SouveraineOS/docs/substrate/HANDOFF_NEXT.md

description	date
Resume doc for the next session — current state, what landed, what's next	2026-05-15

Handoff — May 15 (close)

Session overview

This session landed federation Phases 4–8, identity audit, task audit, and significant cleanup. Three commits:

1. c6a0f86 — Atmosphere restore from system/preferences/visual.md + archive of 5 resolved task docs + CLAUDE.md refresh
2. 3460780 — Phase 8: hearth & limb role model
3. c722e39 — Phase 7: identity split (agent seed signs summons)
4. 9bce489 — TurnInjector auto-wake for inbound summons
5. 614a152 — Phases 4–6: reach & consult, lite listener, memory gating
6. bccff21 — Archive federation-seed-id.md, update CLAUDE.md task refs

What's genuinely built

Federation (all 8 phases, 6 commits)

Phase	What	File
1	Signed WS transport, FederationBridge, outbound/inbound	src/server/federation/bridge.rs
2	DeviceRegistry, device_announce, souveraine peers CLI	src/server/device_registry.rs
3	Subscription matching, control-event always-forward	Built into bridge.rs
4	reach/consult tools, SummonHandler, consent floor	src/core/tools/agent.rs, src/server/summon_handler.rs (617 lines)
5	Lite listener, summon parking, auto-wake	src/server/listener.rs (241 lines)
6	Memory-based gating, federation posture in system prompt	src/core/prompt.rs
7	Identity split: agent seed signs summons, receiver classifies by crypto	src/core/identity/summon.rs + tests
8	Hearth/limb role model, split-brain guard	src/core/config.rs, bridge.rs, device_registry.rs

Atmosphere/presence

• ChatPalette fully wired (tool cards, cockpit, input bar, markdown, schedules, settings all use ChatPalette)
• Posture shift no longer clobbers explicit atmosphere (atmosphere_explicit guard, transition_atmosphere)
• Cross-session atmosphere restore: Atmosphere::from_name() + system/preferences/visual.md readback at TUI startup
• Self-awareness pulse ([HH:MM — X minutes in. Still going.]) — was already in the code
• Interjection queue + /btw fork — both built
• Conversation switch race fixed (switch_pending state machine in place)

Consciousness

• N+1 Aster pass fires on every turn (surfacing, reflection, archivist, compaction events on EventBus + mpsc)
• N+25 reflection engine — 408 lines, functional (src/core/reflection/mod.rs)
• Only hole: archivist module is empty/not registered (but all infra wired)

Identity

• Per-agent seed dir (agents/{id}/seed/) — travels with memfs
• Per-machine seed (seed-id/) — device identity
• Summon signing: agent_seed signs payload, machine_seed signs transport envelope

What the task audit revealed

5 tasks were fully resolved and archived this session:

• tui-clean-conversation-switch (already fixed)
• scope-4-n25-reflection (was 408 lines, not 35-line stub)
• tui-presence-and-interrupt (everything built, including self-awareness pulse)
• presence-visual-evolution (ChatPalette wired, posture fix, cross-session restore landed)
• presence-autonomy (atmosphere tool bidirectional + prefs readback; from_posture() coupling remains per proto scope)

What's actually remaining (honest queue)

High impact

1. n100-archivist — Empty directory, not registered. The only major consciousness module genuinely unbuilt. All surrounding infrastructure is wired (config, events, TUI, API, settings).
2. heartbeat-n1 — on_response is called on background turns but the mpsc channel drains silently. Surfacings reach EventBus (firehose subscribers + EventLog see them) but there's no stash mechanism for UI pickup. Needs a pending-surfacings file written for pickup at next conversation start.
3. rename-aster — 62 refs (19 code-level), purely cosmetic. No public API impact.
4. tui-memory-browser — Nothing built. Depends on markdown renderer + memory read API (both exist).
5. primitive-refactor-super-task — Four massive files (app.rs 3413, chat.rs 2604, local.rs 1536, settings.rs 1441). EventBus→TUI unwired. Posture/atmosphere coupling remains at Presence level.

Deferred / lower priority

• In-process Lite→Full upgrade (federation deferred #1)
• authorized-devices.md gating (federation deferred #2)
• Encrypted agent seed at rest (federation deferred #4)
• Remote git sync, desktop overlay, node connection manager, circuit breaker, persona router, subagent pool, chain modes, etc. (~15 items, scoped but not urgent)

Build status

cargo build 0 errors, ~240 pre-existing warnings. 135+ tests pass.

Key decisions made

• Phase order. Federation Phases 4–6 bundled in one commit because SummonHandler, consent floor, and lite listener are coupled.
• Identity split (Phase 7). Discovered during post-Phase-6 audit: event_type field was trusted, not verified. Agent-seed signing closes the spoofed-"reach" hole.
• Hearth/limb (Phase 8). Device identity (machine seed) is the right thing for the hearth: true flag. Agent identity stays orthogonal. In-process Lite→Full upgrade deferred — requires route-set refactor.
• Task archive. 5 tasks closed after code audit found them already resolved. Archivist confirmed as the only genuinely empty consciousness module.