# INDEX — the full map of the fak repo

The curated map of everything in this repo that is not on the front page. If a
doc exists, it is reachable from here. New dated notes go under
[`docs/notes/`](docs/notes/) and get a line in the **Notes & research** section
below, so the front door never has to grow to stay complete.

> New here? Start with the front doors, not this map: the
> [README](README.md), [START-HERE](START-HERE.md), and the
> [agent orientation](AGENTS.md). This page is the index for when you already
> know roughly what you want and need the link.

## Start here

- [README](README.md) — what fak is and why, in one read.
- [START-HERE](START-HERE.md) — run a local model behind the gate in ten minutes.
- [Getting started](GETTING-STARTED.md) — install the single binary, point your agent at it.
- [AGENTS](AGENTS.md) — orientation for coding agents (build, test, the hard rules).
- [llms.txt](llms.txt) — the answer-engine index (and its inlined `llms-full.txt`).
- [Docs home](docs/index.md) — the published documentation landing page.
- [Innovations index](docs/INNOVATIONS-INDEX.md) — the durable catalog of fak's innovations, concepts, and learnings: what each is, the general primitive it embodies, where it lives, whether it's shipped, and whether it's been generalized for reuse. The innovations counterpart to this repo map and the [llms.txt](llms.txt) doc map.
- [Work map](docs/WORK-MAP.md) — where each *kind* of work lives, kept separate: **optimizations** (the `EXTENDING.md` three-gate lane), **ongoing work** (the in-flight trackers, epics, and dispatch loop), and **dev** (the build/test/partition/ship workflow). Names the overlaps and the known drift between the status surfaces. Read this when you're not sure which front door a task belongs to.

## What fak supports

The dedicated, cross-linked capability pages — what fak works with, each grounded in the
repo and the sourced [compatibility matrix](docs/integrations/compatibility-matrix.md).

- [What fak supports (hub)](docs/supported/README.md) — the index of every "supported" page.
- [Models](docs/supported/models.md) — any model you front, plus the in-kernel architectures proven bit-exact.
- [Features](docs/supported/features.md) — every capability with its shipped / simulated / stub status.
- [Clouds & hosted providers](docs/supported/clouds.md) — Anthropic, OpenAI, Gemini, xAI, Bedrock, Vertex, Azure, OpenRouter, Together, Groq, Fireworks.
- [APIs, wires & MCP](docs/supported/apis-and-protocols.md) — the wires fak speaks and the fak-native + MCP endpoints.
- [Agent harnesses & frameworks](docs/supported/agent-harnesses.md) — Claude Code, Cursor, Codex, and the framework field.
- [Serving engines](docs/supported/engines.md) — Ollama, vLLM, SGLang, llama.cpp, LM Studio, and the in-kernel engine.

## Measuring sticks (the scorecards)

Each turns a fuzzy goal into a number you can drive toward zero.

- [Industry scorecard](docs/industry-scorecard/README.md) — the one OUTWARD stick: an industry-first taxonomy of the dimensions the LLM-serving field competes on (vLLM/SGLang/TensorRT-LLM/llama.cpp), with fak's honest position on each (mostly named gaps). Two driven numbers: **coverage** (of the field) and **parity-debt** (honesty of the rows). Modular folder, regenerated from `tools/industry_scorecard.data/`.
- [Agent-readiness scorecard](docs/AGENT-READINESS-SCORECARD.md) — can an AI agent discover, adopt, and build on fak (friction-debt across the three steps an agent walks).
- [Maturity scorecard](docs/MATURITY-SCORECARD.md) — the one LIFECYCLE stick: where each declared capability (one per `internal/<leaf>` lane) sits on a closed ladder (`proposed→prototyped→tested→dogfooded→default`, + a `benchmarked` badge), and the next work item that would mature it. Immaturity is never a defect — only a **ladder-skip** (fak relies on a capability yet leaves it untested) is. `fak maturity next` is the ranked backlog the dispatch loop pulls from; re-derived from `dos.toml` + the tree's import graph.
- [Repo-hygiene scorecard](docs/REPO-HYGIENE-SCORECARD.md) — verbosity, organization, indexing, and accessibility of the whole tree.
- [Code-quality scorecard](docs/CODE-QUALITY-SCORECARD.md) — the Go module's code-debt.
- [Steerability scorecard](docs/STEERABILITY-SCORECARD.md) — the one GROWTH-INVARIANT stick: does the effort to steer/change/navigate the repo stay flat as it grows? A 0–100 **steerability index** over modularity, coupling (blast radius), navigability, and correction — every KPI a ratio/percentile, so a 2× repo with the same discipline scores the same. The number every count-based sibling can't give.
- [Observability scorecard](docs/OBSERVABILITY-SCORECARD.md) — the observability plane (metrics, dashboards, alerts, traces, proofs, ship-audit), graded so every dashboard/alert/doc points at a metric the binary emits and every claim is verifiable.
- [Conflation scorecard](docs/CONFLATION-SCORECARD.md) — the truth-maintenance stick: does every number/status fak reports label its provenance — WITNESSED (a fact fak authored, in its control) vs OBSERVED (a value fak relays from an external party) — and never blame a provider-side miss on a fak action? Reads the fact-reporting surfaces (metric help, the guard exit summary) so a dashboard can't say "fak broke the cache" when the provider's cache simply expired.
- [Default-value scorecard](docs/DEFAULT-VALUE-SCORECARD.md) — the recurring guard for epic #1089: does every cost/cache/amplification value-flag in `cmd/fak/{guard,serve}.go` ship default-ON (or gated OFF with a documented reason), does no exit-summary line fold `kernel.Counters` that are structurally 0 on the Decide-only `fak guard -- claude` proxy (VACUOUS_ON_GUARD), and does no score surface default its headline to a modeled "planned" number (C_MODELED_NOT_OBSERVED)? Parses the flag definitions and exit/score surfaces from the Go source so "a value feature shipped not-fully-enabled" becomes a tracked `default_value_debt` integer, not a one-off chat. Worst-first retirement maps onto #1090-#1095.
- [UI/UX-quality scorecard](docs/UI-QUALITY-SCORECARD.md) — the one TERMINAL-SURFACE stick: do the `fak console` panes, the `fak info` overlay, and `fak guard --split` render correctly and legibly? Graded against the render source itself — rune-safe truncation (no byte-slice that splits a multibyte rune), cell-aware column pads (no `%-Ns` shear on a multibyte row), empty-state branches, full info-legend and console-help coverage — folded into a `ui_quality_debt` integer. The first ship retired the `trimTUI` byte-slice that emitted a half rune on any em-dash/emoji.
- [Demo-quality scorecard](docs/DEMO-QUALITY-SCORECARD.md) — are the demos runnable, honest, self-contained.
- [Demo-robustness scorecard](docs/DEMO-ROBUSTNESS-SCORECARD.md) — do the demos survive bad input and odd environments.
- [Learning-docs scorecard](docs/LEARNING-SCORECARD.md) — does the teaching set actually teach (learning-debt: a how-to with no runnable command, a tutorial with no worked output, an orphan lesson, an uncovered topic). Pedagogy counterpart of repo-hygiene (structure) and doc-appeal (voice).
- [Concept-usage scorecard](docs/fak/concept-usage-scorecard.md) — the INWARD dogfooding stick: when an agent BUILDS fak, how much does that development route through fak's *own* concepts? Two axes, both re-derived from `git log` + the `.dos` journals — **usage** (the ship-stamp / DCO / binding-verb commit discipline + lane arbitration) and **witness** (the `verify`/`improve` syscalls over passive recall). The thin axis is witness: it catches development that ships with fak's commit clothes but still trusts a self-report instead of witnessing its own claim. Breadth-and-depth sibling of the [dogfood-loop scorecard](docs/fak/dogfood-loop-scorecard.md) (one launched-session honesty loop).
- [Loop scorecard](docs/fak/loop-scorecard.md) — are fak's always-on agentic background loops *first-class durable processes*, or fire-and-forget scripts? Three axes, all re-derived from the loop ledger + job registry `fak loop` writes — **durability** (auto-restart on system restart: every firing loop registered, armed, and `fak cron emit`-projectable to an OS unit), **self-report** (no dark loop; fires that record an end outcome; heartbeat/notify), and **dogfood** (runs route through `fak loop run` under `fak guard`, the canonical hash-chained ledger, the witness contract). The honest baseline is debt 4 / composite 33 (F): the loops that fire are driven by external schedulers, so they vanish on reboot, go dark, and run unguarded — the 3× program drives them through `fak loop run`. Operational sibling of the [concept-usage scorecard](docs/fak/concept-usage-scorecard.md).
- [Release-readiness scorecard](docs/RELEASE-READINESS-SCORECARD.md) — the RELEASE-VELOCITY stick: can a kernel that writes hundreds of commits a day cut, validate, publish, and roll back a release at the same speed, or does `@latest` rot far behind HEAD? KPIs across the release lifecycle — **discover** (an agent can find & invoke the path), **automate** (the machine cuts on green, not a human), **validate** (the cut is gated and the publish verified), **trust** (stable anchors, signed artifacts, rollback) — folded into a `release-debt` integer, all re-derived from git + the tracked tree + live release signals. Honest baseline is debt 12 / composite 16 (F): the cut is a hand-driven 7-step ritual and the cadence is dry-run-only, so `@latest` sits ~1900 commits behind HEAD; the 3× program (epic #1354) automates the cut and makes the path agent-discoverable.
- [Cadence report](docs/cadence/README.md) — the regular control-pane fold over scores, feature maturity, work done, and release state. Its append-only ledger records `standing_score`, normalized health, and difficulty fields so trends can keep climbing or fall instead of treating a bounded 100 as a stable meaning after the scorecard surface changes.
- [Milestone status](docs/milestones/STATUS.md) — the durable, freshness-checked snapshot of the maturity CLIMB: the model x backend grid's distribution across the closed M0–M7 support-maturity ladder, generated from `internal/covmatrix` + `internal/milestonereport` and kept honest by `fak milestone status-doc --check-doc` (a committed cell cannot silently drift from the live grid). The `gh`-fed epic ROADMAP stays on the Slack card + the durable `docs/milestones/history.jsonl` trend ledger.
- [Code-2x program](docs/CODE-2X-PROGRAM.md) — the plan to halve code-debt, then halve it again.

