each CandidateRequestPlan retains structured candidate, capability snapshot, adapter and exact bytes; admission, retries and send reuse them. Actor-visible weight drives preventive maintenance, not provider fit/billing. Usable input is floor(U*C)-O; runtime binding stores max positive capacity, actual candidate admission uses its own. Prepared input supplies completion/utilization once, not modelParams fallback; summary uses same retained winning admission/hash through application boundary.

InvocationService admits capability-compatible candidate membership once per projection in route order, without credentials/exchanges/availability changes. Incapable candidates neither trigger nor suppress size-fixable compaction. ConversationLLMActor may do one local-exact compaction/readmission before primary I/O. Authoritative input-context failure suspends typed admitted execution; one compaction can rebuild only context-failed/nonexhausted retained members, retrying the failed member first. It never enumerates routes to reopen rejected/exhausted ones. Same input, captured blocks/tools/temperature and attempt continuity remain; only history changes, without reappending ingress/results. Later logical operation refreshes records. Second rejection/failed one local pass is final, no third pass.

Attempt runner orders cancellation, unconditional body-hash integrity, retained capability invariant, credentials, protocol wire derivation, recorder/fetch. Integrity error escapes before classification/retry/availability/evidence. Ordered tool schemas project frozen Chat nested or Responses/Codex flat layouts. Nonempty surface uses auto tool choice/parallel false; no forced terminal phase. Chat/public Responses use JSON; Codex SSE. Chat sends max_tokens, Responses max_output_tokens, Codex neither, while admission authority remains exact. Adapters cannot read history or choose context. Responses native private replay compares required producer-account hash(provider,account); mismatch omits only whole encrypted reasoning objects, not native text/functions or marked pairing. Alias equality is not credential equality; invalid encrypted content is terminal, never inferred provenance/backfill.

Codex affinity derives transient SHA256(project root, actual invocation owner), including distinct summary owner. Body prompt_cache_key enters hash/admission and header session-id derives from that body. It is not encryption/auth/global identity or a cache-hit/economics guarantee. Protocol parsers preserve real call identities, latest complete output and strict terminal signal. Codex valid response.completed returns known result without waiting EOF, no delta-text assembler/fallback terminator.

Failure, retries and evidence

Direct structured classifier distinguishes non-OK HTTP versus opened terminal payloads; real status remains evidence. Auth/rate/context-content ambiguity/exact context/content/terminal precedence is not prose/nested-cause matching. Exact overload aliases alone grant unbounded abortable backoff 30–600 seconds outside ordinary four-failure/two-hour finite budgets; generic 5xx is finite. Ready viable admitted alternatives retain scheduler priority and exhaustion never reopens on cooling expiry. Pinned autonomous content-policy pass retries only that refusing candidate/byte-identical plan after overload; it cannot failover/compact/suspend or gain a third policy pass. Continuation returns to original ordinary route with fresh input, never replays completed tool/effect/result. Second refusal appends marker first, links real error attempts and delivers safe BLOCKED through normal owners.

Recorder owns actual started attempts once. Owner cancellation is exact reason identity; unrelated racing error retains actual failure. Known success survives abort as facts but cannot update availability after abort. Lease revocation fences late raw work from canonical publication/hints/delivery; wrapper rejection alone does not prove raw work stopped. Summary evidence publishes under canonical source session with internal-summary identity, not triggering primary input. Errors link terminal_conversation_output_id; successes link assistant_output_ids. Provider- reported five-counter usage preserves zero versus unknown, never sums subsets or estimates billing. Latest-primary reader validates summary rows but excludes them from latest competition.

Request consumption owns 120000 ms inactivity and 900000 ms absolute timers before fetch; headers do not renew, actual body bytes/SSE data outputs do. Comments/partial frames are not progress. Timers end before recorder/publication/recovery waits; owner reason wins abort-associated normalization. OAuth refresh has independent scope and strict status-only non-OK handling:429 rate-limit/Retry-After,5xx/network finite transient; other 4xx/malformed successful payload may retain old token for subsequent real auth handling. Refresh failures send no stale-token provider call or fabricated exchange. Latest-file replacement is accepted last-completed-write-wins with credential-loss risk, no CAS/merge/lock. Process-local availability resets on restart and is not durable health. Provider API projects Registry capabilities/candidate records. It exposes no endpoints and uses no configuration fallback. It does not present an account aggregate as model facts.

Operational observations and private diagnostics

observability/outbound-http.ts supplies call-local UUID/elapsed/safe source to explicit provider/auth/MCP/web fetch owners and scheduler waits. Composition binds one Fastify info sink; downstream packages do not import Fastify. Dispatch/headers/ terminal/body disposition follow actual consumption, without tee/drain. Manual retries/redirects get new IDs; native automatic redirects remain one fetch. Wait candidate is not next-send promise. Only sink's ordinary exception is tolerated, never publication uncertainty. This is deployment-retained stdout/journal, not app log, public Debug or lossless durable request ledger. CLI/browser/stdio peers and dependency tooling are not covered external fetch owners.

Opt-in FailedProviderRequestDiagnostics observes actual serialized failed requests after canonical admission/exclusion. Exclusive activation UUID and self-ignore precede finite 16 slots/one hour, 8 MiB documents or 16 KiB metadata; reuse disables without inspecting retained data. Current diagnostic 3/privacy 2 positive native-position projection distinguishes exact/redacted/omitted/reencoded fidelity, drops extensions/ images/credentials and reports hashes/counts without a general secret-free claim. It is sensitive private text, no replay fixture/provider receipt/canonical evidence or UI export. Publication uncertainty is fatal before notices/retry/cleanup. Files excludes lexical/resolved namespace; diagnostics stay outside reset and have no reader/index/scanner/cleanup. Diagnosis owns safe use.

