docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
# RFC index
Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand; `verify-rfc-classification` fails when this file is stale. The curated front door — layout, classification, when to write one, and the in-file format — is [README.md ](README.md ).
## Proposed
### Feature
| Title | First proposed |
|---|---|
| [Pre-tool input rewrite — a consistent design ](proposed/feature/2026-06-30-pre-tool-input-rewrite.md ) | 2026-06-30 |
2026-07-07 01:01:24 -07:00
| [Recallable compaction — index checkpoints, a state checkpoint, and in-session history recall ](proposed/feature/2026-07-06-recallable-compaction.md ) | 2026-07-06 |
2026-07-07 09:40:07 +00:00
| [Claude Code and Codex subagent backends (out-of-process delegation to external coding agents) ](proposed/feature/2026-07-07-claude-code-and-codex-subagent-backends.md ) | 2026-07-07 |
2026-07-10 02:09:17 -07:00
| [Interactive side sessions and merge-back ](proposed/feature/2026-07-08-interactive-side-sessions.md ) | 2026-07-08 |
2026-07-11 12:20:35 +08:00
| [SQLite FTS5 session search ](proposed/feature/2026-07-10-sqlite-session-query-provider.md ) | 2026-07-10 |
2026-07-13 21:55:38 +08:00
| [Stream workflow progress through tool calls ](proposed/feature/2026-07-13-stream-workflow-progress-through-tool-calls.md ) | 2026-07-13 |
2026-07-15 18:17:38 +08:00
| [Developer-owned SDK projects ](proposed/feature/2026-07-14-sdk-developer-projects.md ) | 2026-07-14 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Simplification
| Title | First proposed |
|---|---|
2026-07-12 03:11:21 +08:00
| [Prune dead public and result surface ](proposed/simplification/2026-07-04-prune-dead-core-spine-surface.md ) | 2026-07-04 |
2026-07-19 03:49:18 +08:00
| [Make JSON-RPC completion and transport directional ](proposed/simplification/2026-07-19-make-jsonrpc-directional.md ) | 2026-07-19 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Architecture
| Title | First proposed |
|---|---|
| [Runtime schemas for the event vocabulary (Zod vs the merge-extensible-map pattern) ](proposed/architecture/2026-06-16-typed-event-schemas.md ) | 2026-06-16 |
2026-07-15 18:17:38 +08:00
| [SDK project editing architecture ](proposed/architecture/2026-07-15-sdk-project-editing-architecture.md ) | 2026-07-15 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Process
| Title | First proposed |
|---|---|
| [API extractor reports ](proposed/process/2026-06-11-api-extractor-reports.md ) | 2026-06-11 |
| [Architectural conformance — dependency rules and the adapter kit ](proposed/process/2026-06-11-architectural-conformance.md ) | 2026-06-11 |
| [Supply chain checks and vendor drift verification ](proposed/process/2026-06-11-supply-chain-and-vendor-drift.md ) | 2026-06-11 |
| [Discover package inventories instead of maintaining static lists ](proposed/process/2026-06-20-discover-package-inventory.md ) | 2026-06-20 |
2026-07-15 21:05:43 +08:00
| [Periodic human-review maintenance for dsh-code-review ](proposed/process/2026-07-13-human-review-skill-maintenance.md ) | 2026-07-13 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Testing
| Title | First proposed |
|---|---|
| [Deterministic tests, the replay invariant fixture, and race stress ](proposed/testing/2026-06-11-deterministic-and-stress-testing.md ) | 2026-06-11 |
| [Mutation testing as the coverage counterweight ](proposed/testing/2026-06-11-mutation-testing.md ) | 2026-06-11 |
## Implemented
### Feature
| Title | First proposed |
|---|---|
2026-07-11 21:37:38 +08:00
| [Agent Client Protocol (ACP) support — drive the coding agent from external editors ](implemented/feature/2026-06-14-acp-agent-client-protocol.md ) | 2026-06-14 |
| [Multiplex concurrent ACP sessions over one connection ](implemented/feature/2026-06-14-acp-multi-session.md ) | 2026-06-14 |
feat: Code Mode — the registry's mode config, the SDK codegen, and the run_code bridge
The dsh-tools half of the Code Mode RFC (its fourth, final change): the
registry gains its first config — mode: native | code | both — and OWNS how
its tools reach the model. 'code' contributes exactly one wire tool,
run_code, plus a lazy tools:sdk prompt section declaring every other tool
as a generated TypeScript API (jsonSchemaToTs: total over the defineTool
subset, unknown degradation, lexicographic byte-identical rendering);
'both' ships both representations; 'native' is byte-for-byte the old
behavior. Non-native modes fail every assembly loudly without a
typescript-language ctx.codeRuntime.
run_code's dispatch bridge: JSON-normalizes each binding argument before
dispatch (what dispatches is what the tool/code-dispatch event logs — the
append can never fail on payload shape; BigInt/circulars reject that one
call), serializes all program tool calls through a per-run queue (even
Promise.all — no concurrency-safety metadata yet), routes every sub-call
through tools/pre-execute → tools/post-execute (a deny rejects the
program-side promise), drops sub-call additionalContext (no safe outlet
mid-run; pinned), owns a run-scoped abort that follows the outer signal in
and fires on settlement (in-flight sub-dispatch aborted, queued abandoned,
queue drained before returning), and converts a failed run into
CodeRunFailedError → a structured isError carrying kind + captured logs.
tool/code-dispatch joins SessionEventMap by declaration merging (log-only;
deriveMessages ignores it).
