{
  "REQ-INPUT-PROVENANCE-ACCEPTANCE-REPORT": {
    "title": {
      "before": "A REMOTE SUBMITTER'S QUOTED ABSOLUTE PATHS ARE SERVED FROM THE SUBMITTER'S MACHINE, BOUND BY CORE ALONE AT RECEIPT OF THE USER_INPUT REPORT ADAPTERS ALREADY SEND -- NO TOKEN, NO DECLARATION, NOTHING ASKED OF ANY ADAPTER (releases#300; operator-ruled 2026-09-13 that #300 is developed entirely independently of harness adapters, USER_INPUT being all core asks of them; doyle re-cut docs/INPUT-PROVENANCE-CONTRACT.md section 8 the same day). Operator experience (relayed, comment 5645159945): the origin is the SENDER'S computer; a path that names no file there is SILENTLY SKIPPED, no prompt, no fallback origin. MECHANISM, core-only: (1) at RECEIPT of every USER_INPUT report core binds origin to the session's current authenticated REMOTE controller seat, the broker-owned driven_by; local seat, viewer, or none binds nothing and the declined line names it. (2) OWN-INJECTION EXCLUSION: a report whose payload is a delivery core itself wrote into that session's PTY binds no origin, recognised by the bytes core wrote and never by payload shape; resumed-session and external automation remain uncharacterised and bind the seat per the submitter rule. (3) core-side dedup: a repeat of the same payload in the same session while its reference is live re-registers nothing, emits no second helper notice, extends no TTL. (4) serving unchanged from the live-reference contract: submitter's machine, 24h TTL, audience the receiving endpoint, helper notice once per submission and path; every non-grant named EXCEPT the missing file, silent by decision. STATED CEILING, not an adapter promise: the report lags acceptance by the harness's own path (0.5-1.0 s measured on claude-spt), and a cross-operator Take inside that lag attributes to the new holder, whose own file is then served to the agent that holder controls. Gate: doc -- section 8 of the contract; impl -- the receipt-time bind, the own-injection exclusion, the dedup, wired to the existing live-reference serve; unit -- remote seat binds that seat, viewer/local/none binds nothing with the declined line naming it, a core-written delivery payload binds nothing, a repeated payload is idempotent with no TTL extension, a missing file on the bound origin emits no line; int -- a real two-node rc session where a remote controller's quoted path is served to the agent and a locally typed one is not.",
      "after": "A REMOTE SUBMITTER'S QUOTED ABSOLUTE OR ~-ROOTED PATHS ARE SERVED FROM THE SUBMITTER'S MACHINE, BOUND BY CORE ALONE AT RECEIPT OF THE EXISTING USER_INPUT REPORT -- NO TOKEN, NO DECLARATION, NOTHING ASKED OF ADAPTERS (releases#300; operator-ruled 2026-09-13; INPUT-PROVENANCE-CONTRACT section 8; ADR-0058 Amendment 2). NO QUOTED PATHS means no broker IPC and no line. For a path-bearing report, core binds origin to the session's current authenticated REMOTE controller seat, the broker-owned driven_by. An absent hosted session, local or viewer-only seat, or no controller binds nothing SILENTLY. OWN-INJECTION EXCLUSION: a report matching a peer delivery core physically wrote into that session's PTY binds no origin, comparing exact bytes OR both byte sequences trimmed of ASCII whitespace at their ends, never payload-shape parsing or interior normalization. Keep fixed-size streaming evidence, physical-write publication order, and fail-closed unproven/capacity handling. Resumed-session and external automation remain uncharacterised and bind the seat per the submitter rule. Core-side dedup: a repeated payload in the same session while its reference is live re-registers nothing, emits no second helper notice, extends no TTL. Serving uses the submitter's machine, bounded 24h TTL, audience the receiving endpoint, and one helper notice per submission and path. Missing files are silently skipped, with no prompt or fallback origin. CLI broker-connect and unanswered-receipt failures are silent unless SPT_PUMP_TRACE enables diagnostics; named declines apply only to failures with a remote controller, including the broker's 10-second owner-reply timeout. STATED CEILING, not an adapter promise: reports lag acceptance by the harness's own path (historical claude-spt measurement 0.5-1.0 s), and a cross-operator Take inside that lag attributes to the new holder. Gate: doc -- section 8 and ADR-0058 Am.2; impl -- receipt-time binding, physical-delivery exclusion, dedup, existing live-reference serving; unit -- remote binding survives Take, local/viewer/none/absent session bind nothing silently, no paths never call receipt transport, exact and ASCII-edge-trimmed core-written deliveries bind nothing without interior normalization, repeated payloads cannot renew TTL or repeat notices, missing files emit no line. The separately admitted two-node field leg is PENDING: remote controller's quoted path serves only to the receiving agent; local input does not serve; with a remote controller seated, a path-bearing peer message physically delivered by core must cause NO SERVE on its input report; measure added hook cost. No execution or hook-cost result is claimed and no adapter integration work is required."