Outbound MCP connections and native content

This is Saivage→configured server, not external client→Analyst. Composition creates one required immutable invocation port and sole installer, reconciles McpManager then installs once before inbound work. Duplicate/preinstall use is invariant failure, not unavailable fallback. Manager retains definitions/runtimes/status/cleanup; tools receive narrow installed invocation/control ports and independent grants.

YAML connection policy and lazy strict format 1 mcp-servers.json definitions share connection schemas. Dynamic literal definitions cannot shadow YAML, never autostart and survive reset. Register/replace/unregister are exact synchronous publication, not partial config patch or topology journal. Replacement needs contained/eligible owner, publishes whole connection then retires it; stopped status alone is not containment proof. Unregister can commit removal before stop failure and retains closed owner without compensation. Restart captures retained owner, joins stop, checks identity/admission/cancellation and fresh-starts selected definition. HTTP reconnect is local, never remote-service restart. Failed containment blocks replacement.

Each runtime owns transient binding UUID/catalog UUID and a complete discovery snapshot. Ready requires initialize/initialized/all list pages under one 180 s budget. HTTP has no HEAD prerequisite or roots advertisement; stdio uses project cwd and answers negotiated roots/list on one permanent bounded receiver. Method requests dispatch before response correlation; pending slot registers before write. Catalog refresh uses same connection,30s queue-inclusive budget and fresh UUID even identical tools; only complete current candidate publishes. Whole schema remains intact/fingerprinted. Ajv2020 handles absent/2020-12 declaration, draft07 only explicit draft07 (each empty- fragment variant allowed); no coercion/default/removal/network refs/dialect fallback.

Invoke validates binding/catalog/schema at dispatch, inside stdio serialization. Default 900000 ms deadline excludes stdio queue, HTTP covers request/body. Queued cancellation dispatches nothing; active stdio abort/ambiguous closure permanently fences admission and joins direct containment before outer stop, never self-join. HTTP abort is request-local, not remote termination. Fully correlated consumed native response remains known after later EOF; exact caller cancellation/publication fence still applies. EOF alone does not invent process exit; exact runner observer supplies terminal/unavailable facts, preserving failed owner and failure precedence. No automatic restart/replay/remote continuity or hard wall-clock completion guarantee.

Live protocol mapper validates full native envelope once; converter retains ordered text/image/nonimage metadata rather than stringifying or promoting nested lookalikes. Native isError alone supplies telemetry success before later conversion; a later image/publication failure does not rewrite known native outcome. Safe diagnostics stay tool-local, not duplicate event errors.48MiB wire,32MiB aggregate decoded source, 1 MiB complete projected nonimage and 512-byte ordinary error limits are not lossy prefix paging. Native errors select no pixels. Process/presentation ownership remains MCP service scope, not agent wait/kill capability. Shared browser context is disposable; catalog readiness is observation, not guaranteed present connection/known delivery.

Images: selection, materialization and inspection

contracts/tool-result.ts owns strict producer-neutral ordered text/image success content; image-normalization.ts owns source/oriented/sent dimensions/invariants. Workspace view_image adds admitted source label and matching strict metadata; native MCP reuses neutral content without inventing workspace paths. Backend-only Sharp static decode/orient/resize/sRGB produces PNG. Workspace admits PNG/JPEG, native additionally WebP with strict canonical base64; source bound 32 MiB/40 million pixels, selected PNG 16 MiB, shared max dimension default 1600.

Transient produced content crosses exact invoking-signal fence before real LLM settlement publishes images/<UUID>.png via fresh-file primitive and canonical result descriptors. External calls return call-local bytes instead. Descriptors select raw PNG under conversation format 12, no image index/family wrapper/scan/GC. Physical Files excludes this subtree. Source/session ownership and repeated occurrence order survive.

conversation-image-materialization.ts follows selected original-source descriptors, validates bytes/hash/decode/dimensions and binds request-local content. Provider adapters are pure serializers; shared OpenAI serializer emits metadata then all ordered parts under the original call-linked function output, not a new user image. Synthetic summary images keep their distinct user-source path and atomic bundles. Each actual emission adds wire bytes/4 plus 2*ceil(width/32)*ceil(height/32) raster reservation under 32 MiB image-bearing request cap; this is approximate accounting, not billing. Covered images leave active pixels; later folds inherit prose/tail. Both composition and actual retained-image summary use independently check compatible fixed summary capability even after tools are removed.

AgentOperatorReadModelService independently admits exact session/segment UUID/ version/result/content-index/image descriptor then uses strict byte reader. Missing/ changed/unavailable remains typed, no fallback source. Ordinary Files raster inspection freshly admits current source separately. Browser caller-local ImagePreviewDialog owns one abortable read/object URL, Fit/1:1, exact selected occurrences and focus/background scroll. Optional normalization enrichment can fail without hiding typed actions; Native MCP capture is a label, not schema source_path. Metadata/copy never fetch pixels. Recorded selection/prepared request is not provider perception.

Read models, transport and browser state

REST is authoritative; WebSocket carries lossy exact-resource freshness hints. operatorApiContracts is the sole GET/POST request/status-response/auth registry, shared by backend and web through operation-indexed types, not generated clients. Only liveness/readiness are registry-public; API is operator-session. Auth precedes request validation. ContractRuntime admits params/query/body, projects allowlisted validated identity, invokes narrow handler, validates exact declared status and sends one descriptor outside its catch. Handler has headers/finish hook, no status/send. Unexpected pre-send errors produce fixed-safe 500 plus phase log; final transport/serializer failures belong to Fastify. Undeclared/malformed browser responses fail before store/ auth signaling. Query-free Pino request URL avoids ticket logs. Static SPA/docs and ticket-or-disabled observation WS are separate boundaries; no socket submits work.