The composed surface: the tools config forwards through agent-core and
both app packages; examples/code-agent + demo:code run the worker runtime
under mode code (keyless boot smoke + a with-key e2e proving the collapsed
[run_code] header, the dispatch events, and the file the program wrote);
two new snapshot scenarios (code-mode-turn, both-mode-turn) record the SDK
section, collapsed header, dispatch events, and result card — each its own
header-pinning class (the harness gains per-scenario config overlays and
per-class pins). Catalogs, graphs, cookbook, hooks-bridge notes, and the
RFC (moved to implemented/, restructured to decision-era headings) updated
in the same change.
2026-07-08 12:58:23 +08:00
| [Code Mode — the model writes TypeScript against the tool registry ](implemented/feature/2026-06-15-code-mode.md ) | 2026-06-15 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [Filesystem tool schemas — model-facing read/write/edit shapes ](implemented/feature/2026-06-17-filesystem-tool-schemas.md ) | 2026-06-17 |
| [Rich ACP bash rendering — the terminal card via the `_meta` convention ](implemented/feature/2026-06-18-acp-terminal-and-tool-rendering.md ) | 2026-06-18 |
| [Compaction as a capability seam (abstract contract + basic backend) ](implemented/feature/2026-06-18-compaction-capability-seam.md ) | 2026-06-18 |
| [Subagent capability seam ](implemented/feature/2026-06-21-subagent-capability-seam.md ) | 2026-06-21 |
| [ACP subagent backend (out-of-process delegation) ](implemented/feature/2026-06-22-acp-subagent-backend.md ) | 2026-06-22 |
2026-07-10 14:32:44 +08:00
| [Workspace context instruction files ](implemented/feature/2026-06-24-workspace-context.md ) | 2026-06-24 |
2026-07-06 10:08:58 +08:00
| [Ask-user question capability ](implemented/feature/2026-06-25-ask-user-question.md ) | 2026-06-25 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [The `todo_write` tool — model task list as event-sourced session state ](implemented/feature/2026-06-29-todo-write-tool.md ) | 2026-06-29 |
| [dsh-hooks-claude + dsh-hooks-codex — the Claude Code / Codex hook bridges ](implemented/feature/2026-06-30-hook-bridges.md ) | 2026-06-30 |
| [dsh-hook-protocol — the shared Claude Code / Codex hook wire-protocol core ](implemented/feature/2026-06-30-hook-protocol-lib.md ) | 2026-06-30 |
| [Interception seams — the typed-Decision surface a hook programs against ](implemented/feature/2026-06-30-interception-seams.md ) | 2026-06-30 |
2026-07-06 13:57:59 +08:00
| [SessionStore fork API ](implemented/feature/2026-06-30-session-store-fork-api.md ) | 2026-06-30 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [Subagent lifecycle enrichment — lastAssistantMessage (observe-only) ](implemented/feature/2026-06-30-subagent-observe-enrich.md ) | 2026-06-30 |
2026-07-06 03:14:07 +08:00
| [Dynamic workflows — a script-driven multi-agent orchestration seam ](implemented/feature/2026-07-05-dynamic-workflows.md ) | 2026-07-05 |
2026-07-06 10:31:45 +08:00
| [Skill system — progressive disclosure instructions for agents ](implemented/feature/2026-07-05-skill-system.md ) | 2026-07-05 |
2026-07-09 16:44:32 +08:00
| [The approval seam — one-shot permission decisions over a waterfall of answerers ](implemented/feature/2026-07-06-approval-seam.md ) | 2026-07-06 |
2026-07-07 11:03:11 +08:00
| [Explicit model-facing tool order ](implemented/feature/2026-07-06-explicit-tool-order.md ) | 2026-07-06 |
2026-07-09 16:44:32 +08:00
| [The subprocess sandbox — confinement seam, native runners, escalation, and per-session modes ](implemented/feature/2026-07-06-sandbox.md ) | 2026-07-06 |
feat(mcp): adopt mainstream server-qualified MCP tool naming
Research across 8 multi-server agent clients (Claude Code, Codex, Gemini
CLI, VS Code, Cline, Roo Code, Goose, OpenCode) showed all of them keep
the server namespace in model-facing MCP tool names; the RFC's premise
for raw names ("servers already prefix their tools") is false for the
official GitHub/filesystem/Sentry servers.