## Architecture & design

- [Architecture](ARCHITECTURE.md) — the registry seams and the frozen ABI.
- [GPU forward pass](GPU.md) — the in-kernel Llama decode on the GPU: a real on-box run witnessed against the CPU reference, with the honest gap to llama.cpp.
- [Partitioning](PARTITION.md) — how the kernel splits work across lanes and leaves.
- [Extending fak](EXTENDING.md) — plug in an optimization, prove it correct, prove it faster.
- [SOTA comparison](SOTA-COMPARISON.md) — where fak sits next to the state of the art.
- [The cross-platform spine (IoT to hyperscaler)](docs/explainers/cross-platform-spine.md) — why the same pure-Go kernel is the invariant spine across the whole deployment spectrum (IoT, edge, laptop, hyperscaler), the way Linux is one kernel under a phone and a datacenter: the hardware specifics change, the agentic workload shape and the kernel's invariants do not. The deployment-substrate axis, alongside the scale axis ([loops](docs/explainers/engineering-is-building-loops.md)) and the hardware-depth axis ([HAL](docs/explainers/hardware-portability.md)).
- [Interoperability stance](docs/integrations/interoperability.md) — why fak adopts whatever agent/model/framework you run (the one opinion kept is the floor) + the honest per-wire grade for the flagship harnesses and every interop protocol.
- [Agent-to-agent value](docs/a2a-value-opportunities.md) — where the cross-agent cache pays off.
- [Multi-agent coordination protocol (RFC, D-007)](docs/multi-agent-coordination-protocol.md) — the normative spec binding message passing (a2achan), shared state (sharedtask), and coordination primitives (comm) under one default-deny floor.
- [Shared state ladder](docs/shared-state-ladder.md) — the canonical split for shared live messages, live mutable state, durable handoff, disaggregated state, and user-level collaborative editing.
- [Shared task record contract](docs/shared-task-record-contract.md) — the executable envelope contract for collaborative task records, user patches, conflicts, approval gates, and disaggregated artifact refs.
- [Task manager concept](docs/task-manager.md) — the process-local runtime snapshot for tasks, steps, resource usage, concept runtime, progress, and ETA.
- [Agent–machine link protocol](docs/agent-machine-link-protocol.md) — how an agent and a host node bind.
- [Glossary](docs/glossary.md) — the canonical split for overloaded core words (session, agent, context, model, memory, tool/skill, steering), shared-memory senses, and the live memory issue-owner map.
- [DOS kernel transfer playbook](docs/dos-kernel-transfer-playbook.md) — moving the trust substrate to a new repo.
- [Prefill visuals](docs/prefill-visuals.md) — the diagrams behind prefill reuse.

## Operating the agent fleet

- [`fleet` operator console](tools/FLEET.md) — one command to watch the agent fleet on a host: live session/account health, what stopped and why, which accounts are resumable, and what needs you. The session-health companion to `dos top`; install it onto PATH with `fleet install`.
- [Run it all night (`fak nightrun`)](docs/nightrun/README.md) — the data-collection center of excellence: the one door an operator/agent uses to answer "what is the single most important datum I can collect on THIS box, right now?" then collect the feasible queue on a loop into a durable ledger.
- [GPU server overnight run plan (2026-06-28)](docs/nightrun/DGX-OVERNIGHT-PLAN-2026-06-28.md) — the fleet-scale companion: per-box overnight data-collection plan for the GPU server/CPU server boxes reached over the Slack control bridge (where the frontier GLM-5.2 witnesses live), with the live fleet state, the exact runbook per box, and the honesty boundary.
- [Mac metal node overnight run plan (2026-06-28)](docs/nightrun/MAC-OVERNIGHT-PLAN-2026-06-28.md) — the Apple-Silicon companion: the fak-kernel Qwen3.6-27B Q4_K decode witness collected on the Metal verify node (warm ~1.6–1.9 tok/s, climbing with length), why `--context-budget-tokens` is load-bearing on the 36 GB box, and the resume conditions.

## Benchmarks & methodology

- [Benchmark authority](BENCHMARK-AUTHORITY.md) — the single source of truth for every number.
- [Benchmark template](BENCHMARK-TEMPLATE.md) — the shape a new benchmark result doc must take.
- [Net-true value standard](docs/standards/net-true-value.md) — how fak decides a gain is real, not noise: the six-question rubric (real baseline / net of cost / scope / provenance / witness / realized) used on fak's own claims and on incoming industry "5×" claims, each criterion bound to the stick that enforces it.
- [Agent grammar standard](docs/standards/agent-grammar.md) — the normative trust grammar a second agent fleet conforms to: the closed nouns (lane · lease · reason token · witness · verdict · claim · ladder rung · scope), the shipped verbs each with an input→verdict signature and the closed vocabulary it draws from (every verb maps to a `dos_*` MCP verb / `dos.toml` surface today), the lift recipe as MUST clauses, the `G6` one-sided-screen + witnessed-loss polarity predicate as a checkable MUST, and a per-verb conformance checklist — the role `internal/abi`'s golden freeze plays for the ABI.
- [Observer-effect standard](docs/standards/observer-effect.md) — the cost-side companion: the perf-floor/security-floor duality, the WITNESSED/OBSERVED/MODELED/SIMULATED label required on every overhead number fak reports about itself, and the fence that a hot-path meter's own cost must be under a declared cap proven by a green test (the shipped `AcceptanceMeter` is pinned at 0 allocations/sample).
- [Support-maturity honesty fence](docs/standards/support-maturity-honesty-fence.md) — the support-side companion (epic #1243): the net-true-value lens on *support* claims. Three rules keep the maturity ladder (M0 none → M7 beyond-SOTA) from becoming a wish-list — no self-reported promotion (a rung rises only on a non-author witness, the shipgate keep-bit), a rung can drop (the scorecard re-derives every rung from the live grid, so a stale/regressed witness demotes with no latch), and every rung carries a WITNESSED/OBSERVED/MODELED label (only WITNESSED attains a rung).
- [Hardware bench plan](docs/bench-plan.md) — auto-generated: the next highest-value test per bench-node (regenerate with `tools/bench_plan.py`, don't hand-edit).
- [Web-agent baselines](docs/webbench-baselines.md) — the modeled WebVoyager prefill geometry (vs the naive floor).
- [Web-agent blockers](docs/webbench-blockers.md) — what is not yet measured, and why.
- [Web-agent measurement summary](docs/webbench-real-measurements-summary.md) — the rolled-up real-run numbers.
- [DOS hook cost](docs/perf-dos-hook-cost.md) — what the commit-time guards cost in practice.
- [Runaway-guard cost](docs/perf-runaway-guard.md) — the cost of the process-reaper backstop.

## Status & tracking

Working docs that track a specific effort. Dated by design; they age out.