    },
    "required_stages": {
      "before": [],
      "after": [
        "doc",
        "impl",
        "unit"
      ]
    }
  },
  "REQ-NOW-SIGNAL-FILE-ACCESS-HELPER": {
    "title": {
      "before": "THE FILE_ACCESS_HELPER CATEGORY HANDS AN AGENT THE EXACT `spt fetch` LINE FOR A FILE IT WAS GIVEN, AND NEVER MORE THAN ONCE PER (MESSAGE, PATH) (releases#17, ADR-0058 Amendment 1, operator directive 2026-09-06 widening the category from carries-attachments to user-quoted-a-path). TWO TRIGGERS, ONE OUTPUT SHAPE. (a) A DELIVERED MESSAGE CARRIES ATTACHMENTS: the signal emits one `spt fetch <url>` line per attachment, taken VERBATIM from the envelope rather than rebuilt, so the line an agent runs is the link the sender minted. (b) A USER'S MESSAGE QUOTES A FILEPATH THAT EXISTS ON THE USER'S NODE: core AUTO-REGISTERS that path as a REFERENCE-SERVED entry -- a file or dir entry, NEVER a snapshot, because the user said look at this and not keep this as it was, and a live reference costs no copy -- with ttl 24h, origin = the message short-ID, and audience = THE ONE ENDPOINT THAT RECEIVED THE MESSAGE (REQ-WEB-ENTRY-AUDIENCE), then hands that endpoint the fetch line. SAME-NODE USER AND AGENT REGISTER NOTHING: the signal says the path is local and readable, because serving a file to a process that can already open it buys an audit entry and no access. A REMOTE USER -- the case #17 was minted for -- has the file on THEIR node, so registration happens THERE on the agent's behalf: a cross-node serve-this-path-for-endpoint-X request authorized by the user's attach session, riding the stream family of REQ-WEB-CROSS-NODE-PROXY, which is why this rider lands after W1. GUARDS, EACH ITS OWN CELL: the path must EXIST on the owning node at signal time (a quoted path that is not there emits NOTHING rather than a dead link); ABSOLUTE OR ~-ROOTED PATHS ONLY, because a relative path has no anchor and would silently name a different file on the other node; AT MOST 5 PER MESSAGE; a directory registers a dir entry under the same ttl and audience. EVERY ENTRY IT MINTS IS ENUMERABLE IN `spt serve list` WITH ITS ORIGIN, so an automatic exposure is exactly as visible as a deliberate one and what-am-I-exposing keeps its single answer. DELTA DISCIPLINE on the standing now-signal rule: once per (message, path), so a re-poll in the same session emits nothing. Gate: doc -- the shells/frames.md now-signal category table and the attachments page's helper section; impl -- the category, the attachment trigger, the quoted-path detector, the auto-registration carrying ttl and audience and origin, the cross-node register-on-my-behalf request; unit -- the attachment trigger's exact emitted line, the quoted-path trigger registering with a 24h ttl and the receiving endpoint as audience, each guard as its own cell (missing path silent, relative path skipped, the cap of 5, a directory registering a dir entry), the same-node case saying local and registering nothing, and the once-per-(message,path) delta holding across a re-poll; int -- a remote user's quoted path served to the named endpoint end to end.",
      "after": "THE FILE_ACCESS_HELPER CATEGORY HANDS AN AGENT THE EXACT `spt fetch` LINE FOR A FILE IT WAS GIVEN, WITHOUT REPEATING A NOTICE (releases#17/#300, ADR-0058 Amendments 1 and 2). TWO TRIGGERS, ONE OUTPUT SHAPE. (a) A delivered message carries attachments: emit each fetch line VERBATIM from its envelope, once per (message, path). (b) A path-bearing USER_INPUT report binds the receiving session's live authenticated REMOTE controller at receipt; registration happens on that controller's machine over the same rc stream, with audience derived from its established target. The result is a live file or directory reference, not a snapshot, with a bounded 24h lifetime, origin = user-input:<receipt-id>, and audience = the one receiving endpoint. NO QUOTED PATHS means no broker IPC and no line. An absent hosted session, local or viewer-only seat, or no controller binds nothing SILENTLY; the Am.1 same-node readable notice is superseded. Missing files on the bound owner are silent, with no fallback origin. CLI broker-connect and unanswered-receipt failures are silent unless SPT_PUMP_TRACE enables diagnostics. Named declines apply only to failures with a remote controller; the broker's 10-second owner-reply timeout remains named. Absolute or ~-rooted paths only; at most five per report; directories have the same TTL and audience. Core-written physical peer deliveries bind no origin when bytes match exactly OR after trimming ASCII whitespace from both ends of both byte sequences, never by payload-shape parsing or interior normalization. Fixed-size streaming evidence follows physical-write publication order; unproven or capacity-exhausted evidence fails closed. Repeated payload/session reports register nothing again, repeat no helper notice, and never extend a live reference's deadline. Every exposure remains enumerable in `spt serve list` with its origin. No adapter integration obligations. Evidence: the kept attachment-link, receiver-never-resolves, live-reference dedup, missing-file/refusal, and HTTP edit/deletion cells, plus the receipt-path local-silence, no-path/no-transport, and physical-delivery byte-exclusion cells replace the deleted four guard-cell promise. Historical int evidence belongs to the original helper mechanism, not the deferred #300 field leg. That pending leg must prove remote serving and local silence, keep a remote controller seated while core physically delivers a path-bearing peer message whose report must cause NO SERVE, and measure added hook cost; none is claimed executed here."