- Config: drop toolPrefix; require serverName ([A-Za-z0-9_-]{1,32}),
duplicate serverName fails the later instance at load (per-root
reservation, released on dispose)
- Names: always mcp__<serverName>__<rawName>; normalize to the DeepSeek
64-char [A-Za-z0-9_-] contract with a deterministic 12-hex identity
hash on lossy normalization; raw name is the only thing sent on the
wire (tools/call)
- Sync: two-phase fetch/swap — fetch failure keeps the previous
generation; a swap conflict rolls back the whole generation (never a
partial set); duplicate raw names reject the tool list
- RFC: moved to implemented/ (status + skeleton rewritten per the
format contract), naming design + tier-level test coverage recorded
- Tests: naming algorithm unit suite; keyless Streamable HTTP e2e
against an in-process StreamableHTTPServerTransport (namespace
discovery, execution, per-request auth headers); dotted-name
normalization e2e via a new fixture tool
2026-07-13 23:39:02 +08:00
| [MCP client plugin — connect to external MCP servers and bridge their tools ](implemented/feature/2026-07-07-mcp-client-plugin.md ) | 2026-07-07 |
2026-07-09 00:40:57 +08:00
| [The session prefix — request-only messages in front of the derived history ](implemented/feature/2026-07-07-session-prefix.md ) | 2026-07-07 |
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
| [Background subagent tasks ](implemented/feature/2026-07-08-background-subagent-tasks.md ) | 2026-07-08 |
2026-07-08 14:24:20 +08:00
| [Repeat-tool-call guard plugin ](implemented/feature/2026-07-08-repeat-tool-guard.md ) | 2026-07-08 |
2026-07-08 11:45:01 +08:00
| [The self-referential cordis toolset ](implemented/feature/2026-07-08-self-referential-cordis-toolset.md ) | 2026-07-08 |
2026-07-09 20:44:32 +08:00
| [Bash-backed grep and glob discovery tools ](implemented/feature/2026-07-09-bash-backed-grep-glob-discovery.md ) | 2026-07-09 |
2026-07-10 20:52:27 +08:00
| [Expose agent session identity and JSONL location to tools and hooks ](implemented/feature/2026-07-10-agent-session-identity-and-log-location.md ) | 2026-07-10 |
2026-07-13 11:02:21 +08:00
| [Parallel tool-call execution by per-call safety ](implemented/feature/2026-07-10-parallel-tool-call-execution.md ) | 2026-07-10 |
2026-07-11 12:20:35 +08:00
| [Exact session query service ](implemented/feature/2026-07-10-session-query-service.md ) | 2026-07-10 |
2026-07-12 22:49:46 +08:00
| [Configure subagent persona, tool visibility, and depth ](implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md ) | 2026-07-12 |
2026-07-13 13:44:01 +08:00
| [Session query relationship tracing ](implemented/feature/2026-07-13-session-query-tracing.md ) | 2026-07-13 |
2026-07-14 16:04:34 +08:00
| [Optional time-context plugin ](implemented/feature/2026-07-14-time-context-plugin.md ) | 2026-07-14 |
2026-07-16 17:47:51 +08:00
| [Durable per-step time context ](implemented/feature/2026-07-16-durable-per-step-time-context.md ) | 2026-07-16 |
2026-07-19 12:05:59 +08:00
| [Dedicated full-screen TUI front door ](implemented/feature/2026-07-17-dedicated-full-screen-tui-front-door.md ) | 2026-07-17 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
2026-07-19 12:38:18 +08:00
### Bug-fix
| Title | First proposed |
|---|---|
| [Preserve Windows DACLs during atomic file replacement ](implemented/bug-fix/2026-07-19-windows-atomic-write-dacl-preservation.md ) | 2026-07-19 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Simplification
| Title | First proposed |
|---|---|
| [Drop the mutable session summary ](implemented/simplification/2026-06-19-drop-mutable-session-summary.md ) | 2026-06-19 |
| [Fold trace-only session facts into load-bearing events ](implemented/simplification/2026-06-20-collapse-trace-only-session-events.md ) | 2026-06-20 |
| [Drop the unconsumed `llm/adapter-change` event ](implemented/simplification/2026-06-20-drop-unconsumed-llm-adapter-change-event.md ) | 2026-06-20 |
| [Drop unconsumed assembled LLM convenience surfaces ](implemented/simplification/2026-06-20-drop-unconsumed-llm-assembled-surfaces.md ) | 2026-06-20 |
| [Prune dead methods from the persistence seam ](implemented/simplification/2026-06-20-prune-dead-seam-methods.md ) | 2026-06-20 |
| [Keep one public stop primitive ](implemented/simplification/2026-06-20-public-agent-stop-surface.md ) | 2026-06-20 |
| [Stop mirroring durable boundaries as agent events ](implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md ) | 2026-06-20 |
2026-07-14 02:22:20 +08:00
| [Unify the agent id and the session id ](implemented/simplification/2026-06-20-unify-agent-and-session-id.md ) | 2026-06-20 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [Split the filesystem seam — provider text mutations plus the `dsh-fs-policy` plugin ](implemented/simplification/2026-06-26-fsspec-style-fs-seam.md ) | 2026-06-26 |
| [Stop mirroring the token stream as an agent event ](implemented/simplification/2026-07-02-remove-stream-chunk-mirror.md ) | 2026-07-02 |
| [Drop the `image` content block until a path can honor it ](implemented/simplification/2026-07-04-drop-image-content-block.md ) | 2026-07-04 |
| [Drop `GenerateOptions.prefill` and `ToolSchema.strict` — request knobs with no working end-to-end path ](implemented/simplification/2026-07-04-drop-inert-request-knobs.md ) | 2026-07-04 |
| [Drop the unconsumed web observation surface — the `providers-change` event and the status methods ](implemented/simplification/2026-07-04-drop-unconsumed-web-observation-surface.md ) | 2026-07-04 |