- [Executive roll-up](docs/EXECUTIVE-ROLLUP.md) — the leadership snapshot: flagship wins, the live GLM-5.2 goal, the real risks, and the one open decision — every number provenance-labeled (witnessed / observed / simulated / unverified). Aggregated from PRODUCT-STATUS, BENCHMARK-AUTHORITY, the AgentDojo red-team, the dispatch audit, and the industry scorecard.
- [Issue tracker](https://github.com/anthony-chaudhary/fak/issues) — the live, always-current open-issue count. This index never hard-codes a count (it drifts); see the tracker for the current number.
- [Support-maturity disambiguation epic (#1243)](docs/notes/support-maturity-disambiguation-tracking-1243.md) — splits the one fuzzy word "supported" into a closed, witnessed level ladder (none → loads → runs → correct → optimized → SOTA-parity → beyond-SOTA) and a router that turns each cell's rung into the right dev-regime, time-horizon, and tooling — so a 10-step "make it work" is never confused with a 10,000-step "make it fast". Extends `internal/covmatrix`; the measurement+routing instrument above the Parity tracks (#307/#305/#303/#301).
- [GPU parity tracking (#480)](docs/notes/gpu-parity-tracking-480.md) — bringing the GPU path to parity.
- [SIMD CPU parity tracking (#400)](docs/notes/simd-cpu-parity-tracking-400.md) — Go-native SIMD (AVX2/AVX-512/NEON) vs llama.cpp on CPU: parity where SIMD is the lever, non-SIMD residuals named.
- [Track B performance parity tracking (#306)](docs/notes/track-b-performance-parity-tracking-306.md) — roll-up status for the eight Track B children, with stale migrated issue links corrected and GPU-gated/unimplemented acceptance blockers kept explicit.
- [Track D agent-framework parity tracking (#304)](docs/notes/track-d-agent-framework-parity-tracking-304.md) — roll-up status for the eight Track D children, with stale migrated issue links corrected; D-001 benchmark scaffold (smoke green, published run bench-node-gated), D-002 closed by wire repoint, D-003/D-004 wire-supported with adapter acceptance open, D-005/D-006 unimplemented, D-007/D-008 scaffolds tracked by sibling epics.
- [The self-tax plane — performance-assurance epic (#1147)](docs/notes/self-tax-performance-assurance-tracking-1147.md) — first-class, always-on evidence that fak's own gates/guards/verification cost no more than a declared budget (and naming it when they make work faster): the mediation-overhead dual of the security floor, mechanizing net-true-value Q2 (net-of-cost) across turn-by-turn → post-session → CI-gate → model-as-judge → observability. Sibling of #306 (mediation overhead vs raw-inference parity).
- [Model-arch seam status (#487)](docs/notes/model-arch-seam-status-487.md) — the model-architecture seam work.
- [Trust-floor decomposition (#492)](docs/notes/trust-floor-decomposition-492.md) — splitting the trust floor into checkable parts.

## Plans & media

- [Video content plan](docs/explainers/video-content-plan.md) — the explainer-video storyboard.

## Notes & research (`docs/notes/`)

Dated working notes: research, audits, and run logs. Kept for the record, not the
front page.