Source-adjacent egress

Owners project classified fields directly: agents provider exchange, observability events, persistence control action, config effective input, application cards/processes, tools invocation and MCP catalog. redaction/index.ts exports primitive text/URL/ dynamic filtering only, not a generic dispatcher. Strict known outputs never enter an opaque fallback. Config omits provider/account base URLs, masks keys/env, filters MCP URL; tool arguments filter locations independently from execution, while valid record URLs retain exact spelling. Generic old result data stays opaque; strict successful typed content/selected images retain their owners. Record/card diff projection occurs before comparison, sharing artifact projection with REST/tools/Files/hashes. Text defense has finite credential families/placeholders, no exhaustive detection or fixed-point guarantee. Record prompt redaction lifts rules through exactly one JSON string layer, never recursively reconstructs body/template. Browser message ingress is not an egress projector.

Successful navigation data is independently parsed against the strict shared target/intent contract immediately before browser route effects, requiring exact tool correspondence. Invalid/cross-wired/failed/unknown results cannot navigate; opaque historical payload inspection does not bypass this effect admission.

Granular card, session and evidence resources

CardsReadModelService supplies separate immediate hierarchy, selected detail, compiled descriptors/exact records, history/version/diff. Hierarchy reads immediate membership once and projects compiled permitted_child_types; current semantic order filters complete active carrier through exact live children. No aggregate index/cache. At depth d exact path consumes d+1 heads/selections; history adds reached predecessors, records their selected documents. Writes avoid history-sized copies, not body/pointer- size work or indefinite immutable accumulation. Virtual Files is exact linked semantic card/record content, never raw head/index/mailbox or fallback filesystem access. Current card wrapper is versionless/head-identified; historical/tombstone wrapper 4 is projection, not another durable family.

Agent read model derives inventory from configured globals/active cards, direct known session from current/tombstone type and exact session grammar, without enumerating sessions. One request-local executing-session map supplies active/busy, not transcripts/ app logs/browser joins. Started_at comes from index; exact history access remains lifecycle-ungated. Current/history both validate canonical data then exclude private rows and project safe opaque results. Cursor/version selection follows complete validation. Current instructions render all matching loaded bindings without conversation/evidence/disk reread, dynamic context/tools/wire bodies or provider invocation; initially closed browser disclosure owns abort/discard/reopen/Refresh. Same-session segment updates do not refetch it. Historical text remains separate.

Execution read model strictly consumes lazy non-LLM history then selects bounded rows/ invocation/file reference. Preview/download delegates same Files confidential text owner, not raw capture. Events read complete app log then filter/page; Errors are explicit runtime diagnostics/actionable errors/failed MCP, never direct-control informational events. Control actions/external receipts are separate bounded observations, not delivery/effect ledger. Content-policy endpoint follows exact linked history/tombstones and refusal metadata; it has no bootstrap/reconnect UI store/banner. Doctor alone converts ordinary one-cards-read failure to fixed diagnostic 200, preserving publication fatality first. Workflow presentation is immutable per-type compact topology; Debug Graphs projects rich installed declarations/bindings without body/path/ accounts, not a reconfigure disk view.

Freshness and request owners

Owners call typed SyncHub picks after known publication: runtime; exact card scope; Agent membership; conversation UUID/version/last physical row; primary exchange. No EventBus, event freshness, Files/Processes/Timeline topic or write authority. Card changes invalidate detail/history/diff/own children and known parent children; tombstone adds declared records, accepted record only its exact name. Initial pre-link bootstrap/no-op/failed writes emit none. Conversation first publication adds membership; summary evidence emits no primary exchange hint. Coalescing uses last accepted arrival, not numeric max ordinal.

Exact SyncHub debounce policy

constant.sync-hub-debounce-ms = {"unit":"milliseconds","value":75}

LiveSyncSocket owns connection-local acknowledged exact-key leases for global/card membership/conversation/exchange. Replacement subscribe precedes ack, stale unsubscribe cannot remove successor; close loses all leases. Browser generations fence old callback completions, baseline callbacks precede pending reconciliation, and each registration gets its own ack baseline even shared callback object. Global distinct pending scopes broaden to null baseline; one repeated scope stays scoped. No global cross-generation flight gate. Ordinary non-Cards refetch registrations use one active plus latest trailing function; Cards has its separate invalidation/reconnect branch.

RuntimeStore owns combined REST state/status acceptance, not socket state; accepted null is stopped/no-live and refresh failure retains last success. CardStore owns parent-keyed hierarchy, selected detail, ordered exact record slots and independent catalog/version/diff. Each request owner/AbortController compares exact identity on success/error/finally; reset/selection replacement aborts first. Record current responses never overwrite captured historical/diff fields. Exact detail 404 clears subordinate admission; optional record absence differs from canonical damage. Reconnect refreshes only accepted mounted scopes, skipping failed-stale until Retry; no fanout/preload. Deep reveal traverses accepted nonstale slices with ephemeral action token, bounded by card depth. Display paths derive loaded sibling order, never identity normalization.

Agent inventories partition exact global/card keys and independent targeted requests; baseline aborts/fences hints and selected-summary refresh remains separate from transcript. Card Conversations owns its own store/lease. Selected conversation and Analyst share tail request/cursor core, not selection/send ownership. Append needs exact segment UUID/version; segment-changed 409 rebases cursorless once. Explicit history ignores current hints. useSelectedConversation subscribes before fetch, token/epoch fences delayed cleanup even same-ID replacement; exchange has separate token. Analyst panel owns acknowledged handoff/transcript lifetime, AppShell only configured identity arbitration. Inspector/panel swap waits teardown tick. Busy removes only optimistic send and restores captured draft only if empty; no server queue or socket acknowledgement.