| [Fold the stdio UI helper into the stdio app ](implemented/simplification/2026-07-04-fold-stdio-ui-helper.md ) | 2026-07-04 |
| [Prune producer-less vocabulary variants (block cache hints, the `agent` message source, the `continuation` turn trigger) ](implemented/simplification/2026-07-04-prune-producerless-vocabulary-variants.md ) | 2026-07-04 |
| [Prune write-only fields and a dead routing knob from the fs seam ](implemented/simplification/2026-07-04-prune-write-only-fs-surface.md ) | 2026-07-04 |
| [Remove the `agent/steering` mirror emit ](implemented/simplification/2026-07-04-remove-agent-steering-mirror.md ) | 2026-07-04 |
| [Share the app bins' boot glue instead of maintaining twin copies ](implemented/simplification/2026-07-04-share-app-bin-boot-glue.md ) | 2026-07-04 |
| [Tighten the hook-protocol contract — dialect, discarded fields, double defaults, and lib-owned `hook/result` semantics ](implemented/simplification/2026-07-04-tighten-hook-protocol-contract.md ) | 2026-07-04 |
| [Trim unreachable ACP bridge surface — the branding knobs and the kind-sniffing fallback ](implemented/simplification/2026-07-04-trim-acp-bridge-unreachable-surface.md ) | 2026-07-04 |
2026-07-14 04:32:40 +08:00
| [Drop unconsumed skill provider events ](implemented/simplification/2026-07-12-drop-unconsumed-skill-provider-events.md ) | 2026-07-12 |
2026-07-14 04:26:35 +08:00
| [Prune unused web seam fields ](implemented/simplification/2026-07-12-prune-unused-web-seam-fields.md ) | 2026-07-12 |
2026-07-13 23:56:10 +08:00
| [Simplify session-log representation ](implemented/simplification/2026-07-12-simplify-session-log-representation.md ) | 2026-07-12 |
2026-07-19 11:54:37 +08:00
| [Retire the standalone subagent mock package ](implemented/simplification/2026-07-19-retire-subagent-mock-package.md ) | 2026-07-19 |
2026-07-19 11:36:07 +08:00
| [Use one surface manager per session ](implemented/simplification/2026-07-19-use-one-session-surface-manager.md ) | 2026-07-19 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Architecture
| Title | First proposed |
|---|---|
| [Provider-neutral content-block vocabulary owned by dsh-llm ](implemented/architecture/2026-06-11-content-block-vocabulary.md ) | 2026-06-11 |
| [Custom typed tool-schema DSL instead of schemastery ](implemented/architecture/2026-06-11-custom-schema-dsl.md ) | 2026-06-11 |
2026-07-12 03:51:55 +08:00
| [Source-owned session immutability and dev-mode invariants ](implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md ) | 2026-06-11 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [Event-sourced sessions with derived message history ](implemented/architecture/2026-06-11-event-sourced-sessions.md ) | 2026-06-11 |
| [Microkernel — extension via Cordis event taxonomy, one concrete loop ](implemented/architecture/2026-06-11-microkernel-event-taxonomy.md ) | 2026-06-11 |
| [Runtime arg validation at the model boundary ](implemented/architecture/2026-06-11-runtime-arg-validation.md ) | 2026-06-11 |
| [Structured error taxonomy ](implemented/architecture/2026-06-11-structured-error-taxonomy.md ) | 2026-06-11 |
| [Tool schemas are part of the system-prompt assembly ](implemented/architecture/2026-06-11-tool-schemas-in-prompt-assembly.md ) | 2026-06-11 |
| [Capability seams — interface / implementation / consumer split ](implemented/architecture/2026-06-13-capability-seams.md ) | 2026-06-13 |
| [Two LLM adapters as a design-verification twin ](implemented/architecture/2026-06-13-twin-llm-adapters.md ) | 2026-06-13 |
| [Session persistence as an abstract service over the existing `SessionEvent` ](implemented/architecture/2026-06-14-session-persistence.md ) | 2026-06-14 |
| [Every session event is enclosed in a turn ](implemented/architecture/2026-06-15-turn-enclosure-invariant.md ) | 2026-06-15 |
| [Filesystem capability seam — ctx.fs, local backend, and model-facing filesystem tools ](implemented/architecture/2026-06-17-filesystem-capability-seam.md ) | 2026-06-17 |
| [Agent lifecycle and ownership seams ](implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md ) | 2026-06-18 |
2026-07-13 23:56:10 +08:00
| [Session surface — an ordered projection over the event log ](implemented/architecture/2026-06-18-session-surface.md ) | 2026-06-18 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [Shared persistence write coordinator ](implemented/architecture/2026-06-18-shared-persistence-write-coordinator.md ) | 2026-06-18 |
| [Branded IDs everywhere they belong ](implemented/architecture/2026-06-20-branded-ids.md ) | 2026-06-20 |
| [Extract example apps into packages ](implemented/architecture/2026-06-20-extract-example-app-packages.md ) | 2026-06-20 |
docs(tasks): condense background task prose
The background-task change repeated its lifecycle design across implemented RFCs, package READMEs, JSDoc, test commentary, and model-visible schemas. That repetition obscured the contracts that maintainers must preserve and added avoidable prompt tokens.
Rewrite the implemented RFCs around the current design, keep authorization, exact-owner cleanup, wait/abort ordering, producer quiescence, and teardown-failure guarantees at their owning surfaces, and remove peer surveys, review history, control-flow narration, and emphatic restatement.
Shorten the task and subagent schema wording, synchronize the bilingual tool cookbook, and regenerate the config, service, RFC, tool, and replay snapshot derivatives. Runtime behavior is unchanged; test edits update prose-only assertions and descriptions.