- [Named issue views as the default selection surface (2026-06-29)](docs/notes/ISSUE-VIEWS-DEFAULT-2026-06-29.md) — the GitHub saved views at `/issues/views` aren't API-readable, so `tools/issue_views.py` + `.github/issue-views.json` give the dispatch/triage family an API-readable mirror (named views derived from the real label taxonomy); `show --json` pipes into `issue_lane_router`/`issue_triage` instead of scattered `--label` queries.
- [sm80 CUDA 13 issue #973 closure witness (2026-06-29)](docs/notes/SM80-CUDA-ISSUE-973-WITNESS-2026-06-29.md) — targeted datacenter GPU-class sm_80 CUDA 13.0 witness for the two #973 residuals: `TestCUDAGraphDecodeParity` and `TestCUDAQ4KBatchedMatMulApproxMatchesRef` both pass, with Q4_K batched cosine `1.00000000`; explicitly does not claim the full original `CUDA|HALDevice` umbrella, and leaves the separate f32 failures to #972.
- [Native-harness progress tracking (#1315) (2026-06-29)](docs/notes/native-harness-progress-tracking-1315.md) — the roll-up for [epic #1315](https://github.com/anthony-chaudhary/fak/issues/1315), *fak owns the native agent loop end-to-end — the dispatch-edge program*. On the proxy path the external harness (Claude Code/codex) owns the turn loop and *consumes* tool calls outside fak; the native harness is fak *owning* dispatch (its own loop drives the turns, the kernel is the only tool path), the precondition for every "impossible on proxy" capability (vDSO tool-result materialization, before-consumption write barrier, speculative serve). Produced from an **8-surface, 90-claim survey** whose every SHIPPED/PARTIAL claim was re-checked by an adversarial pass against git + request-path reachability — **27 downgrades** on the one question that matters: *is there a live, non-test caller on the request path?* The honest one-liner: **the engine is owned, the loop is not (yet).** SHIPPED + live on the serve path: the native `/v1/messages` front door, in-kernel generation (`--gguf`), in-kernel tool-call render+lift+adjudication, fail-closed on malformed calls, vDSO read-serve, per-request session admission, the context planner, KV planned-elision, inbound quarantine, the `fak guard` proxy gate, the syscall boundary + A/B comparator. PARTIAL (built + tested, **zero live caller**): `RunArm` itself (only the `fak agent` benchmark + bench/ablate callers; the served path is single-shot `s.planner.Complete`), `WithSessionTable`/`gateTurn`, `drainSteer`, `WithRouteManifest`, `ApplyPace`, `WaitResume` warm-KV splice, in-loop streaming, the AgentDojo steward sweep, the multi-session scheduler, the intent conduit (#805), the loop-lifecycle ledger. NOT_YET (named gaps, keystones first): the **suspend-and-resume turn primitive** (`gateTurn` *terminates*, it does not suspend — the one net-new mechanism the canonical note names) and the **before-consumption write barrier** (SEAM-4 `abi/speculate.go` is committed `d859ec21` but `Speculator.Predict` has zero production callers), plus the consistency-level field on `ToolCall`, the native TUI/REPL (`fak chat`), and the system-prompt-MMU spine's first live caller. 8 ordered children #1316–#1323 (keystones #1316 a live `RunArm` caller, #1318 the suspend/resume primitive). Forward framing in [the vToolcall fork note](docs/notes/VTOOLCALL-FORK-AND-BESTEFFORT-2026-06-25.md); close children per [the epic close-out method](docs/notes/EPIC-CLOSEOUT-METHOD-2026-06-29.md) (a CLOSED box is a self-report, not a witness).
- [Epic close-out method — properly closing (or retiring) an epic (2026-06-29)](docs/notes/EPIC-CLOSEOUT-METHOD-2026-06-29.md) — the backlog is epic-heavy (57/171 open are epics); this is the repeatable method for closing one **honestly**. Guards the two failure modes — *false-close* (a child's `CLOSED` state / `- [x]` box is a self-report, not a witness; the syspromptmmu #1258 children were docs-closed while the code stayed UNBUILT) and *stale-open* (shipped epics that nobody re-checked). Three routes: **A COMPLETED** — every child closed AND the deliverable witnessed in the tracked tree (artifact on disk + claimed SHAs real + `dos commit-audit` OK/diff-witnessed + residual carved), closed with the #1147 house-style evidence comment (worked example: **#1116** closed 2026-06-29); **B NOT_PLANNED** — superseded/deduped, point to the survivor and fold framing there (example #1226→#1217; candidate clusters: serving #50/#637/#931, agent-OS #748/#749/#750/#1178/#1193); **C STANDING** — a "keep-the-scorecard-alive" perpetual loop (#710/#801/#1050/#1278) is retired from the deliverable count (split finite children out, drive the recurring part from a `/loop`, mark standing), never closed as done. Includes the read-only bulk close-state audit recipe and the anti-gaming laws.
- [The native-code doctrine (#1124) (2026-06-28)](docs/notes/NATIVE-CODE-DOCTRINE-1124-2026-06-28.md) — fak's written rule for dropping below portable Go: Go-assembly (`.s`) is welcome on the model/compute path and is **not** cgo; `cgo`/`import "C"` is justified only for GPU device code behind an opt-in build tag; neither is ever allowed on the request/adjudication path. Plus the verified backlog of hot scalar kernels worth vectorizing (C1–C6) and the four places native code must never go.
- [Committing shared-clone WIP is an integration pass, not a freeze (2026-06-29)](docs/notes/SHARED-CLONE-INTEGRATION-PASS-2026-06-29.md) — runbook for an agent told to commit/clean up work in progress on the shared fak clone: land complete, self-contained, building units by explicit path; park the rest; gate the push with an archive-HEAD build — instead of mislabeling collective fleet WIP as untouchable peer work.
- [fak issue-backlog dispatch loop — handoff (2026-06-29)](docs/notes/DISPATCH-LOOP-HANDOFF-2026-06-29.md) — handoff from a session that shipped 26 issues via headless lane-disjoint workers: the paste-ready goal prompt, that session's laws, and a live backlog probe (the adversarial red-team pass was cut by a session limit, so the tooling sketches are proposals, not vetted specs).
- [GLM-5.2 multi-GPU: expert-parallel sharding + the resident-fit benchmark (2026-06-29)](docs/notes/GLM52-EXPERT-PARALLEL-MULTIGPU-2026-06-29.md) — the **expert-parallel (EP) MoE FFN decomposition** for GLM-5.2 is now host-proven on trunk (`internal/model/expert_parallel.go`, `f713391c`): partition the experts across ranks (`ExpertParallelPlan`, a named `TPPlan` over `[0,NumExperts)`), each rank computes only the picks it owns, one `AllReduceSum` of the per-rank `[H]` delta — the cheap MoE-native multi-GPU decomposition `forwardTPSupported()` fails closed on, and the one the overnight cpu-offload data points to (move the expert GEMM off the host onto idle GPUs). The gate triad runs with **no multi-GPU hardware** (`LocalCollective`): `EP(ranks=1)`==routed monolith **max\|Δ\|=0**, collective==rank-order ref **max\|Δ\|=0** (ranks 1/2/4/8), `EP(ranks=N)` cosine 1.0 (~3.7e-9 reassociation drift), + load-imbalance + fail-closed + a GLM shared-expert wrapper on a real `glm_moe_dsa` fixture. Makes the first **benchmark** answerable: the GPU server's **8×80GB = 640 GiB** VRAM (WITNESSED) fits GLM-5.2 UD-Q4_K_M (**433.82 GiB**, ~54 GiB/GPU even shard + replicated dense + KV ≈ 55–60 GiB/GPU < 80, ~20 GiB headroom, COMPUTED) — so **resident EP is feasible by capacity**, the lever past the measured 0.2324 tok/s cpu-offload wall (vs 0.89 tok/s llama.cpp CPU). Honest scope: the primitive is landed but **not yet** wired into the live forward, and a live resident-EP tok/s witness is gated on three rungs — a real cross-DEVICE NCCL/RCCL collective (CUDA still `cudaSetDevice(0)`, `Caps.Collective=false`), EP live-wiring, and a multi-GPU binary on the box (Go absent). The cpu-offload wall stands as the baseline until then.
- [Blackwell-class hardware readiness map (GB200/GB300 NVL72) (2026-06-29)](docs/notes/BLACKWELL-NVL72-READINESS-MAP-2026-06-29.md) — a grounded plan for running fak better on the latest NVIDIA datacenter hardware. Thesis: fak's scale-out architecture is already **NVL72-shaped** — a coherent KV-**pool** plane (`internal/cachemeta/pool.go` `FabricShareable()`), a hardware-aware residency **ladder** (`hardware.go`, HBM→DRAM→NUMA-far→CXL→Disk), a device-**mesh** collective seam (`compute.go` `CollectiveBackend`), and a bit-exact middle-span **evict** that survives paging (`paged_evict.go`, `#33` GO) — but **every one is a stub today** (a cost model, a CPU-ref collective, `cudaSetDevice(0)`, no FP4 enum). A GB300 NVL72 (one coherent **20.7 TB** HBM3e NVLink domain across 72 GPUs + 36 Grace CPUs, **130 TB/s** in-domain NVLink, **NVFP4** at 0.5 B/param, ~900 GB/s Grace coherent memory) is the physical substrate those planes were written against. Maps each Blackwell lever onto the exact seam it lights up (file-anchored, with `[SHIPPED]`/`[SEAM-ONLY]`/`[GAP]` state), names the four contexts where fak's *specific* levers compound (fleet prefix reuse across a coherent domain; demote-not-evict against a 900 GB/s tier; KV disaggregation at 1.8 TB/s NVLink ~18–36× the planned TCP path; the frontier class in-reach as FP4 weights stop dominating HBM and KV governance becomes the scarce resource), resolves the **one load-bearing tension** (NVFP4 vs the bit-exact-evict moat → tier precision per *plane*: FP4 the weights + V + read-K, keep an f32 `Kraw` shadow for governably-evictable spans, the FP4 analogue of the `#1047` Q8-KV choice), and lays a **hardware-ungated-first** rung ladder (R0 FP4+BF16 `Dtype` + cpu-ref oracle, R1 FP4-KV tier the moat survives, R2 model the NVL72 in the cost planes, R3 KV→bytes serializer — all doable now; R5 NVFP4 device GEMM, R6 NCCL device collective, R7 NVLink/RDMA byte mover, R8 the governed mega-pool — Blackwell-gated). Strategic frame: the hardware doesn't make fak a *faster server* (vLLM/SGLang still win tok/s) — it makes fak's **governance** value mandatory, because a 20.7 TB coherent pool shared by a fleet *forces* the cross-tenant-reuse / provable-evict / placement / disaggregation questions only fak answers with attribution. Asserts **no** measured fak number on Blackwell; every figure is a published spec or a labelled MODELED cost-model projection (the `#44` parity-must-be-measured rule still binds).
