Triage was applying the user's notification preferences correctly and then
calling notify() anyway, with the filtering itself as the summary ("filtered
as generic marketing per user preferences") — the interruption the rule was
written to prevent, delivered with an explanation attached.
Nothing in the prompt said that notify() *is* the interruption, so using it as
a record of the decision looked coherent. Say it plainly instead, in the three
places the model passes through: notify delivers immediately and has no silent
variant, a rule that filters a category means no call at all, and a summary
that mentions filtering is the tell that the rule is about to be broken. The
tool description carries the same statement at the call site.
The single-user notifications.md mechanism (a file in data/) died in the
multi-user move: assistant's prompt still pointed at it, but nothing read
it. Replace it with a memory note:
- event-triage injects user-memory/notifications.md verbatim on every
pass and treats it as authoritative over its default heuristics
- a shared common/notifications.md fragment, included by assistant, kid
and project-coordinator, tells the chat agents to record preference
requests there: one dated rule per bullet under a source heading or
General, asking for the source when ambiguous
- docs/system-agents.md explains the steering to users
The agent had no way to know its container ships ffmpeg, ripgrep or
tesseract, so it either declined work it could do or spent a round finding
out. This adds a command list to the system prompt as a **discovery hint** —
explicitly not an inventory.
Every decision follows from it being a hint:
- The allowlist (~35 entries, `container/commands.rs`) is the curation; a
full PATH dump is 800 entries of coreutils noise. The probe exists so the
list cannot *lie*, not so it can discover: `command -v` at login means we
never announce something a container recreate threw away.
- The rendered prose says the list is partial and names `command -v`, so a
tool outside the allowlist costs one check rather than a wrong conclusion.
An empty probe renders as an explicit "could not be read", never as
silence under a heading promising a list.
- Order is the allowlist's own, grouped by kind of work — the grouping is
the curation, and the reader is a model, not a grep.
- Staleness is cheap both ways, so there is no invalidation machinery: a
login-time snapshot on `UserContext`, non-fatal, refreshed at next login.
The gate is the tool, not the sentinel. Every AGENT.md carries
`common/sandbox.md` — the four system agents included — and the section is
emitted iff the turn's model is shown `execute_cmd`, derived from
`allow_tools` plus the security group's visibility filter for a root turn
and from `child_defs` for a sub-agent: always the same definitions the model
will see. `has_execute_cmd` therefore joins the PrefixCache key, since the
group is switchable mid-conversation and that switch already rewrites the
tool payload in the same provider cache.
The fragment holds only the heading and one stable sentence; every
conditional claim lives in the renderer, because prose promising
`sudo apt-get install` is not the renderer's to retract when the tool is
absent. `execute_cmd`'s own description loses `(python + node available)`:
its job is steering away from the shell, and a capability advertisement
diluted it.
Per blueprint/skill-project.md: the old single-namespace, hand-maintained
index is gone, replaced by a read-only, two-scope tree whose index is a
runtime function of its content.
- skills/ index generated at runtime (crates/skald-core/src/skills/:
inventory, install, validate, watch), injected through the new
<!-- SKILLS_LIST --> placeholder in AGENT.md (agents/common/skills.md);
meta.json inject_skills flag removed. 11 chat/task agents carry the
include, the 4 system agents do not.
- Two trees, both read-only in both directions: skills/shared/{id} (the
group's) and skills/{username}/{id} (one member's own, on the stable
userid). The root is closed too: UserFs::SkillMounts + RouteError (alias
probe, plain-denied paths, no home fallback) and a per-user
.skills-root/{userid} container mount with the two scope mounts nested
inside, plus the fifth self-heal axis (skills_mounted).
- Agent verbs: skill_register/skill_delete (Config group, global scope
behind the new skill.manage capability), fetch_repo for public repos,
list_items(type="skills"); reads are plain read_file on the printed
path. Seeded @fs_read skills/* allow.
- Freshness: a digest-gated watcher on the two trees emits
SystemEvent::SkillsChanged, whose subscriber rebuilds the frozen prompt
prefix via Skald::invalidate_prompt_prefix; in-process writers invalidate
directly.
- The build ships no skills: the three bundled skills (ics2json,
mcp-builder, skill-creator) and skills/index.md are removed, skills/ is
instance data (gitignored, not packaged, no longer pruned by update.sh).
- Docs: skills.md, agents.md, shared-folders.md added; docs/index.md and
agents/README.md updated.
TIC said nothing about what the agent does, and named the wrong thing: the
tick belongs to the scheduler, which is generic and lives outside it. The
agent's only decision is whether an incoming event deserves an interruption
— it sorts, it never acts — so it is now event-triage, matching the
functional naming of the two memory lints.
- agents/tic/ -> agents/event-triage/, module tic/ -> event_triage/,
TicManager -> EventTriageManager, TicConfig -> EventTriageConfig
- agent id and chat source: "tic" -> "event-triage"
- config keys: tic.* -> event_triage.*, and the config.yml section tic: ->
event_triage: (greenfield: previously set values fall back to defaults)
- i18n en/it/fr: Event triage / Triage eventi / Tri des evenements; dropped
the stale "TIC sessions" mention from the debug-pages description
- docs/system-agents.md, docs/index.md, docs/settings.md, CLAUDE.md, SKALD.md
Daniele
dguiducci