Program Board

The prior charter mixed a next-session implementation claim with planning-only rules and covered only a curated subset of the ledger. The replacement separates authority cleanly, verifies stale premises against both repos, records one live closure (G-140), opens and schedules 22 evidence-backed omissions plus the missing hub-census guard (G-213), and maps all 104 open residues exactly once into 36 defined packages. The A6 ledger/hardening tests are green. Session 10 execution remains unchanged.

The founder read the four build-blocking asks from the embodiment spec and adopted each one's own recommended option, all on the record in the spec itself. ① The Canvas 2D avatar engine is ratified as our own one-way fork — no waivers, split to size instead — and Rive stays out (no such asset exists anywhere in gspace1 to adopt). ② The gspace1 cat IS Vitto's face going forward, and it now switches preset by theme so the dark background never swallows it — classic on light, mochi on dark. ③ VL-1 proceeds under founder-reviewed passes rather than waiting on a named designer; the three expression rows still under dispute are parked for the design gate, and the "nothing pulses on a timer" principle gained a carve-out — a face is allowed to breathe and blink for its own sake, but every change that means something must still land on a real event. ④ The layout is ratified: the avatar becomes the route's persistent stage (at least 320px), with the mood label, the first-person note, the provenance chip and the time as its caption, and the old Live Feed moves to a secondary column. Build slices VL-0 (vendor the engine as the fork) and VL-1 (the embodied surface and the scrubbed face) are now in flight. The three remaining asks — a voice provider, the embed's reach and weight, and the inner-life amendment — stay open, but each only gates a later slice (VL-4, VL-3 and VL-2A respectively), so none of them block the work happening now.

Then, same day: VL-0 landed, gate green. The build plan for the port itself went through its own adversarial round first — three reviewers, 36 findings, several blockers (the code formatter was quietly pushing the vendored files 20% past the size cap; a subtle bug could let animation state leak between renders) — all fixed in the plan before a line of code moved. With that settled, the gspace1 Canvas-2D avatar engine and its mood models were vendored into agente's own ui tree as a governed one-way fork: about 9,000 lines after reformatting, 44 files, every one under the 600-line cap (the biggest data table needed a five-way split to fit). All 12 of the engine's own behavior tests came across intact — 267 tests, the exact count preserved — plus 34 new tests pinning the fork's own deliberate deltas. Full gate green: 1,692 backend unit tests, 677 ui tests, 128 browser end-to-end tests, all four ratchets. A genuine bonus: porting the engine surfaced three real bugs in gspace1's ORIGINAL code (G-118) — two "random direction" rolls that were re-rolling every single frame instead of once per gesture, and an offset that never got subtracted back out, permanently nudging the character out of position once idle animations are off. All three are fixed in agente's fork with tests that fail if the fix is ever reverted; gspace1's live avatars still render all three today, so bringing the fix upstream is a coordination task, not a code task. Two smaller findings joined the ledger: G-119 (an 8-second "go idle" timer that turns out to be dead code, upstream too) and G-120 (a small blind spot in the import-boundary checker). Nothing here is committed — the founder reviews and commits — and VL-1, the embodied surface itself, was next.

And by the end of the day, VL-1 landed too. Vitto's face is now IN the product: the persistent stage of the Vitto Live page, every state rendered through it — quiet, loading, and both honest error states included — with the cat switching preset by theme exactly as ruled (classic on light, mochi on dark, contrast-proven with tests that fail on an illegible pairing). The scrubbed face shipped in this same first pass: drag the rewind slider on a conversation and the pane shows the face the diary supports at that instant, re-derived, never replayed. The build plan survived its own two-reviewer adversarial round first (33 findings, several blockers — including a missing one-line setting that would have quietly defeated the dark-theme legibility ruling), and the new browser tests then caught a real race that made the stage's very first paint vanish — fixed with a guard and regression tests before any human ever saw an empty box. Full gate green: 139 browser e2e, 716 ui unit, 1,692 backend tests, all four ratchets; measured on the real instance at zero dropped frames (about a tenth of a millisecond of work per frame) and ~5ms mood reads. The step now sits at the founder's design-gate pass 1: look at the face in both themes, and rule the three contested expression mappings the spec deliberately parked for this moment.

Pass 1 happened the same day and passed with notes — the three rows stayed unruled — and then, before the day was out, VL-2R landed: Vitto is alive on the console. He now visibly thinks, acts, waits and pauses while a turn runs, speaks while his reply streams in, follows your cursor with his eyes, and blinks when you poke him; a compact, always-visible Vitto docks beside the chat itself, listening the moment you focus the message box, nodding when you send, and yielding to the rewind face while you scrub history. A dead live stream now recovers honestly instead of hanging — the exact promised line, plus a Reconnect button proven to reopen the socket. Two structural moves rode along: the engine graduated into its own governed library (@vitto/avatar, one entry point enforced by the toolchain itself), and the whole experience is being lifted into a second, host-agnostic library with a formal sensor-plugin contract, so future senses (UI activity, a webcam, hand tracking, lip-sync) can plug in but can never fake a feeling the diary doesn't hold. The safety net caught a real bug again — a first-paint race, same pattern as VL-1 — and then, because the review lane itself was down for hours on API errors, the landed code got a full retrospective adversarial pass instead: 23 findings, 2 blockers (the pane was reachable from the embed by accident; a "poking Vitto never disturbs his timing" claim was measured false), all fixed, full suite green the same day — 455 ui, 299 engine-library, 1,692 backend, 148 browser end-to-end tests. The step now sits at design-gate pass 2: the three carried-over expression rows, plus the bigger one VL-2R adds — ASK 7, the inner life. Asks 5 and 6 (voice, embed) stay open.