Cockpit is one route owner for home/card/exact session, resolving session first; global creates no card context and readable conversation may survive unavailable card context. Five facets are Overview, Conversations, Executions, Records & History, Evidence. Overview reuses record/session owners, not a correctness/completion/wait- reason oracle. Executions owns selection/file abort boundaries. Evidence catalog uses local direct promises; not every facet inherits owned-fetch fencing. createOwnedFetch handles its consumers' instance-local current request only; Cards, graph, directory, inventory and conversation owners keep separate contracts. Current-card orientation is an independent last-known detail plus runtime-admission observation, no atomic synchronization/polling. SystemView owns sections/requests/ membership lease; panels present typed events, hidden sections own no automatic work. Errors selected-only, Doctor manual, MCP no polling, Events explicit refresh/pages.

Files owns route selection/listing/preview lifetime separately; reconnect joins pending route resolution, then represented listing/preview, never default-root replacement. Listing age 30 s resets only accepted listing, not preview or callback time. Lexical and resolved privacy/card reservation precedes generic stat/content; exact ENOENT alone is absence and indeterminate classifier fails closed. Card aliases never fall through. Selected-config aliases use effective projection. Text reads check raw 1 MiB cap, whole-buffer UTF8/NUL/control ratio before one decode/redaction, preserving BOM/CRLF; images are separate fresh ordinary raster admission. Direct record URLs and virtual physical previews retain their own caps/metadata. No raw capture/config/attic bypass.

Browser presentation and build ownership

Shared JsonText/json-tokens renders lossless lexical Vue text nodes, no HTML/value roundtrip; CodeBlock owns copy/layout and large inputs retain exact plain fallback. Shared MarkdownText transforms references outside code, synchronously parses GFM then DOMPurify-sanitizes HTML string; sanitizer does not bound parse cost. Conversation association uses session/source/call, retains both physical anchors and source order while rendering matched pair once at call position. Nonadjacent results show later-result provenance. Unknown/missing data stays inspectable/unavailable, never inferred success/liveness; disclosures stay in one transcript scroll surface, no invented virtualizer or persisted reading-position model. Same selection retains ephemeral state; departure resets. Request/Result safe originals are not raw secrets.

Root/web manifests and locks own separate dependencies. Matched Vue core patches cover root SFC semantic analysis/docs SSR and web runtime/plugin compilation; language-tools/test-utils/devtools have independent compatibility. Static roots derive executing source/dist module layout, not cwd/ancestor names. Build/serving checks belong to validation, including public /docs and unknown-route 404. No runtime OpenAPI generator, prompt editor, generic plugin registry or compatibility redirect surface exists.

Lifecycle exclusion and CLI delegation

Lock classification is exactly missing, verified live, positively dead, indeterminate and malformed; no outcome authorizes removal/takeover. Acquisition establishes canonical root/identity/process start, then .saivage/locks parents with ordinary defaults and exact EEXIST directory proof. Missing bound identity fails before layout. Lock creation is known empty namespace; record write/sync uncertainty is fatal. Ordinary failure releases exact owned handle without undoing prior config/identity/generated effects; uncertainty permits no release.

CLI status/pause/resume/stop/restart delegates only verified live published endpoint/ auth. Null endpoint says only active lifecycle owner; runtime control unavailable. Missing/dead status is stopped, Stop already-stopped/not-contained, Pause/Resume fail; dead directs manual repair. Malformed/indeterminate fails closed. Client never rediscovers flags/YAML/env/defaults or falls back after REST/auth/schema failure. Disabled auth omits Authorization; bearer requires nonblank header token. Offline control never reads/mutates runtime state. Runtime control owns operator next actions.

Source-derived reference

These exact inventories remain at this canonical owner for source-parity guards. They are lookup data, not another runtime registry. Operational procedures are in the runbook; human configuration lookup belongs to the configuration documentation.

Operator routes

Work reclamation uses the strict runtime.gcWork operation with required mode: dry_run|delete, optional RFC3339-zone before and nonnegative safe-integer target_bytes; unknown keys fail. The response carries mode, disposition: completed|interrupted|refused, a bounded reason, restoration: not_acquired|resumed|not_resumed, and nullable accounted result. Ordinary refusal/interruption can be a 200 response: inspect disposition, not HTTP status alone. Duplicate/held ingress uses 409 {error:'WorkGcBusy',message:'Work garbage collection is busy.'}; existing validation, authentication and internal errors remain 400/401/500. The result separates would-delete from known-deleted counts/bytes, retained reasons and expected accounted remaining/target shortfall; whole_work_size_known is false. See result interpretation.

