---
version: 0.20.0
date: 2026-06-18
headline: "fak-dogfood attaches to an already-running kernel by default instead of failing on a busy port."
themes: ["dogfood", "policy"]
highlights:
  - "Default `fak-dogfood` now ATTACHES to a healthy kernel on $PORT instead of dying."
  - "Attaching adopts the live kernel's model and leaves it running on exit."
  - "A pinned FAK_DOGFOOD_MODEL that disagrees with the live model still fails loud."
  - "FAK_DOGFOOD_NO_ATTACH=1 forces a fresh kernel and keeps the old port-busy guard."
  - "Capability-floor security visual + chart linked from the README/knowledge base."
---

**TL;DR** — Running `fak-dogfood` a second time used to abort with "port already
serving" and make you kill the old kernel or pick another port. It now ATTACHES to
the running kernel by default — adopts its model, wires Claude Code straight to it,
and leaves it up on exit — so the common case (a server is already up) just works.

## Attach to a running kernel (#dogfood)

- **What changed** — `fak-dogfood` checks `/healthz` on `$PORT` first; if a kernel
  is already healthy it ATTACHES instead of building + starting a second one.
  - *Why:* the prior behavior failed loud on a busy port, forcing a manual kill or a
    port change for the most common repeat-invocation case.
  - *How:* `fak/scripts/dogfood-claude.sh` — adopts the model from `/healthz`, skips
    build + backend + `fak serve`, and (since it didn't start the kernel) leaves it
    running on exit.

- **What changed** — the safety rails the old guard provided are preserved.
  - *Pinned-model conflict:* an operator-set `FAK_DOGFOOD_MODEL` that disagrees with
    the live kernel's model still fails loud rather than serving the wrong model.
  - *Force fresh:* `FAK_DOGFOOD_NO_ATTACH=1` skips attach and keeps the original
    port-busy guard (fail with the pid holding the port).
  - *Smoke unchanged:* `--smoke` never attaches — it always fronts its own offline
    mock kernel.

## Security docs (#policy)

- **What changed** — a capability-floor visual + chart, linked from the top-level
  `README.md`, `docs/cli-reference.md`, and `INDEX.md`.
  - *How:* `SECURITY-capability-floor-2026-06-18.md`.

## Verify without a session

```bash
# A kernel already up on :8080 → a second invocation attaches to it:
FAK_DOGFOOD_PORT=8080 ./fak/scripts/dogfood-claude.sh --print-env   # adopts the live model

# Force a fresh kernel instead (fails loud if the port is busy):
FAK_DOGFOOD_NO_ATTACH=1 ./fak/scripts/dogfood-claude.sh --print-env
```