2026-07-15 21:08:58 +08:00
| [The background task runtime (`ctx.tasks`) and generic task control tools ](implemented/architecture/2026-06-20-generic-long-running-tool-runtime.md ) | 2026-06-20 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
| [Reorganize packages into a modular hierarchy ](implemented/architecture/2026-06-20-package-hierarchy.md ) | 2026-06-20 |
| [Mandatory `User-Agent` attribution for provider requests ](implemented/architecture/2026-06-21-mandatory-app-attribution-headers.md ) | 2026-06-21 |
| [Web capability seam - stable tools over multiple providers ](implemented/architecture/2026-06-24-web-capability-seam.md ) | 2026-06-24 |
| [Make `dsh-fs-policy` an event-gate plugin, not a method interface ](implemented/architecture/2026-06-26-file-context-as-event-gate.md ) | 2026-06-26 |
| [stdin + extra env on the bash seam ](implemented/architecture/2026-06-30-bash-stdin-env-trusted-plugin-surface.md ) | 2026-06-30 |
| [Event-domain semantics — session is the fact log, agent is the live surface ](implemented/architecture/2026-06-30-event-domain-semantics.md ) | 2026-06-30 |
| [Resolve filesystem paths against the caller's session cwd ](implemented/architecture/2026-07-02-fs-per-session-cwd.md ) | 2026-07-02 |
| [Result-time applied-hunk diffs for file mutations ](implemented/architecture/2026-07-02-result-time-applied-hunk-diffs.md ) | 2026-07-02 |
| [Tagged render-intent union for tool-call presentation ](implemented/architecture/2026-07-02-tool-render-intent-union.md ) | 2026-07-02 |
| [Add direct directory listing to the filesystem seam ](implemented/architecture/2026-07-03-filesystem-directory-listing-seam.md ) | 2026-07-03 |
2026-07-06 00:13:09 +08:00
| [Prompt variables and tool-guidance ownership ](implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md ) | 2026-07-05 |
docs: the governing principle — every LLM request is reconstructable from the session log
The reconstructability RFC is the principle's home: model-visible ⟺
logged in both forms, the mechanism (boundary derivation + header
fold), the enforcement (write-time round-trip guard, the dev
invariant), the corollaries ranked (prefix-cache stability first), the
MiniCode lineage with the provenance arrow inverted, and the
alternatives it beat — including the stateful transmission client
whose three-design archaeology lives in PR #162.
Placements per the one-home-per-fact taxonomy: a standing-order line in
root AGENTS.md (with displacement trims to stay inside the 1,575-word
ceiling), the principle statement in architecture.md § Session Log and
its Turn Flow lines (condensed to the ratcheted 1,630 ceiling), the
request-envelope section in core-data-structures/core.md with the
LlmCallConfig paste, both review-requested FIXMEs
(FIXME(call-config-shape) beside the type, FIXME(catalog-verbs) at the
catalog's drift-gate note), cookbook rows redirected off agent/request
(tool filtering → system-prompt/assemble, plan-mode prompt → sections/
inject()), and the llm/stream JSDoc stating the frozen-request
contract. RFC index and all generated catalogs regenerated.
2026-07-06 03:49:35 +08:00
| [Every LLM request is reconstructable from the session log ](implemented/architecture/2026-07-05-reconstructable-requests.md ) | 2026-07-05 |
2026-07-06 00:13:09 +08:00
| [Subagent provider-lifecycle events — `subagent/provider-added` / `subagent/provider-removed` ](implemented/architecture/2026-07-05-subagent-provider-lifecycle-events.md ) | 2026-07-05 |
2026-07-05 21:15:46 +08:00
| [Windows write-permission semantics — inherited DACLs, not mode bits ](implemented/architecture/2026-07-05-windows-fs-permissions.md ) | 2026-07-05 |
2026-07-05 04:31:22 +08:00
| [Windows-native durable JSONL publication ](implemented/architecture/2026-07-05-windows-jsonl-durable-publish.md ) | 2026-07-05 |
2026-07-06 16:23:52 +08:00
| [A shared timeout/deadline primitive, with hard-kill left to each capability ](implemented/architecture/2026-07-06-timeout-deadline-library.md ) | 2026-07-06 |
2026-07-07 09:31:53 +08:00
| [Tool result retention library ](implemented/architecture/2026-07-06-tool-result-retention-library.md ) | 2026-07-06 |
2026-07-08 10:06:07 +08:00
| [Tool-call timeout policy as a plugin ](implemented/architecture/2026-07-07-tool-call-timeout-policy.md ) | 2026-07-07 |
docs: agent-scope RFC, CONTEXT.md glossary, architecture scope section, README sync
The agent-scope-contexts RFC (implemented) records the decision tree:
the dsh-scope primitive over cordis extend/Context.filter/no-op fibers,
two-level flat scope with shadowing, restriction/grant semantics, the
scoped-dispatch rule with fused helpers, the setup window, and the
alternatives (explicit scope params, isolate, event-filtering-only,
vendored support) with why each lost. CONTEXT.md pins the glossary.
architecture.md gains the Agent Scope section, the dsh-scope spine row,
the scoped turn-flow line, and an extension-table row (ceiling 1640→1790:
the two-layer registration model is a new architectural axis; additions
are condensed to pointers). READMEs of every touched package re-state
their scoped facts; the stale structured-runtime README section is
replaced by the scoped-registration description.