Route	Purpose	Source
GET /api/agents	Active compiled-workflow session summaries.	src/contracts/operator-api-agents.ts:502
GET /api/agents/:id	Exact known session summary.	src/contracts/operator-api-agents.ts:514
GET /api/cards/:id/agent-sessions	One active card's session summaries.	src/contracts/operator-api-agents.ts:569
GET /api/cards/:id/executions	Bounded chronological non-LLM execution rows.	src/contracts/operator-api-executions.ts:139
GET /api/cards/:id/executions/:invocationId	Exact invocation evidence, not liveness.	src/contracts/operator-api-executions.ts:163
GET /api/cards/:id/executions/:invocationId/files/:fileKey	Selected bounded redacted text.	src/contracts/operator-api-executions.ts:181
GET /api/cards/:id/executions/:invocationId/files/:fileKey/download	Same confidential text as attachment.	src/contracts/operator-api-executions.ts:199
GET /api/agents/:id/conversation	Current segment with exact segment cursor.	src/contracts/operator-api-agents.ts:585
GET /api/agents/:id/current-instructions	All matching loaded static bindings.	src/contracts/operator-api-agents.ts:484
GET /api/agents/:id/conversation/versions	Indexed segment catalog.	src/contracts/operator-api-agents.ts:530
GET /api/agents/:id/conversation/versions/:version	Exact indexed segment.	src/contracts/operator-api-agents.ts:547
GET /api/agents/:id/llm-exchange	Latest primary exchange.	src/contracts/operator-api-agents.ts:604
POST /api/auth/ws-ticket	WebSocket ticket.	src/contracts/operator-api-auth.ts:20
GET /api/chat	Configured global Analyst identity/availability.	src/contracts/operator-api-chats.ts:105
POST /api/chat	Internal Analyst submission.	src/contracts/operator-api-chats.ts:117
GET /api/workflows/:cardType/presentation	One installed type's presentation topology.	src/contracts/operator-api-workflows.ts:106
GET /api/config	Redacted effective configuration.	src/contracts/operator-api-config.ts:128
GET /api/providers	Process-local routing/capability observation.	src/contracts/operator-api-config.ts:140
GET /api/control-actions	Bounded Analyst action evidence.	src/contracts/operator-api-config.ts:152
GET /api/external-tool-calls	Body-free settled external receipts.	src/contracts/operator-api-config.ts:116
GET /api/events	Authenticated retained-event query.	src/contracts/operator-api-events.ts:46
GET /api/files	Privacy-admitted listing.	src/contracts/operator-api-files-debug.ts:340
GET /api/files/content	Admitted projected text.	src/contracts/operator-api-files-debug.ts:356
GET /api/files/image	Fresh ordinary static raster bytes.	src/contracts/operator-api-files-debug.ts:321
GET /api/agents/:id/conversation/images	Exact descriptor-selected recorded occurrence.	src/contracts/operator-api-agents.ts:456
GET /api/mcp/tools	Server/tool hierarchy.	src/contracts/operator-api-mcp.ts:94
POST /api/mcp/servers/:name/start	Start/install/complete discovery.	src/contracts/operator-api-mcp.ts:77
POST /api/mcp/servers/:name/stop	Stop/join retained owner.	src/contracts/operator-api-mcp.ts:83
POST /api/mcp/servers/:name/restart	Nonatomic stop then fresh start.	src/contracts/operator-api-mcp.ts:89
GET /api/processes	Process observations.	src/contracts/operator-api-processes.ts:221
GET /health	Public liveness.	src/contracts/operator-api-runtime-cards.ts:559
GET /health/ready	Public readiness.	src/contracts/operator-api-runtime-cards.ts:567
GET /api/state	Runtime/project without inventory.	src/contracts/operator-api-runtime-cards.ts:575
GET /api/runtime/content-policy	Read-derived refusal count/latest locator.	src/contracts/operator-api-runtime-cards.ts:587
GET /api/cards/:id/children	Immediate active hierarchy slice.	src/contracts/operator-api-runtime-cards.ts:599
GET /api/cards/:id	Selected current detail.	src/contracts/operator-api-runtime-cards.ts:615
GET /api/cards/:id/records	Compiled record descriptors.	src/contracts/operator-api-runtime-cards.ts:631
GET /api/cards/:id/records/:name	Exact current effective record.	src/contracts/operator-api-runtime-cards.ts:647
GET /api/cards/:id/records/:name/history	Accepted-record catalog.	src/contracts/operator-api-runtime-cards.ts:667
GET /api/cards/:id/records/:name/versions/:version	Exact accepted document.	src/contracts/operator-api-runtime-cards.ts:683
GET /api/cards/:id/records/:name/diff	Projected record comparison.	src/contracts/operator-api-runtime-cards.ts:703
GET /api/cards/:id/history	Sparse ordinary history catalog.	src/contracts/operator-api-runtime-cards.ts:725
GET /api/cards/:id/history/:version	Exact ordinary/tombstone artifact.	src/contracts/operator-api-runtime-cards.ts:741
GET /api/cards/:id/diff	Projected card comparison.	src/contracts/operator-api-runtime-cards.ts:757
GET /api/runtime/status	Supervisor runtime observation.	src/contracts/operator-api-runtime-cards.ts:774
POST /api/runtime/pause	Bodyless cooperative Pause.	src/contracts/operator-api-runtime-cards.ts:786
POST /api/runtime/gc-work	Explicit live-owner work preview or deletion.	src/contracts/operator-api-work-gc.ts:7
POST /api/runtime/resume	Bodyless same-Run Resume.	src/contracts/operator-api-runtime-cards.ts:799
POST /api/runtime/stop-project	Bodyless project containment.	src/contracts/operator-api-runtime-cards.ts:813
POST /api/runtime/restart-server	Exact-confirmation authenticated restart.	src/contracts/operator-api-runtime-cards.ts:826

Internal debug routes

Route	Purpose	Source
GET /api/debug/doctor	Authenticated bounded card diagnostic.	src/contracts/operator-api-files-debug.ts:406
GET /api/debug/errors	Explicit error projection.	src/contracts/operator-api-files-debug.ts:382
GET /api/debug/graphs	Non-disclosing installed workflow projection.	src/contracts/operator-api-files-debug.ts:394

Agent tools

Rows compare alphabetically normalized default membership, not operational order. These default rows and the fixed shipped-role-inventories claim cover the three OFF profiles. The provision-required classic-git builder derives the same graph: its Analyst excludes run_command/wait_process/kill_process and the three default MCP tools, while Executor adds checkpoint_source and optional git-correction.md permission on every type. Other role inventories are unchanged. The tool-union and exclusive-role guards include this separately validated native selection. Classic shared factory, contracts Oversight policy and actual binding own order; emit_result is workflow-generated. Optional MCP tools remain explicitly selected, not default grants. Shared reopen spelling never aliases scoped contracts.