- [Cache savings in one session: what fak did and didn't (2026-06-29)](docs/notes/SESSION-CACHE-SAVINGS-ABLATION-2026-06-29.md) — ablates a `fak guard` session (`c6723f7c`, 122 turns) three ways — **no cache (~29.65M projected)**, **normal Anthropic cache (~4.15M, −86%)**, **fak guard (~4.15M, identical)** — to make the attribution honest: the `~25.5M input-token-equiv` headline is the **provider's** prompt cache, which fak **prices** (`cache_pricing.go`, OBSERVED not WITNESSED) but cannot move, because passthrough forwards `req.Raw` verbatim and the `cache_control` prefix stays byte-identical. fak's *own* contribution is a sliver of uncached tool-def tokens (tool-floor prune, ~0.1% of headline) and — the real lever — **1,104 bad tool calls stopped before a wasted round-trip** (1,101 repaired, 3 denied); compaction stayed idle. Also answers **"does that mean fak's features aren't on?"** with a HEAD-verified enablement audit — all six token-savers are default-on (`token_defaults.go`-locked) incl. `ctxview`/`elide` (flipped on 06-28/06-26; #927 closed the #555 passthrough gap), but the cache-breakpoint-near-the-end structure leaves fak only a small uncached tail to act on, by design (a referee), not a misconfig. Two-panel [ablation SVG](docs/notes/session-cache-ablation-2026-06-29.svg) + [enablement-status SVG](docs/notes/session-feature-enablement-2026-06-29.svg).
- [Audit: recent fak logs — effectiveness + context fidelity (2026-06-28)](docs/notes/AUDIT-recent-fak-logs-effectiveness-fidelity-2026-06-28.md) — the **operational** companion to the [harness-cache-coherence design audit](docs/notes/HARNESS-CACHE-COHERENCE-AUDIT-2026-06-28.md), driven by the *recent* logs on the clone (`.fak/`). Answers the two questions directly. **(1) How effective?** From today's `recent-feature-dogfood` log: vCache `7.13×` telemetry readiness (one workload, OBSERVED), callavoid `2.46×` turn-amplification, cache-value `63%` realized reuse — but the load-bearing finding is the **honest ceiling**: `internal/cachevalueledger/ledger.go:111-119` hard-codes the only publishable framing as `~1.0× single-session (vs-naive 1/(1-reuse) excluded per #1066)`, and the `--floor 0.751` gate *correctly abstained* because `MinGateTurns=8` and only 5 turns were present. The dogfood's overall `ACTION` verdict comes from two **honest** failures, neither a context fault: a probe that refuses to call a *planned* 2× a *telemetry-witnessed* 2× (`recent_feature_dogfood.py:348-355` requires `active_source=="telemetry"`), and a transient assembler build error (`internal/model/quant_amd64_kquant.s` `CMPQ $0,AX` — green at HEAD when re-checked, so a stale-log artifact). **(2) How do we know it isn't butchering context?** Five tested invariants — verbatim-prefix byte-splice (`anthropic_compact.go`/`anthropic_elide.go`, a turn only counts `fired` if the protected prefix was byte-identical, else `prefix_mismatch`, `metrics.go:104`), bail-to-identity on any ambiguity with a closed reason vocabulary, bounded+marked+never-total elision loss (head+tail, last-4 working set untouched), the witness-gated quarantine moat (`recall.go:18-22`), and single-source WITNESSED/OBSERVED-separated attribution. Names the three **honest fidelity limits** rather than hiding them: KV prefix-elision is admittedly NOT bit-exact (`exact=false`, "a re-RoPE cannot un-see attended history", `kvmmu_elide_test.go:51-76`); the quarantine-survives-harness-summary hole is *detected* (`QuarantineAtRisk`) not fixed; and the `PreCompact` suppression **actuator is not yet wired** (`harness_coherence.go:283`, #1133 open) — fak today *measures* the harness butchering context but does not yet *prevent* it. Verdict: effectiveness REAL-but-fenced (passes net-true-value), fidelity STRONG-by-construction + HONEST-about-the-gaps. The mechanism even acted **live on the auditing session** (a `ctxview`-elided turn + a credential-shaped string paged out, both announced with a stub). Lists three checkable `not yet` follow-ons.
- [Context-safety doctrine (#1218, C1 of epic #1217) (2026-06-28)](docs/notes/context-safety-visuals-tracking-1217.md) — the C1 design note for the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): states the **property** (context safety = value-preservation, the **dual** of the security floor — the security floor proves a *bad* call can't get *in*, this floor proves a *good* call's value doesn't silently get *lost* when fak sheds context, and shows it as a cross-checkable picture, not a number you must trust), grounded in why a single number can't carry it (the measured `ctxplan/signalnoise` cache-hit denominator artifact: 0.88→0.99 mechanically with length). Names the **context-event source of truth** — the hash-chained journal `internal/journal/journal.go:59-90` (`CAP_FAULT | CAP_EVICT | CAP_VERSION_BIND` rows, `Seq`/`PrevHash`/`Hash`/`Witness`, replayable via `Verify`/`VerifyRows`) plus the two secondary sources (`engine/capacity_adapter.go` `CacheEventRecorder`; `cachemeta/kvtransfer.go` `KVTransfer` ok/missed/fault). Decomposes "real retained value" into **four guarantees**, each bound to a real cited witness seam: **G1** bit-identity `max\|Δ\|=0` evict-correctness (`kvcache.go:44-105`; `paged_evict_test.go:84`, `longrope_test.go:179`), **G2** saved-vs-realized reuse-bit + correctness (WITNESSED `fak_gateway_kv_prefix_reused_tokens_total` `cachewitness.go:155` reconciled against `prefix_coherence.go:51`), **G3** S/N + Faults paired (`signalnoise.go` `Ratio()`/`FaultRatio()`/`Grade()` `starving`), **G4** cell-integrity (`recall.PageSyndrome` five-axis digest re-derivation). States the **self-checking-visual doctrine** (A paired-axis / B conservation roll-up / C provenance lane / D re-derivation, generalizing the `RestoreIndex(ix.Image()) == ix` rebuild-and-prove-equal pattern to the rendered visual) and the **honesty fences** (value-preservation kept distinct from the security floor AND the #1147 self-tax plane; WITNESSED/OBSERVED/MODELED never summed; an un-witnessed guarantee is a `not yet` not a result; design-only). Names the honest `not yet` gaps — the re-derivation witness (C9 #1227), the cell-integrity visual surface, the DOS refusal tokens (C13 #1231) — rather than rendering them green. Research/design only; sibling of the C2 failure-mode catalog [#1219](https://github.com/anthony-chaudhary/fak/issues/1219).
- [Context-safety failure-mode catalog (#1219, C2 of epic #1217) (2026-06-28)](docs/notes/context-safety-failure-mode-catalog-1217.md) — the C2 child of the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): every failure the value-preservation plane must surface, each mapped to its **witness** (the journal `Kind` / typed verdict / metric / test that catches it), the visual **primitive** that renders it, and the **cross-check** (paired-axis / conservation roll-up / provenance lane / re-derivation) that goes red on it. Six grounded rows — GDN evict panic (#1143, `RecurrentEvictUnsupportedError` + `fak_bgloop_up`-vs-decode-rate liveness light), evict-on-recurrent refused (the `refused` conservation segment), saved-but-never-reused (the WITNESSED `fak_gateway_kv_prefix_reused_tokens_total` gap chart, never blended with OBSERVED provider `cache_read`), S/N-up-but-faults-up (the `ctxplan/signalnoise` `Ratio()`+`FaultRatio()` `starving` grade), cell rot (#782 `recall.PageSyndrome`'s five-axis digest/quarantine/durability/witness/trust-epoch re-derivation), tier page-down missed (`cachemeta.KVTransfer` ok/missed/fault, ties #985) — each cited to a real `file:line`. Plus two failures with **no closing witness** kept as honest named gaps (rendered-visual-drift → C9/C10; harness-rewrite-defeats-the-shed → the `internal/compactcohere` follow-on), because the doctrine's rule is that a named gap is catalog content and only a *silent* gap is the invisible-destruction failure the epic exists to kill. Research/design only; sibling of the C1 doctrine note [#1218](https://github.com/anthony-chaudhary/fak/issues/1218).