2026-07-09 03:01:11 +08:00
| [The agent is a registration scope ](implemented/architecture/2026-07-08-agent-scope-contexts.md ) | 2026-07-08 |
2026-07-08 19:20:50 +08:00
| [Tool output spill policy ](implemented/architecture/2026-07-08-tool-output-spill-files.md ) | 2026-07-08 |
2026-07-11 13:44:14 +08:00
| [Single-file executable SDK runtime distribution (single-exe) ](implemented/architecture/2026-07-10-single-file-executable-sdk-runtime-distribution.md ) | 2026-07-10 |
2026-07-12 13:25:04 +08:00
| [Agent-scope runtime design and correctness ](implemented/architecture/2026-07-12-agent-scope-runtime-design.md ) | 2026-07-12 |
2026-07-14 21:57:52 +08:00
| [Provider-routed LLM adapters and a generic pi-ai backend ](implemented/architecture/2026-07-14-provider-routed-llm-adapters.md ) | 2026-07-14 |
2026-07-15 13:33:42 +08:00
| [Advisory LLM catalogs and per-session ACP model selection ](implemented/architecture/2026-07-15-llm-model-catalog-and-acp-selection.md ) | 2026-07-15 |
2026-07-15 14:47:29 +08:00
| [Replay token meter service ](implemented/architecture/2026-07-15-replay-token-meter-service.md ) | 2026-07-15 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Process
| Title | First proposed |
|---|---|
| [Doc-sync enforcement ](implemented/process/2026-06-11-doc-sync-enforcement.md ) | 2026-06-11 |
| [Mechanical quality gates over prose guidelines ](implemented/process/2026-06-11-quality-gates.md ) | 2026-06-11 |
| [tsdown for JS bundling instead of dumble ](implemented/process/2026-06-11-tsdown-over-dumble.md ) | 2026-06-11 |
| [Vendor Cordis as source, not npm dependencies ](implemented/process/2026-06-11-vendor-cordis-as-source.md ) | 2026-06-11 |
| [pnpm as the package manager instead of Yarn 4 ](implemented/process/2026-06-16-pnpm-over-yarn.md ) | 2026-06-16 |
| [TSC-first build and one tsconfig ](implemented/process/2026-06-17-ts-build-config.md ) | 2026-06-17 |
| [Markdown cross-link validity linting ](implemented/process/2026-06-18-markdown-cross-link-lint.md ) | 2026-06-18 |
| [Core-data-structures catalog and the `ts type-equiv` drift gate ](implemented/process/2026-06-20-core-data-structures-catalog.md ) | 2026-06-20 |
| [Generated cordis events + services catalog ](implemented/process/2026-06-20-generated-cordis-catalog.md ) | 2026-06-20 |
| [Classify RFCs by kind via path-encoded subdirectories ](implemented/process/2026-06-20-rfc-classification.md ) | 2026-06-20 |
| [Bilingual documentation via paired sibling files and a pairing gate ](implemented/process/2026-07-02-bilingual-docs-and-pairing-gate.md ) | 2026-07-02 |
| [Generated tool-schema catalog (boot-and-harvest) ](implemented/process/2026-07-02-tool-schema-catalog.md ) | 2026-07-02 |
| [Documentation graph index for maintainers and SDK users ](implemented/process/2026-07-03-documentation-graph-atlas.md ) | 2026-07-03 |
| [JSDoc completeness gate for the cordis surface ](implemented/process/2026-07-04-cordis-jsdoc-completeness-gate.md ) | 2026-07-04 |
| [Documentation tiers, budgets, and the ceiling gate ](implemented/process/2026-07-04-doc-tiers-and-budgets.md ) | 2026-07-04 |
| [Generate the RFC index tables ](implemented/process/2026-07-04-generate-rfc-index-tables.md ) | 2026-07-04 |
| [Generated persistence log event catalog ](implemented/process/2026-07-04-persistence-log-catalog.md ) | 2026-07-04 |
| [One gated in-file format for RFCs ](implemented/process/2026-07-05-uniform-rfc-format.md ) | 2026-07-05 |
Gate JSDoc completeness on every package export
New doc-sync gate verify-export-jsdoc walks every module-level exported
name under packages/*/*/src and requires description prose everywhere,
plus @param per parameter and @returns on non-void annotated returns for
function-like exports, public class methods, properties, and accessors.
The parsing + check helpers move out of gen-cordis-catalog.ts into a
shared scripts/jsdoc.ts so 'documented' means one thing on both gated
surfaces.
Deliberate exemptions (documented in the RFC): heritage-declared class
members (the seam declaration is the doc's one home — the one checker
query in an otherwise pure-AST walk), cordis plugin-protocol slots
(name/inject/reusable/Config/apply, top-level and static), constructors,
overload implementations, declare-module augmentation bodies, and
re-export statements (checked at the defining module).
The 203 under-documented exports the gate found at adoption are filled
in this change, so the gate lands green; generated catalogs/graphs are
regenerated for the shifted line pointers.
RFC: docs/rfc/implemented/process/2026-07-06-export-surface-jsdoc-gate.md
2026-07-06 22:09:30 +08:00
| [Export-surface JSDoc gate ](implemented/process/2026-07-06-export-surface-jsdoc-gate.md ) | 2026-07-06 |
feat: generated plugin config catalog (docs/config-catalog.md)
scripts/gen-config-catalog.ts walks every packages/<group>/<pkg> entry with
the TypeScript compiler API and emits docs/config-catalog.md: per loadable
plugin, the verbatim config declaration (JSDoc included) its apply/constructor
receives in a ts config-catalog fence, the inject requirements, resolved links
for every referenced type (package-local types pasted transitively, other
plugins' config types as intra-page anchors, LINK_MAP names to
core-data-structures, workspace types to source), and terse classification
lists for config-free plugins, abstract seams, and libraries — classification
is total, so a new package cannot go undocumented.