Agent	Tools	Source
planner	activate_card,cancel_card,create_card,diff_card_versions,edit,edit_card,get_card,get_card_version,get_tree,glob,grep,list_card_versions,list_cards,list_observed_collections,query_observed_collections,read,read_record_version,reopen_card,reorder_child,webfetch,websearch,write	src/config/system-templates/classic-shared.ts:198
executor	apply_patch,diff_card_versions,edit,get_card_version,glob,grep,kill_process,list_card_versions,list_observed_collections,mcp_server_control,mcp_tool_call,mcp_tools,query_observed_collections,read,read_record_version,run_command,skill,view_image,wait_process,webfetch,websearch,write	src/config/system-templates/classic-shared.ts:255
reviewer	diff_card_versions,edit,get_card_version,glob,grep,list_card_versions,list_observed_collections,query_observed_collections,read,read_record_version,skill,view_image,webfetch,websearch,write	src/config/system-templates/classic-shared.ts:230
analyst	apply_patch,cancel_card,create_card,delete_card,diff_card_versions,edit,get_card,get_card_version,get_status,get_tree,glob,grep,kill_process,list_agent_sessions,list_card_versions,list_cards,list_observed_collections,list_processes_tool,mcp_server_control,mcp_tool_call,mcp_tools,navigate_back,navigate_workspace,pause_runtime,query_observed_collections,queue_notification,read,read_agent_session,read_control_actions,read_record_version,read_runtime_errors,read_runtime_events,reconfigure,reopen_card,reorder_child,restart_server,resume_runtime,run_command,show_config,skill,start_project,stop_project,view_image,wait_process,webfetch,websearch,write	src/config/system-templates/classic-shared.ts:132
oversight	diff_card_versions,get_card,get_card_version,get_status,get_tree,glob,grep,list_agent_sessions,list_card_versions,list_cards,list_processes_tool,queue_notification,read,read_agent_session,read_record_version,read_runtime_errors,read_runtime_events	src/contracts/oversight-tool-policy.ts:2

Exact shipped tool identities

The verifier follows exact template factory/registry declarations, PAAD config reuse, Oversight tuple and actual invocation-projector/browser-presenter gates. Sorted membership, configured order, optional identities and scoped exclusivity are separate claims, not a second executable catalog.

tools.shipped-role-inventories = {"agents":[{"name":"analyst","tools":["create_card","reorder_child","reopen_card","queue_notification","get_status","start_project","pause_runtime","resume_runtime","stop_project","restart_server","navigate_workspace","navigate_back","show_config","reconfigure","read_runtime_events","read_runtime_errors","read_control_actions","list_processes_tool","list_agent_sessions","read_agent_session","cancel_card","delete_card","list_cards","get_card","get_tree","list_card_versions","get_card_version","diff_card_versions","read_record_version","read","view_image","write","edit","glob","grep","apply_patch","run_command","wait_process","kill_process","websearch","webfetch","skill","list_observed_collections","query_observed_collections","mcp_tool_call","mcp_server_control","mcp_tools"]},{"name":"executor","tools":["read","view_image","write","edit","glob","grep","apply_patch","run_command","wait_process","kill_process","list_card_versions","get_card_version","diff_card_versions","read_record_version","websearch","webfetch","skill","list_observed_collections","query_observed_collections","mcp_tool_call","mcp_server_control","mcp_tools"]},{"name":"oversight","tools":["get_status","list_cards","get_card","get_tree","list_card_versions","get_card_version","diff_card_versions","read_record_version","read","glob","grep","read_runtime_events","read_runtime_errors","list_processes_tool","list_agent_sessions","read_agent_session","queue_notification"]},{"name":"planner","tools":["create_card","edit_card","cancel_card","activate_card","reopen_card","reorder_child","list_cards","get_card","get_tree","read","write","edit","glob","grep","list_card_versions","get_card_version","diff_card_versions","read_record_version","websearch","webfetch","list_observed_collections","query_observed_collections"]},{"name":"reviewer","tools":["read","view_image","write","edit","glob","grep","list_card_versions","get_card_version","diff_card_versions","read_record_version","websearch","webfetch","skill","list_observed_collections","query_observed_collections"]}],"templates":["classic","classic-typed","paad-typed"]}
tools.projector-presenter-equality = {"gates":["projectLiveToolInvocation","projectToolInvocation"],"names":["activate_card","apply_patch","cancel_card","checkpoint_source","code_quality_javascript_eslint","code_quality_python_ruff","code_quality_typescript_eslint","create_card","delete_card","diff_card_versions","edit","edit_card","emit_result","get_card","get_card_version","get_status","get_tree","glob","grep","kill_process","list_agent_sessions","list_card_versions","list_cards","list_observed_collections","list_processes_tool","mcp_catalog_refresh","mcp_server_control","mcp_server_register","mcp_server_replace","mcp_server_unregister","mcp_servers","mcp_tool_call","mcp_tools","navigate_back","navigate_workspace","pause_runtime","query_observed_collections","queue_notification","read","read_agent_session","read_control_actions","read_record_version","read_runtime_errors","read_runtime_events","reconfigure","reopen_card","reorder_child","restart_server","resume_runtime","run_command","show_config","skill","start_project","stop_project","view_image","wait_process","webfetch","websearch","write"],"sources":["KNOWN_TOOL_INVOCATION_NAMES","TOOL_PRESENTERS","shipped-role-union-plus-terminal-and-optional-mcp-and-quality"]}
tools.exclusive-identities = {"analystPresenterOnly":["delete_card","navigate_back","navigate_workspace","pause_runtime","read_control_actions","reconfigure","restart_server","resume_runtime","show_config","start_project","stop_project"],"plannerOnly":["activate_card","edit_card"]}