The deliverable: a complete, adversarially-reviewed design for the colleague's face — the real avatar engine from gspace1, driven purely by the diary, with the rewindable face shipping in the very first pass. Twelve verification readers swept both codebases first; four independent reviewers then filed 63 findings against the draft, and every one is answered in the spec. The reviewers' best catches: the "zero-port" reuse story was measurably false (48 type + 73 lint errors under our stricter rules — so the engine becomes our own fork); the avatar engine quietly moves its own gaze on mouse movement, which would have broken the "everything you see comes from the record" promise (now disabled by design); the mood system itself can look pleased while a real degradation is still ongoing (G-111 — a finding about the shipped product, not the avatar); and very old rewinds can claim feelings the archive no longer holds events for (G-112). Five new gaps opened, all owned and wave-assigned; the board, ledger and hardening plan were updated in the same round. No production code was written — by design: this was the spec-and-review session the design-led gate demands.

Same day — the inner-life amendment: at the founder's ask ("make it feel almost human"), the spec gained an emotional memory: feelings that accumulate and decay on the diary's own clock (relief after a hard morning, residue that carries), idle spontaneity seeded by the record itself so even randomness replays, an instant nod when you send, and a receipt behind every feeling — hover the face and it shows you the exact diary events behind its look. A second adversarial panel (three reviewers, 42 findings, 7 blockers) attacked the amendment and won real corrections: the "relieved" art doesn't exist yet and must be designed; the claim that this softens gap G-111 was withdrawn — the words under the face still forget a live outage, and fixing that stays a separate founder decision. One design law came out of the fight and now governs everything: the face's claims step only on facts; only its warmth eases in between. Seven decisions now wait on the founder (Decisions tab).

The decision, in one line: an app is a permission slip with a face, not a program we bolt on. The code that does the work already lives in the platform, reviewed and compiled; an "app" is the named, priced, revocable agreement that switches some of it on for one Space — here is what it can see, what it can do, what it costs, and one honest sentence about what removing it does. Because installing, using, and removing an app are all entries in the same diary as everything else, you can always answer "who turned this on, who did what with it, what did it cost" — and rewind all of it.

The hard question the founder asked — letting the colleague create apps, via "dynamic API endpoint creation" — has a safe answer. Apps never invent new web endpoints at runtime (that would quietly break the permission model). Instead an app declares actions, and a human button and the colleague reach the identical action through one governed door — so the diary shows two entries for the same deed differing only in who did it. And when the colleague proposes a new app it proposes words, not code: a new grouping of abilities it already has, which a person must read and approve before it exists. That is why an AI extending its own workbench is safe here and reckless elsewhere — every change is a visible, attributable, reversible record.

What an app actually is, after a second pass: not just a bundle of buttons, but four declarations over code that is already in the binary — the verbs it may perform, the view it shows (a pure fold over the diary, so it re-derives at any past moment and needs no database of its own), the reflexes it runs unasked under a mandatory budget and rate cap, and the placement where it appears and to whom. Two consequences worth reading twice: an app's screen is derived, so rewinding the room rewinds what every app was showing; and an app's autonomy is earned per room — approve the same action a few times and it graduates to acting on its own, announced in the diary, revoked in one click, demoted by a single refusal, and un-earned if you rewind past the moment it was granted. Most platforms hand an assistant a fixed permission list. Here permission is a consequence of proven behaviour, and it is reversible.

You can try the model: a working simulation — switch who is acting, press an action or hand it to the colleague, let an hour pass and watch a reflex decide for itself, break the bridge and watch the app tell the truth instead of showing a blank card, spend past the cap and watch it pause rather than overspend, then drag the diary backwards and watch all of it un-happen — is published at the apps & spaces playground. The full spec (four adversarial reviewers ran and refuted parts of the first draft — the honest fixes are folded in) is 2026-07-28-apps-and-spaces-architecture-spec.md. It waits on a few of your rulings — chiefly: may the colleague author these "House Apps" (a new line on the freeze list), and what the placement words are. No code was written; two new gaps were logged (attribution, and per-Space install grain). A pressure test also found a live issue: any workspace member can currently read a whole Pulse label through chat, including other admins' details — now ledgered for the security wave.