- [Context-safety saved-vs-realized gap (#1221, C4 of epic #1217) (2026-06-28)](docs/notes/context-safety-saved-vs-realized-gap-1217.md) — the C4 value-decomposition spec (MVP slice) for the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the one value-gap that matters — **claimed-saved tokens at page-out time vs later-realized reuse** — built from two WITNESSED taps, **D1** (claimed-saved: journal `CAP_EVICT` row + `internal/engine/cacheevents.go:304-317` `CacheEventRecorder`) and **D2** (realized reuse: `internal/cachewitness` `KVPrefixWitness.ReuseRatio()` `cachewitness.go:155` over `fak_gateway_kv_prefix_reused_tokens_total` `metrics.go:1531`, fed by `cacheobs.Default.Snapshot()`). Specs the `SavedRealizedGap` datum (`Gap = ClaimedSaved - RealizedReused`, the error bar; a positive gap is an over-claim fak never realized), the cross-checks it carries (A paired-axis saved-with-realized + D re-derive both from tamper-evident sources, the C9 checker), and the load-bearing **provenance fence**: the gap is **never blended with the OBSERVED provider `cache_read`** — grounded in the measured cache-hit denominator artifact (`cache_read` climbs to ~1.0 mechanically with length, so a gap built on it would close to zero precisely when the window is most bloated). Binds guarantee G2 of the C1 doctrine (#1218); renders failure F3 of the C2 catalog (#1219); reconciled against the C14 coherence witness (#1232); re-derived by C9 (#1227). Research/design only.
- [Context-safety visual-primitive schemas (#1223, C6 of epic #1217) (2026-06-28)](docs/notes/context-safety-visual-primitive-schemas-1217.md) — the C6 schema spec (MVP slice) for the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the **data schema of each of the six visual primitives** — what each consumes (a real `file:line` witnessed source), its shape (time-series / roll-up / heatmap, **never a single point**), and the cross-check (A/B/C/D) it carries — riding a shared `CtxSafetyPanel` / `PanelPoint` envelope that reuses the `internal/covmatrix:33` `Schema = "fak-coverage-matrix/1"` versioned-payload precedent, the `internal/scoreboard/render.go:41` `FromPayload` text/emoji fallback, and the `internal/cdb/report_html.go:91` `(*Image).HTMLReport` HTML precedent. The six: **(1)** event ribbon (journal `CAP_EVICT`/`CAP_FAULT` + `cacheevents.go` `CacheEventRecorder` + `cachemeta/kvtransfer.go:34-48` `KVTransfer` ok/missed/fault), **(2)** saved-vs-realized gap (C4), **(3)** S/N+Faults strip (`signalnoise.go:69/:81/:249`), **(4)** evict-correctness heatmap (`kvcache.go:44-105` + `recall.PageSyndrome`), **(5)** residency conservation bar (`ctxresidency.go:16-31` `State` + `:39-42` `EvictBlastRadius`), **(6)** liveness light (`fak_bgloop_up` vs decode-rate). The envelope structurally forbids a single trust-me point (every point carries a paired axis, a conservation segment, a provenance lane, and a re-derivability bit). Schemas doctrine A–D of the C1 note (#1218); renders the C2 failures (#1219); rendering *home* is C11 (#1229). Research/design only.
- [Context-safety re-derivation checker (#1227, C9 of epic #1217) (2026-06-28)](docs/notes/context-safety-rederivation-checker-1217.md) — the C9 **keystone** spec (MVP slice) for the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217) — the genuinely missing piece the doctrine names. Specs the **re-derivation checker**: the contract under which a rendered context-safety visual is **RED unless every number on it re-derives from a tamper-evident source**. Today rendering is downstream (Grafana over `/metrics`, Jekyll over scorecard JSON) and **never re-validates after render** (C2 gap G-A). Generalizes the in-tree **rebuild-and-prove-equal** discipline — `internal/ctxplan/image.go:61-76` proves `RestoreIndex(ix.Image()) == ix` for the *index* (`image_test.go:18` `TestIndexImageRoundTripIsIdentity`) — from the index to the **rendered visual** (the one analog the tree lacks). Enumerates the tamper-evident sources the checker is restricted to (the hash-chained journal `journal.go` `Verify`/`VerifyRows` `:577`/`:619`; the WITNESSED `/metrics` family; git via `dos commit-audit`; disk CAS digests via `recall.PageSyndromeFor`), the `RederivationVerdict` / `NumberCheck` contract (every number checked, GREEN only on equality-within-tolerance against a tamper-evident re-derivation, one RED/REFUSED number reds the whole visual), and the structured refusal a non-re-derivable number emits instead of an unearned OK (`SAFETY_UNRECOVERED` / `VALUE_UNRECONCILED` / `SAFETY_UNWITNESSED`, C13 #1231). Lifts four shipped precedents (`image.go`, journal `Verify`, `check_memory.py`, `dispatch_status.py` strict diff-witnessed, the `metrics.go` `proven` vCache gate). CI-gate sibling is C10 (#1228). Research/design only.
- [Context-safety reuse-correctness witness (#1232, C14 of epic #1217) (2026-06-28)](docs/notes/context-safety-reuse-correctness-witness-1217.md) — the C14 second-derivation spec for the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the reuse-**correctness** witness that the C4 saved-vs-realized reuse **count** must reconcile against, so a high reuse count over a *broken* prefix is caught as value that only looks real. Binds two existing fail-closed `internal/cachemeta` verdicts — `prefix_coherence.go:51` `EvaluatePrefixCoherence(...) PrefixBreakDirective` (uncertainty → break the prefix, never an optimistic "probably fine") + `prefix_stability.go:193` `StabilityReport` (produced by `AnalyzeStability` `:203`) — as the second derivation, and states the reconciliation rule `Reconciled ⟺ (RealizedReused == 0) ∨ (Coherent ∧ Stable)`: a non-zero realized-reuse count is credited only if the reused prefix is coherent AND stable, else the gap panel refuses green with `VALUE_UNRECONCILED` (C13). Honest gap named: the count (`cachewitness`/`cacheobs`) and the coherence/stability verdicts are computed on separate paths and **never compared today** — that comparison is the witness this note specs. Deepens guarantee G2(b) of the C1 doctrine (#1218); reconciliation partner of the C4 gap (#1221). Research/design only.
- [Context-safety DOS refusal tokens (#1231, C13 of epic #1217) (2026-06-28)](docs/notes/context-safety-dos-refusal-tokens-1217.md) — the C13 structured-refusal spec for the context-safety epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the three new `dos.toml [reasons]` tokens a panel emits to **refuse green with a verifiable reason** instead of rendering an unearned OK — `SAFETY_UNRECOVERED` (a context-removal event with no tamper-evident journal row), `VALUE_UNRECONCILED` (the reuse count credits value the C14 coherence/stability witness refutes), `SAFETY_UNWITNESSED` (a rendered number with no tamper-evident source). Each gets a category / refusal / summary / fix / see_also and an **oracle condition** an independent check (C9 / C14) decides — verified against the live `dos_refuse_reasons` schema and fak's `L3_PAGE_DIGEST_MISMATCH` verify-rung precedent. Witnessed gap as the anchor: all three return `known=false, UNCLASSIFIED` via `dos_check_reason` today, so a panel cannot emit them until declared; the TOML sketch matches the real `[reasons.*]` grammar (`dos.toml:424/445`). The refusal vocabulary the C9 checker (#1227) + C4 gap (#1221) + C14 reconciliation (#1232) emit. Research/design only.
- [Context-safety bit-identity evict-correctness signal (#1220, C3 of epic #1217) (2026-06-28)](docs/notes/context-safety-bit-identity-evict-correctness-1217.md) — the C3 spec for guarantee **G1** of epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the bit-identity (`max|Δ|=0`) evict-correctness signal as a per-EVENT witnessed datum feeding primitive (4), the evict-correctness heatmap. The guarantee ALREADY EXISTS and is ALREADY TESTED — the job is to SURFACE and cross-check it, not invent a new compute claim. Binds the typed boundary `internal/model/kvcache.go` (`RecurrentEvictUnsupportedError` :54 / `CanEvict` :71 / `Evict` :94 / `TryEvict` :105) and the two existing bit-identity tests `paged_evict_test.go:84` `TestPagedEvictBitIdenticalToContiguous` (mid-span `[2,5)` evict on a non-block-aligned page table is byte-for-byte identical to the contiguous Evict — cache AND next-token logits) + `longrope_test.go:179` `TestLongropeEvictEqualsNeverSaw`. Cross-check C + D (the number 0 proves its own correctness; re-derive against the test/verdict). Every citation adversarially verified. Surfaces guarantee G1; renders into the C6 heatmap (#1223). Research/design only.
- [Context-safety S/N + Faults paired series (#1222, C5 of epic #1217) (2026-06-28)](docs/notes/context-safety-sn-faults-paired-series-1217.md) — the C5 spec for guarantee **G3** of epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the signal-to-noise + Faults PAIRED time-series (not the current single point read) feeding primitive (3). The point: a shed that RAISES S/N by STARVING the turn (eliding spans then demand-paging them back as faults) is value destruction wearing a cleanup costume, and a single-axis "S/N improved" visual is a lie by construction — so the two orthogonal axes are charted TOGETHER. Binds `internal/ctxplan/signalnoise.go` `Ratio()` :69 (caching/length-invariant signal axis) + `FaultRatio()` :81 (orthogonal under-resident axis) + `Grade()` :249-261 (lean/ok/bloated/**starving**), over `SignalNoise` (token-count fields :44-56, `UnaccountedTokens` kept in the denominator :48-51 so the ratio can't over-claim) computed from `ctxplan.Outcome` (`learn.go:25-29`, span-ID slices). Cross-check A (S/N WITH Faults — raise-S/N-by-starving spikes the visible Faults lane) + B + D; the `starving` grade is the named failure verdict (witnessed by `signalnoise_test.go:89`). Citations adversarially verified. Renders C2 failure F4 (#1219). Research/design only.