Presentation uses one immutable descriptor record in web/src/utils/tool-presenters/index.ts: action/read-only group/target/outcome, then Request/Result semantic sections and complete safe originals. Null result is No result recorded; unknown shape is unavailable, not alternate normalized success. Domain refusal/partial effects remain distinct from envelope success. Image actions use typed occurrences even without optional workspace metadata. Presentation policy cannot replace bound tools/generated result authority.

SkillCatalog reads the exact optional index and one selected file on explicit use, validates complete current input and filters exact configured agent names/order. Only index ENOENT is empty; invalid selected files fail. skills:true plus selected skill tool is necessary. No role-name inference, auto-injection or compatibility payload: successful list/load retains the complete generic result envelope and failure uses the same generic error path.

Config schema

Each row is one reachable fixed-field object occurrence rooted at source saivageConfigSchema. Record values use .entry; reused/optional/nullable schemas retain every occurrence. Source optional card_types differs from required effective map. These are field inventories, not defaults or permission grants.

Section	Fields	Source
top-level	agents,analyst_agent,card_types,compaction,git_workflow,mcpServers,models,oversight,providers,server	src/schemas/saivage-config.ts:591
agents.entry	can_create_children,model_route,prompt,quality_tools,record_writes,session,skills,tools	src/schemas/saivage-config.ts:443
git_workflow.variant1	enabled,format_version	src/schemas/saivage-config.ts:260
git_workflow.variant2	correction,delivery_branch,enabled,excluded_paths,format_version,integration,preservation,private_ref_namespace,review_bindings,source_roots	src/schemas/saivage-config.ts:262
git_workflow.variant2.preservation	interrupted_rebase,source_checkpoint	src/schemas/saivage-config.ts:277
git_workflow.variant2.correction	agent,correction_prompt,prompt	src/schemas/saivage-config.ts:283
git_workflow.variant2.correction.prompt	compactable,reference	src/schemas/saivage-config.ts:201
git_workflow.variant2.correction.correction_prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:204
git_workflow.variant2.review_bindings.entry	approved_outcome,node	src/schemas/saivage-config.ts:292
agents.entry.prompt	compactable,reference	src/schemas/saivage-config.ts:200
models	equivalents,failover,profiles,routes	src/schemas/saivage-config.ts:42
models.routes.entry	candidates,max_tokens,profile,temperature	src/schemas/saivage-config.ts:27
models.profiles.entry	allowed,preferred	src/schemas/saivage-config.ts:9
providers.entry	accounts,apiKey,authProfile,baseUrl,capabilities,modelCapabilities,models,priority	src/schemas/saivage-config.ts:83
providers.entry.capabilities	contextWindowTokens,exclusiveToolChoiceSupport,imageInput,maxOutputTokens,quirks,responsesReasoning,toolsMode,transportProtocol	src/schemas/saivage-config.ts:52
providers.entry.capabilities.responsesReasoning	effort	src/schemas/saivage-config.ts:61
providers.entry.modelCapabilities.entry	contextWindowTokens,exclusiveToolChoiceSupport,imageInput,maxOutputTokens,quirks,responsesReasoning,toolsMode,transportProtocol	src/schemas/saivage-config.ts:52
providers.entry.modelCapabilities.entry.responsesReasoning	effort	src/schemas/saivage-config.ts:61
providers.entry.accounts.entry	apiKey,authProfile,baseUrl,capabilities,models,priority	src/schemas/saivage-config.ts:71
providers.entry.accounts.entry.capabilities	contextWindowTokens,exclusiveToolChoiceSupport,imageInput,maxOutputTokens,quirks,responsesReasoning,toolsMode,transportProtocol	src/schemas/saivage-config.ts:52
providers.entry.accounts.entry.capabilities.responsesReasoning	effort	src/schemas/saivage-config.ts:61
server	host,port	src/schemas/saivage-config.ts:97
compaction	context_utilization_fraction,enabled,snap,summarizer_candidate,tail_fraction,trigger_fraction	src/schemas/saivage-config.ts:112
compaction.summarizer_candidate	account,model,provider	src/schemas/saivage-config.ts:104
oversight	agent,enabled,interval_seconds	src/schemas/saivage-config.ts:126
card_types.entry	permitted_child_types,records,workflow	src/schemas/saivage-config.ts:399
card_types.entry.records.entry	bootstrap,format,initialization,schema	src/schemas/saivage-config.ts:382
card_types.entry.records.entry.initialization	format_version,template	src/schemas/saivage-config.ts:388
card_types.entry.workflow	after_activation_commit,entries,format_version,nodes,notification_recipient	src/schemas/saivage-config.ts:356
card_types.entry.workflow.after_activation_commit	execution,statuses	src/schemas/saivage-config.ts:360
card_types.entry.workflow.after_activation_commit.execution	action,config,contract_version,inputs,kind	src/schemas/saivage-config.ts:271
card_types.entry.workflow.after_activation_commit.execution.inputs.entry.variant1	literal	src/schemas/saivage-config.ts:252
card_types.entry.workflow.after_activation_commit.execution.inputs.entry.variant2	source	src/schemas/saivage-config.ts:256
card_types.entry.workflow.entries	BACKLOG,BLOCKED,CHANGED,STOPPED	src/schemas/saivage-config.ts:371
card_types.entry.workflow.entries.BACKLOG	node,prompt	src/schemas/saivage-config.ts:218
card_types.entry.workflow.entries.BACKLOG.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.entries.CHANGED	node,prompt	src/schemas/saivage-config.ts:218