    }
  },
  "REQ-UNLISTED-PRESENCE-PROBE": {
    "title": {
      "before": "`endpoint list` answers 'is this peer there right now' for UNLISTED rows with a presence probe, and the probe is NOT A MESSAGE: it is its own kind-tagged wire family, in the shape KNOCK_KIND already established, so an N-1 daemon classifies it Unknown and DROPS IT CLEAN. Probes fan out simultaneously and the verb BLOCKS on them under a HARD 10-SECOND PER-PROBE CEILING passed as a PARAMETER -- the shared PROBE_TIMEOUT const stays 2500ms and is untouched -- over the `probe_all` + `run_bounded` fan-out shape, so the wall-time is one ceiling and one wedged dial never drags the batch. TWO SILENCES: a probe that goes unanswered renders UNKNOWN AND NEVER OFFLINE, because an N-1 daemon's clean drop and a dead node produce the same silence. The answer distinguishes LISTENING / BUSY / OFFLINE, and each word has exactly one authority: they are answered from the serving daemon's HONEST SESSION AUTHORITY (the broker's hosted-session map and its activity window), NEVER from perch records -- the derived-view class where `is_online` reads a ready-file and a liveness stamp. BUSY IS A BROKER-AUTHORITY WORD ONLY. A relay-hosted peer holds no broker session, so it answers from a real connect attempt: accepted is LISTENING, and anything else is UNKNOWN -- busy and offline are indistinguishable there, and rendering offline would be a coin flip presented as a fact; the renderer may say why. CONSENT GROUNDING: the target node answers only if its own rules admit the asker for MSG to that endpoint -- enforcement stays owner-side at the owner's seam -- and presence already leaks to exactly this population one message at a time (SENT vs QUEUED), so the probe adds no new information class. Gate: doc -- the networking entry naming the family, the ceiling and the three-plus-unknown vocabulary; impl -- the record, the dispatcher arm, the serve side and the bounded fan-out; unit -- an unanswered probe reads unknown and not offline, a relay-hosted peer never reads busy, an unadmitted asker is refused at the owner's seam, and the ceiling is honoured per probe rather than per batch.",
      "after": "`endpoint list` answers 'is this peer there right now' for UNLISTED rows with a presence probe, and the probe is NOT A MESSAGE: it is its own kind-tagged wire family, in the shape KNOCK_KIND already established, so an N-1 daemon classifies it Unknown and DROPS IT CLEAN. Probes fan out simultaneously and the verb BLOCKS on them under a HARD 2.5-SECOND PER-PROBE CEILING passed as a PARAMETER (releases#299: perri's 10105/10120 ms waits were one unreachable peer's dial reaching the former 10-second ceiling) -- the shared PROBE_TIMEOUT const stays 2500ms and is untouched -- over the `probe_all` + `run_bounded` fan-out shape, so the wall-time is one ceiling and one wedged dial never drags the batch. TWO SILENCES: a probe that goes unanswered renders UNKNOWN AND NEVER OFFLINE, because an N-1 daemon's clean drop and a dead node produce the same silence. The answer distinguishes LISTENING / BUSY / OFFLINE, and each word has exactly one authority: they are answered from the serving daemon's HONEST SESSION AUTHORITY (the broker's hosted-session map and its activity window), NEVER from perch records -- the derived-view class where `is_online` reads a ready-file and a liveness stamp. BUSY IS A BROKER-AUTHORITY WORD ONLY. A relay-hosted peer holds no broker session, so it answers from a real connect attempt: accepted is LISTENING, and anything else is UNKNOWN -- busy and offline are indistinguishable there, and rendering offline would be a coin flip presented as a fact; the renderer may say why. CONSENT GROUNDING: the target node answers only if its own rules admit the asker for MSG to that endpoint -- enforcement stays owner-side at the owner's seam -- and presence already leaks to exactly this population one message at a time (SENT vs QUEUED), so the probe adds no new information class. Gate: doc -- the networking entry naming the family, the ceiling and the three-plus-unknown vocabulary; impl -- the record, the dispatcher arm, the serve side and the bounded fan-out; unit -- an unanswered probe reads unknown and not offline, a relay-hosted peer never reads busy, an unadmitted asker is refused at the owner's seam, and the ceiling is honoured per probe rather than per batch."
    }
  }
}