- [Context-safety conservation roll-up contract (#1224, C7 of epic #1217) (2026-06-28)](docs/notes/context-safety-conservation-rollup-1217.md) — the C7 spec for doctrine mechanism **B** of epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the conservation roll-up feeding primitive (5), the residency conservation bar. The contract: a roll-up whose segments are WITNESSED sub-counts that MUST sum to the total — resident = signal + noise + unaccounted; evicted = bit-clean + reset + refused — so if the segments don't sum the visual is VISIBLY broken (the eye does the check, no second tool). Binds `internal/ctxplan/signalnoise.go` (`UnaccountedTokens` in the denominator :48-51, `ResidentTokens` as the sum :57-59 so it can't over-claim) + `internal/ctxresidency/ctxresidency.go` (`State` :16-31 resident/evictable/held, `BlastRadius{Tokens,DependentEntries}` :39-42, `Snapshot` roll-up :73-89). The `refused` evicted-segment ties to C2 failure F2 + `serve --reset-on-budget` (`cmd/fak/serve.go:110`). Specs the `ConservationRollup` datum + the RED-on-mismatch (sum≠total) rule. Citations adversarially verified (no fixes needed). Doctrine B; primitive 5. Research/design only.
- [Context-safety CI gate (#1228, C10 of epic #1217) (2026-06-28)](docs/notes/context-safety-ci-gate-1217.md) — the C10 spec for epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the build-time enforcement that reds `make ci` when a shipped visual's numbers stop re-deriving — turning C9's per-visual `RederivationVerdict` into a green gate. The load-bearing fence (#1228's core ask): **do not red on noise** — a single transient scrape skew is one tick and is never the build verdict; only a PERSISTENT mismatch reds, via a consecutive-streak / change-point rule lifted from `internal/loopmgr/restart.go` (`MaxAttempts` + `ResetAfter` clear window) and `internal/rsiloop/metarsi.go` (`Window:20, MinEscalations:2`). Specs the `CIGateVerdict` (one green tick clears the streak; a RED streak ≥ `Threshold` reds; any one persistently-RED visual reds the conservative roll-up) and the build wiring (a `*_test.go` folded by `go test ./...` — the `architest`/`pythongate`/`windowgate` shape — or a `scorecard-ratchet` `--check` like `covmatrix` `growth_debt`, `Makefile:229-233`, mirrored into `scripts/ci.ps1`). Consumes only C9 verdicts (zero new trust); emits the C13 DOS tokens / `CTX_SAFETY_VISUAL_DRIFT`. Stale Makefile line-refs adversarially corrected. Closes doctrine D + C2 gap G-A (#1219) at the build boundary. Research/design only.
- [Context-safety debug-window surface (#1229, C11 of epic #1217) (2026-06-28)](docs/notes/context-safety-debug-window-surface-1217.md) — the C11 surface spec for epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the HOME the C6 schemas asked for — where the six visual primitives live as panels, the data each binds to, and the read route each scrapes — landing a concrete instance into the generic #196 (Performance Dashboards) placeholder by hanging the panels off the context debugger `cmd/fak/debug.go:20-25` (the surface that attaches to a finished session and answers `context-query` / `context-diff` / `--prefer-view summary`). Specs the panel wireframe + per-panel data binding (cross-ref the C6 schemas, #1223) + the read route (`/metrics` `handleMetrics` `internal/gateway/metrics.go:1041`, `/debug/vars` `handleDebugVars` `debug.go:286-291`, registered in `http.go` `routeTable():51`), and the `(*Image).HTMLReport` (`cdb/report_html.go:91`) + `scoreboard/render.go:41` `FromPayload` render precedents. Defers RENDERING to C6 and re-derivation to C9. Citations adversarially verified (`routeTable()` line corrected). Owns placement + binding. Research/design only.
- [Context-safety liveness-contradiction light (#1230, C12 of epic #1217) (2026-06-28)](docs/notes/context-safety-liveness-light-1217.md) — the C12 spec for primitive (6) of epic [#1217](https://github.com/anthony-chaudhary/fak/issues/1217): the liveness-contradiction light that catches the #1143 "healthy but serving nothing" failure (GDN evict panic: `/healthz` answers 200 but every decode hangs). Reuses the #750 two-heartbeat oracle: the liveness pulse `fak_bgloop_up` (`internal/gateway/bgloops.go:227-234`) vs the decode-throughput `fak_gateway_inference_decode_tokens_per_second` (`metrics.go:1970-1975`, fall-to-0 :1968), RED when `/healthz`=up disagrees with decode-rate=0. Binds `*model.RecurrentEvictUnsupportedError` (`kvcache.go:54`) + `recoverRecurrentEvictUnsupported` (`gateway.go:1266`, wired into the deferred recover :1216) + the `deriveState` DARK fold (`loopmgr/health.go:281-312`, ticked-but-stale). Cross-check A (up vs throughput=0) + D (re-derive both from their metrics). Citations adversarially verified — the draft's `fak_bgloop_up` wrong-file (metrics.go→bgloops.go) and an `AdmittedTurns` over-claim (→ `fak_sched_admitted_total` `admission.go:507`) were caught and fixed. Renders C2 failure F1. Research/design only.
- [The agent programming grammar — lifting fak's invariants into a domain-free substrate (2026-06-28)](docs/notes/CONCEPT-AGENT-PROGRAMMING-GRAMMAR-2026-06-28.md) — the "express + generalize" half of the innovations survey: fak's contribution is one invariant (*a decision no participant can move by narrating a number*) carried at every scale, not any single primitive (0/29 novel). Extracts that invariant as a reusable **grammar** — nouns (lane, lease, reason token, witness, verdict, claim, ladder rung, scope) and verbs (arbitrate, verify, audit, review, refuse, recall, resolve, status) — names the ~10 fak concepts already lifted into the domain-free DOS form, the two structural shapes a correct primitive obeys (the verification ladder; the security==optimization two lenses), and scopes the **under-expressed** concepts (`G1–G9`: readiness ladder, verification-ladder verb, durability-class promotion, materialized-view context contract, prediction-vs-reality calibration, one-sided-screen polarity, taint-check, per-aspect routing, net-true-value claim-check) as the next grammar verbs. The companion of the durable [innovations index](docs/INNOVATIONS-INDEX.md); actioned by the grammar epic.
- [The feature-maturity lifecycle ladder — completeness is not maturity, and every gap is the next work item (2026-06-29)](docs/notes/CONCEPT-MATURITY-LADDER-2026-06-29.md) — the **shipped** subsystem for the long-horizon "agentic culture" problem: a v1 prototype can be legitimately *complete* yet not tested, not dogfooded, not benchmarked, not the default — and the operator should SEE where each capability sits and what would mature it next. [`internal/maturity`](internal/maturity) places every declared fak capability (one per `internal/<leaf>` lane in [`dos.toml`](dos.toml) `[lanes.trees]`) on a closed lifecycle ladder — `proposed → prototyped → tested → dogfooded → default` (with a `benchmarked` badge) — each rung gated by evidence the author did not write (code on disk, a `*_test.go`, an edge in the running binary's transitive import graph, a documented verb), so a rung moves only by changing the real tree. **Immaturity is never a defect** (a complete v1 honestly sitting at `prototyped` is expected); the one thing it refuses is a **ladder-skip** — a capability fak relies on yet leaves untested (`maturity_debt`, the maturity sibling of the readiness ladder's `READINESS_OVERCLAIM`). For each capability the first unmet rung is rendered as a concrete **next work item**, and `fak maturity next` is the ranked backlog the issue-dispatch loop pulls from — the mechanization of "each agent has the desire to create the next ticket." The shipped fak-tree binding of grammar [G1 / the readiness ladder](docs/notes/CONCEPT-AGENT-PROGRAMMING-GRAMMAR-2026-06-28.md); first dogfood run over fak's own 109 lanes: index 78/100, 0 ladder-skips, 18 tested-but-not-dogfooded.
- [Complain by default — the agentic-dev friction channels and when to use each (2026-06-29)](docs/notes/CONCEPT-AGENT-FRICTION-COMPLAINT-CHANNELS-2026-06-29.md) — a playbook for the `/goal` "improve the default ability for agents to complain about annoying agentic-dev things": friction that no agent records stays trapped in per-agent private memory and is re-discovered by the next agent, so the default response to a papercut should be to register it through a structured, **deduplicating** channel that is part of the repo. Names a closed, evidence-grounded **friction taxonomy** (`shared-tree-clobber`, `red-trunk`, `stamp-refusal`, `push-blocked`, `saturated-box`, `tool-timeout`, `lane-collision`, `guard-false-positive`, `confusing-refusal`, `phantom-artifact`) and routes each to the channel that fits *who acts and how fast* — operator/status surfacing via `fak blockers post|feed` (shipped), the capability-floor **appeal** that must carry the witnessed journal verdict (`internal/guardcomplaint`; the `fak complain` dispatch is `not yet` wired — mid-rework on the shared tree), the DOS closed **refusal vocabulary** (`dos_refuse_reasons`/`dos_check_reason`) to decline green with a verifiable reason, and the `internal/dogfoodissues` dedup/escalate fold for recurring process friction. Four rules for complaining as signal not noise (structured+deduped, carry a witness not a feeling, name the recovery you wanted, route by who acts). Companion of the [agent programming grammar](docs/notes/CONCEPT-AGENT-PROGRAMMING-GRAMMAR-2026-06-28.md); the `not yet` half (wire the verb + a `workflow`/`dev` domain) is the next checkable step.