The headline: everything the security wave built has been inert by configuration. The RBAC ceiling ships in shadow mode by deploy default — it derives the correct decision for every request and then allows it anyway — and the hook its own written rollout plan depends on ("run in shadow, read the logs, then flip") was passed by nothing but a test, so weeks of shadow mode recorded ZERO evidence. That readout now exists and is wired to the Activity surface (G-78). The flip itself is deliberately NOT done: two adversarial reviewers proved it would lock every non-owner out of chat and HITL, kill the Pulse embed lane, and — the inversion that decided it — leave automation unrestricted while restricting the humans who link their identity. A live query settled the size: 3 accounts, all owners, so the blast radius today is zero and the next invited member is the casualty.

Four defects found that predate this session. GitHub CI had been RED since the previous session's own "CI green" claim (a piped exit code hid it). The Pulse embed crashed on its first approval or question — a whole surface with zero browser coverage. Archiving a conversation could stamp workspace_id: "unknown" into the APPEND-ONLY log, permanently unmatched by any workspace-scoped fold and uncorrectable by construction. And the chat's SSE stream retried a dead endpoint every 1.5s forever while displaying "connecting". Three of those were found by guards written for a different problem — the argument for writing the check rather than fixing the instance.

New machinery: a pack-boundary CI rule (core may never import a pack — it found an undocumented violation on its first run), and a ledger-integrity guard, after two agents working this branch in parallel independently allocated the same six gap ids. Also measured and recorded: grep on this machine silently reports "no match" for content it cannot read, so three core files were invisible to every past grep-based audit. Open gaps rose 37→56; that is discovery, not regression. Checkpoint 1468455.

The founder cleared all outstanding decisions at once and re-owned Yam's permission queue to the build agents "acting exactly as Yam would". Two waves shipped in one round: the chat preview escape (G-45) and the authz cluster (G-43 reset governance, G-37 cross-workspace reads, G-29 read lane, RNF3 census, plus a member-forgeable "trusted" label nobody had noticed). Four adversarial reviewers and two judges ran BEFORE any code — the judges settled the browser questions by running real Chromium probes and refuted three of the orchestrator's own confident claims, including the exploit story for the very hole being fixed. The most valuable catch: the cross-workspace fix as first designed would have LOOKED sealed while the rewind lane still served other workspaces' data. Everything verified twice — the full suite locally, then live against the founder's own running instance. Checkpoint 2d70fc2, GitHub CI green on both branches.

The founder asked for a full plain-words plan and a real explanation of every gate; this board gained tabs (the Plan tab explains each queued item's what/why for non-technical readers; the Decisions tab turns every gate into a card with examples and honest recommendations). Then the first gate cleared for real: the founder pushed both program branches to github.com/YamCrack/agente. The push exposed a latent gap — the CI recipe's trigger list still named only the step-0.1-era branches, so the first push ran zero checks; fixed the same hour and the first full GitHub runs (ci + e2e + evals) went out on both branches. The briefing artifact was re-checked and remains org-locked (public-reader); progress-vs-plan comparison continues against the repo master plan. Next: the required-checks click once green, then the feature wave, starting with the Vitto-Live chat pane spec + its adversarial review.

Channel redeliveries can't double-bill anymore (designed so no historic event changed meaning). Goals became diary events — the one piece of the colleague's life that lived outside the log came home, closing a real architecture violation. Chat history pages backward. Groups are manageable end to end. And tests now compile in CI on both trees — 293 stale fixtures burned, including tests that were writing schema-invalid events. The founder's product questions were analyzed and answered on this board (Analysis tab); the Vitto-Live chat pane was queued next. Checkpoint 285949f.

The poison-record class is now unmintable at every boundary — the sweep found the worst lane wasn't even the reported one: a single crafted URL to the trust-reset endpoint could have frozen a tenant's autonomy system; it now refuses cleanly, with tests proving the old bug existed. Dark mode chips (165 fixes) and light-mode gray text (151 fixes) both meet accessibility standards, enforced by token-level tests and grep guards so they can't regress. Oversized rewinds explain themselves. Also: audited the full master plan against the board — nothing unowned — and rewrote this page in plain language with test steps and business scenarios. Checkpoint f3a827a.

Consent poison now freezes autonomy shut (the reviewer refuted the first design and produced a better one). Rewind got O(1) mood lookups, an honest size cap, and byte-exact ordering between past and present. The theme layer shipped with zero light-mode change and an enforced contrast matrix. Checkpoint d69a02b.

The birth-certificate chain landed end-to-end (verification caught a provenance-attribution bug pre-merge). All 43 silent-failure paths burned to zero; the 2-billion-event ID ceiling removed permanently. Checkpoints 43fb66f, 7299a94.

The rewind demo runs for real: paint → five human approvals → announced graduation → staleness fails closed → the wall re-derives at any moment. The first review rejected a design that would have graduated dangerous commands from harmless ones.

15 backend↔frontend gaps closed (including a broken multi-tenant login). Ask-memory citations shipped, and the first 18-case graded exam became a mandatory CI job.

Safety rails, grenade fixes, replay integrity, the pack engine — then the first two visible surfaces.