card_types.entry.workflow.entries.CHANGED.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.entries.BLOCKED	node,prompt	src/schemas/saivage-config.ts:218
card_types.entry.workflow.entries.BLOCKED.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.entries.STOPPED	node,prompt	src/schemas/saivage-config.ts:224
card_types.entry.workflow.entries.STOPPED.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry	descendant_context,edges,execution,initialize_records,record_prompts,records,output_record	src/schemas/saivage-config.ts:321
card_types.entry.workflow.nodes.entry.execution.variant1	agent,correction_prompt,data_inputs,inputs,kind,prompt	src/schemas/saivage-config.ts:280
card_types.entry.workflow.nodes.entry.execution.variant1.prompt	compactable,reference	src/schemas/saivage-config.ts:200
card_types.entry.workflow.nodes.entry.execution.variant1.correction_prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.execution.variant1.data_inputs.entry.variant1	enum,type	src/schemas/saivage-config.ts:260
card_types.entry.workflow.nodes.entry.execution.variant1.data_inputs.entry.variant2	max,min,type	src/schemas/saivage-config.ts:262
card_types.entry.workflow.nodes.entry.execution.variant1.data_inputs.entry.variant3	type	src/schemas/saivage-config.ts:268
card_types.entry.workflow.nodes.entry.execution.variant1.data_inputs.entry.variant4	type	src/schemas/saivage-config.ts:269
card_types.entry.workflow.nodes.entry.execution.variant1.inputs.entry.variant1	literal	src/schemas/saivage-config.ts:252
card_types.entry.workflow.nodes.entry.execution.variant1.inputs.entry.variant2	source	src/schemas/saivage-config.ts:256
card_types.entry.workflow.nodes.entry.execution.variant2	action,config,contract_version,inputs,kind	src/schemas/saivage-config.ts:271
card_types.entry.workflow.nodes.entry.execution.variant2.inputs.entry.variant1	literal	src/schemas/saivage-config.ts:252
card_types.entry.workflow.nodes.entry.execution.variant2.inputs.entry.variant2	source	src/schemas/saivage-config.ts:256
card_types.entry.workflow.nodes.entry.record_prompts.item	presence,prompt,record,selection	src/schemas/saivage-config.ts:332
card_types.entry.workflow.nodes.entry.record_prompts.item.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.records.entry	gate,mode	src/schemas/saivage-config.ts:344
card_types.entry.workflow.nodes.entry.descendant_context	records,require_unchanged_until_accept	src/schemas/saivage-config.ts:350
card_types.entry.workflow.nodes.entry.edges.entry.variant1	inputs,pending_notifications,prompt,target	src/schemas/saivage-config.ts:290
card_types.entry.workflow.nodes.entry.edges.entry.variant1.target.variant1	node	src/schemas/saivage-config.ts:235
card_types.entry.workflow.nodes.entry.edges.entry.variant1.target.variant2	export_records,promote,terminal	src/schemas/saivage-config.ts:237
card_types.entry.workflow.nodes.entry.edges.entry.variant1.target.variant2.promote.variant2	latest_node	src/schemas/saivage-config.ts:232
card_types.entry.workflow.nodes.entry.edges.entry.variant1.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.edges.entry.variant1.pending_notifications	node,prompt	src/schemas/saivage-config.ts:244
card_types.entry.workflow.nodes.entry.edges.entry.variant1.pending_notifications.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.edges.entry.variant1.inputs.entry	output	src/schemas/saivage-config.ts:258
card_types.entry.workflow.nodes.entry.edges.entry.variant2	cases,otherwise	src/schemas/saivage-config.ts:301
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item	id,inputs,pending_notifications,prompt,target,when	src/schemas/saivage-config.ts:304
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.target.variant1	node	src/schemas/saivage-config.ts:235
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.target.variant2	export_records,promote,terminal	src/schemas/saivage-config.ts:237
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.target.variant2.promote.variant2	latest_node	src/schemas/saivage-config.ts:232
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.pending_notifications	node,prompt	src/schemas/saivage-config.ts:244
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.pending_notifications.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.inputs.entry	output	src/schemas/saivage-config.ts:258
card_types.entry.workflow.nodes.entry.edges.entry.variant2.cases.item.when	field,op,value	src/schemas/saivage-config.ts:307
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise	inputs,pending_notifications,prompt,target	src/schemas/saivage-config.ts:290
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.target.variant1	node	src/schemas/saivage-config.ts:235
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.target.variant2	export_records,promote,terminal	src/schemas/saivage-config.ts:237
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.target.variant2.promote.variant2	latest_node	src/schemas/saivage-config.ts:232
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.pending_notifications	node,prompt	src/schemas/saivage-config.ts:244
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.pending_notifications.prompt	compactable,compaction_key,reference	src/schemas/saivage-config.ts:203
card_types.entry.workflow.nodes.entry.edges.entry.variant2.otherwise.inputs.entry	output	src/schemas/saivage-config.ts:258
mcpServers.entry.variant1	args,autostart,command,disabled,env,transport	src/schemas/saivage-config.ts:191
mcpServers.entry.variant2	autostart,disabled,transport,url	src/schemas/saivage-config.ts:192