The walk enforces per-field JSDoc prose on every pasted declaration and
statically cross-checks the schemastery schema (z.object keys, z.intersect
composition across packages): every schema-validated key must be a declared
member of the config type. One violation existed repo-wide — the agents[].id
field in dsh-agent-loop — fixed by adding its JSDoc (which shifts the
cordis-catalog services page's source pointers; regenerated).
verify-config-catalog (--check) joins doc-sync; doc-typecheck learns the
ts config-catalog fence; gen-cordis-catalog exports its JSDoc/pointer helpers
and LINK_MAP for reuse. Negative-path spec in
packages/core/agent-core/tests/gen-config-catalog.spec.ts mirrors the
gen-cordis-catalog spec. Decision record:
docs/rfc/implemented/process/2026-07-06-generated-config-catalog.md (includes
the deliberate acceptance of README ## Config overlap).
2026-07-06 21:57:17 +08:00
| [Generated plugin config catalog ](implemented/process/2026-07-06-generated-config-catalog.md ) | 2026-07-06 |
2026-07-07 17:39:04 +08:00
| [Raise the Node LTS engine floor to 22.19 ](implemented/process/2026-07-06-node-engine-floor.md ) | 2026-07-06 |
2026-07-06 01:04:06 +08:00
| [Parallel GitHub CI gates ](implemented/process/2026-07-06-parallel-github-ci-gates.md ) | 2026-07-06 |
2026-07-06 01:04:06 +08:00
| [Parallel pre-push gates ](implemented/process/2026-07-06-parallel-pre-push-gates.md ) | 2026-07-06 |
Add a gated Known Limitations and Deferred Work section to every package README
Every packages/*/* README now carries a canonical '## Known Limitations and
Deferred Work' section: condensed, evidence-backed bullets for consumer-visible
gaps (unimplemented features, platform caveats, MVP cuts) and consciously
postponed work (TODO/FIXME/XXX markers, RFC deferrals still open). The ten
pre-existing ad-hoc variants ('What is NOT here (TODO)', 'Deferred',
'Limitations (MVP)', 'Known limitations (tracked TODOs)', ...) are normalized
into the canonical heading.
A new doc-sync gate, scripts/verify-readme-limitations.ts, enforces the shape:
exactly one limitations-like heading per package README, byte-equal to the
canonical h2, with at least one bullet; near-miss headings fail so variants
cannot creep back. Packages with genuinely nothing to declare (dsh-brand,
dsh-timeout, dsh-subagent-mock, dsh-app-boot) are whitelisted in the script and
must NOT carry the section; whitelist entries are validated against the scanned
package set so a rename fails loud.
Wired into the doc-sync chain (package.json) and the run-gates doc-sync leaf
set; the standing rule lands in packages/AGENTS.md and the adding-a-package
cookbook; decision record in
docs/rfc/implemented/process/2026-07-10-readme-known-limitations-gate.md
(RFC index regenerated).
Also fixes two stale '(deferred)' markers claiming dsh-compact-basic is
unimplemented (the dsh-compact seam README's package table and the seam's
module doc comment).
2026-07-10 01:51:50 +08:00
| [A gated Known-Limitations section in every package README ](implemented/process/2026-07-10-readme-known-limitations-gate.md ) | 2026-07-10 |
2026-07-12 02:12:36 +08:00
| [Package Model Experience contract ](implemented/process/2026-07-12-package-model-experience-contract.md ) | 2026-07-12 |
2026-07-15 00:42:08 +08:00
| [TypeScript Program-backed semantic gates ](implemented/process/2026-07-14-typescript-program-backed-semantic-gates.md ) | 2026-07-14 |
2026-07-17 15:42:35 +08:00
| [Run CI examples from built lib ](implemented/process/2026-07-17-run-ci-examples-from-built-lib.md ) | 2026-07-17 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Testing
| Title | First proposed |
|---|---|
| [Property-based testing for protocol-shaped code ](implemented/testing/2026-06-11-property-based-testing.md ) | 2026-06-11 |
| [ACP snapshot tests — record-once / replay-deterministic ](implemented/testing/2026-06-19-acp-snapshot-tests.md ) | 2026-06-19 |
| [Real-API e2e in CI against the external DeepSeek API ](implemented/testing/2026-06-19-real-api-e2e-ci.md ) | 2026-06-19 |
| [Use `session.jsonl` as the only snapshot session-log artifact ](implemented/testing/2026-06-20-remove-redundant-snapshot-log-goldens.md ) | 2026-06-20 |
| [Persist the seed boundary so fork-child replay routes correctly ](implemented/testing/2026-06-22-fork-child-replay-seed-boundary.md ) | 2026-06-22 |
| [Record fork and mixed spawn+fork snapshot scenarios ](implemented/testing/2026-06-22-fork-snapshot-scenarios.md ) | 2026-06-22 |
| [Per-session snapshot replay for nested agents ](implemented/testing/2026-06-22-subagent-snapshot-replay.md ) | 2026-06-22 |
| [Hook snapshot matrix — end-to-end goldens for both bridges ](implemented/testing/2026-07-04-hook-snapshot-matrix.md ) | 2026-07-04 |
| [Single-source the acp-agent replay config ](implemented/testing/2026-07-04-single-source-acp-replay-config.md ) | 2026-07-04 |
2026-07-06 23:41:20 +08:00
| [Pin request-header content in one snapshot scenario ](implemented/testing/2026-07-06-pin-request-header-content-in-one-scenario.md ) | 2026-07-06 |
2026-07-08 02:09:32 +08:00
| [Extract the ACP snapshot suite into a support package ](implemented/testing/2026-07-08-shared-acp-snapshot-package.md ) | 2026-07-08 |
2026-07-18 22:31:04 +08:00
| [Snapshot semantic terminal state for the TUI ](implemented/testing/2026-07-18-tui-terminal-state-snapshots.md ) | 2026-07-18 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
## Rejected
### Simplification
| Title | First proposed |
|---|---|
| [Persist assembled assistant messages, not stream chunks ](rejected/simplification/2026-06-20-assembled-assistant-messages-only.md ) | 2026-06-20 |
| [Drop ACP session/load until resume has a product shape ](rejected/simplification/2026-06-20-drop-acp-session-load.md ) | 2026-06-20 |
| [Drop ACP terminal `_meta` rendering ](rejected/simplification/2026-06-20-drop-acp-terminal-meta.md ) | 2026-06-20 |
| [Drop bash full-output spill files ](rejected/simplification/2026-06-20-drop-bash-output-spill-files.md ) | 2026-06-20 |
| [Drop durable step boundary events ](rejected/simplification/2026-06-20-drop-durable-step-boundaries.md ) | 2026-06-20 |
| [Drop unused session lineage metadata ](rejected/simplification/2026-06-20-drop-unused-session-lineage.md ) | 2026-06-20 |
| [Fold the persistence interface into dsh-session ](rejected/simplification/2026-06-20-fold-session-persistence-interface.md ) | 2026-06-20 |
| [Collapse tool-owned UI presentation ](rejected/simplification/2026-06-20-generic-tool-rendering.md ) | 2026-06-20 |
| [Retire mid-turn steering ](rejected/simplification/2026-06-20-retire-mid-turn-steering.md ) | 2026-06-20 |
| [Return the ACP bridge to one live session per connection ](rejected/simplification/2026-06-20-single-session-acp-bridge.md ) | 2026-06-20 |
| [Truncate interrupted final turns on load ](rejected/simplification/2026-06-20-truncate-interrupted-turns.md ) | 2026-06-20 |
| [Prune the unimplemented subagent seam vocabulary ](rejected/simplification/2026-07-04-prune-unimplemented-subagent-vocabulary.md ) | 2026-07-04 |
2026-07-13 21:55:38 +08:00
| [Collapse workflows to the exercised foreground core ](rejected/simplification/2026-07-12-collapse-workflow-to-foreground-core.md ) | 2026-07-12 |
| [Prune unused skill registry surface ](rejected/simplification/2026-07-12-prune-unused-skill-registry-surface.md ) | 2026-07-12 |
2026-07-19 11:12:26 +08:00
| [Fold the single compaction backend into its service package ](rejected/simplification/2026-07-19-fold-compaction-package-split.md ) | 2026-07-19 |
docs(rfc): define and enforce a uniform RFC format; adopt it across the corpus
Define the in-file RFC contract in docs/rfc/README.md § The file format:
the header block (`# RFC: <title>` plus a dateless Status enum
cross-checked against the lifecycle folder), the per-lifecycle body
skeleton (a Problem opener everywhere; Proposal/Alternatives considered/
Acceptance criteria/Risks in proposed/; present-tense Decision/
Consequences with proposal-era headings banned in implemented/; the
frozen proposal shape in rejected/), and a mandatory Alternatives
considered section with a date-fenced grandfather comment for pre-format
RFCs whose alternatives are not reconstructible from the record.
Enforce it with a new doc-sync gate, scripts/verify-rfc-format.ts, and
normalize all 112 RFCs to it: ~15 Status-line spellings collapse to the
enum, 29 Context openers become Problem, the 39 legacy-format XXX debt
markers are resolved and banned from reappearing, proposal-era sections
in implemented RFCs are rewritten to shipped reality (including the
web/fs/subagent seam RFCs' migration plans and test checklists, closing
the doc-tiers deferred-work item on the web seam), every RFC gains an
Alternatives considered section or the grandfather comment, and the
bilingual pair is re-mirrored and re-recorded.
Move the generated index tables out of README.md into a fully generated
docs/rfc/INDEX.md — gen-rfc-index now writes the whole file, and
verify-rfc-classification checks its freshness and rejects index-shaped
rows in the curated README — which makes room for the format contract to
live in the README front door instead of a separate FORMAT.md.
The decision record, and the first RFC written in the new format, is
docs/rfc/implemented/process/2026-07-05-uniform-rfc-format.md.
2026-07-05 22:58:25 +08:00
### Architecture
| Title | First proposed |
|---|---|
| [Deep-readonly public surfaces ](rejected/architecture/2026-06-11-immutable-public-surfaces.md ) | 2026-06-11 |
| [Make the shared example base providerless ](rejected/architecture/2026-06-20-providerless-example-base.md ) | 2026-06-20 |