- [Affordable-hardware agent fleets — the doable tier, and what shows it (2026-06-28)](docs/notes/AFFORDABLE-HARDWARE-AGENT-FLEETS-2026-06-28.md) — a strategy/framing + showable-demo map for running **multiple** coding agents **safely** on hardware a small team can afford (one big-RAM CPU box, one or a few older datacenter GPU/Ampere GPUs, a gaming GPU, or a Mac), including overnight/offline. Thesis: the agent fleet is the workload where affordable hardware wins, because it is latency-tolerant (batch it overnight), prefix-heavy (pay the setup once), and unattended (so trust, not tok/s, binds). Separates the **witnessed-today** tier (sub-frontier ≤27B — the 27B @64–128-concurrency curve, the 4070 862-agg-tok/s batch, the Mac 4.1× fleet stack, the 1,024-agent CPU `fanrun`, the GPU-free `fleet-reuse-demo`) from the **honest not-yet** (frontier 753B GLM-5.2 on CPU-offload at sub-1 tok/s — the #971 host-expert wall; TPU = no backend), and ties each tier to the specific fak lever (RadixAttention prefix reuse, continuous batching, resident-Q4_K, capacity preflight) and safety rail (default-deny capabilities, `dos_arbitrate` disjoint lanes, commit-audit, quarantine) that makes it usable. Every measured number cited to its authority row; every projection labeled.
- [Desktop slowness maintenance runbook — sprawl, not resources, on the fleet workstation (2026-06-28)](docs/notes/DESKTOP-SLOWNESS-MAINTENANCE-2026-06-28.md) — why the workstation "feels slow" is not resource exhaustion (CPU ~32%, RAM 25% used, disk queue 0, no thermal throttle) but two reboot-cleared accumulations: one WindowsTerminal rendering all fleet panes (2.2 GB / 14.7k handles) and a growing TermService/RDP handle leak (2.5 → 3.0 GB within a single session). Records the reboot cadence, the Defender build-tree exclusion command, and the verified do-NOT list (do not bulk-kill "idle" python/pwsh — they are live DOS-MCP/session workers, classified by parent liveness; do not clear the shared ~18 GB go-build cache).
- [D-006 (#243) Tool Ecosystem Expansion — architecture-fit decision + honest status (2026-06-28)](docs/notes/D-006-TOOL-ECOSYSTEM-ARCH-FIT-243-2026-06-28.md) — discharges the [#304 tracker](docs/notes/track-d-agent-framework-parity-tracking-304.md)'s deferred "decide the architecture fit first" step for [#243](https://github.com/anthony-chaudhary/fak/issues/243): fak's tool ecosystem is **gate-native, not provider-native**. Decides it on on-disk evidence — fak already ships the confined, kernel-routed `fak_read` built-in (#795) plus the `readOnly`/`idempotent`/`destructive` safety-annotation layer (`metaFor`) — so the tracker's "🔴 Not implemented" D-006 row is now 🟡 partial (read + annotation layer shipped; glob/write/HTTP/DB built-ins not). Reframes the LangChain-shaped acceptance, names the single open gate (the unbuilt boxes + the 20-tool target), and scopes the smallest next leaf (`fak_glob`: read-only, confined, mirrors `fak_read`). Honest: a decision note does not tick the feature boxes, so #243's literal acceptance stays open pending re-scope or the multi-day build.
- [fak guard SECRET_EXFIL audit — banner clarity + version build-provenance (2026-06-28)](docs/notes/AUDIT-fak-guard-secret-exfil-2026-06-28.md) — the audit behind 06179a0c: the SECRET_EXFIL quarantine banner is current HEAD behavior (default-on normgate), not a stale binary; `fak version` now stamps the binary's VCS revision so a stale binary is detectable; the inbound-quarantine banner was rewritten to plain-language, non-alarming text. Documents the over-firing detector (witnessed on the kernel's own source) and the more-permissive-detection options, leaving the tested secrets-are-absolute-by-source stance as an explicit maintainer decision.
- [Two cache stacks, one wire — fak's cache concepts vs the agent harness's, and do we disable Claude Code auto-compaction? (#1131) (2026-06-28)](docs/notes/HARNESS-CACHE-COHERENCE-AUDIT-2026-06-28.md) — audit of the coherence between fak's cache/context machinery (cache-preserving compaction #745, budget reset / cut-vs-reset #774, prompt-MMU #751, ctxmmu quarantine, paged-KV evict, cachemeta prefix-stability/coherence) and the agent harness's OWN machinery (Claude Code auto-compaction, `cache_control` prompt-cache, ~5-min TTL). Names the interference matrix: the two managers stack blind to each other — fak is cache-**preserving**, the harness's auto-compaction is cache-**destroying** (it rewrites the `cache_control` prefix, bursting the cache fak just preserved) and can defeat a quarantine by folding a sealed span into its summary. Answers the explicit question with evidence: Claude Code auto-compaction **cannot be reliably disabled via settings/env** (the toggle is silently ignored; threshold clamped ~83%; anthropics/claude-code #38483/#42817/#42149) — the one dependable lever is a **`PreCompact` hook (exit 2)**, so the answer is a conditional protocol (**block** while fak copes, **allow** when fak's compaction bails, **reset** past TTL), not a flag flip. Lands the spine [`internal/compactcohere`](internal/compactcohere/compactcohere.go): a pure tier-1 sensor that attributes a per-turn prefix event (`stable`/`fak_cut`/`fak_world_break`/`harness_rewrite`/`cold_ttl`) + a standing block/allow PreCompact posture, reusing `cachemeta` divergence rather than duplicating it. Actuators (gateway wiring, the guard hook, the quarantine-survival witness) are the epic.
- [Ultracode dogfood — a 9-agent fleet advancing Qwen3.6 parity (2026-06-28)](docs/notes/ULTRACODE-DOGFOOD-QWEN36-PARITY-2026-06-28.md) — a measured session record of fak's *ultracode* (multi-agent) mode run as two concurrent waves (4 production + 5 verification agents on disjoint file lanes) against the Qwen3.6-27B-vs-llama.cpp parity goal: 8 independent reviewed deliverables, ~48 min of agent labor compressed into ~20 min agent-phase wall-clock (**2.38× wall-clock / 8× deliverable-count**), with the agent-orchestration multiple fenced strictly apart from fak's separate **inference** 5–10x (different axis, cited never blended). Links the parity rollup ([`QWEN36-PARITY-ROLLUP-2026-06-28`](docs/benchmarks/QWEN36-PARITY-ROLLUP-2026-06-28.md)), the [token-3 drift investigation](experiments/qwen36/token3-drift-investigation-2026-06-28.md), the [one-command Mac gate](tools/qwen36_mac_parity_gate.sh), the [ultracode-mode explainer](docs/explainers/ultracode-multi-agent-dogfood.md), and the [machine-readable witness](experiments/agent-live/ultracode-dogfood-witness-20260628.json).
- [Evict-on-paged KV — the bit-exact middle-span Evict survives a block-paged layout (#33) (2026-06-28)](docs/notes/EVICT-ON-PAGED-KV-DESIGN-2026-06-28.md) — design + prototype proof for [#33](https://github.com/anthony-chaudhary/fak/issues/33) (the gate before the native paged allocator [#34](https://github.com/anthony-chaudhary/fak/issues/34) and the L3 governance referee [#27](https://github.com/anthony-chaudhary/fak/issues/27)). Verdict **GO**: fak's kernel-owned, bit-exact middle-span `KVCache.Evict` carries forward onto a block-paged layout because the single-rotation re-RoPE of a shifted survivor depends only on its pre-RoPE `Kraw` and its **new logical position**, not on physical contiguity. Two requirements proven on real float32 KV with no GPU: the paged blocks must carry a per-token `Kraw` plane (the shipped #277 allocator stored only K/V — `NewPagedKVPoolWithRaw` adds it), and a survivor re-RoPE must copy-on-write-split any shared block before mutating K. A mid-span evict on a deliberately non-contiguous page table is **byte-for-byte identical** to the contiguous `Evict` (cache **and** next-token logits, `max|Δ|=0` on amd64), and a COW-forked sibling is left untouched (`internal/model/paged_evict.go`, `internal/model/paged_evict_test.go`). Names the honest cost (an intra-block compaction on middle-span evict, which vLLM/SGLang avoid only because they cannot evict a middle span at all), the FP8/INT8-KV decision (keep `Kraw` f32 per [#1047](https://github.com/anthony-chaudhary/fak/issues/1047); defer quantized-K-with-exact-span), and scopes the GLM-DSA path out with reason (its `glm.rerotateSurvivor` follows the identical new-logical-index re-derivation; carrying the DSA state onto blocks is #34's job).
- [`L3RegionBackend` — child B of epic #79, designed behind the frozen `Ref`/`Resolver`/`RegionBackend` seam (#55) (2026-06-28)](docs/notes/L3REGIONBACKEND-CHILD-B-DESIGN-55-2026-06-28.md) — the `design(` artifact for [#55](https://github.com/anthony-chaudhary/fak/issues/55) (Option B): the interface, span→page-key contract, resolve/page-in/page-out/evict lifecycle, G2 middle-eviction fold, and G3 deletion-certificate tier-projection that unlock **G2** (evict a poisoned span from the *middle* of pages shared across sequences) and native **G3** (attest the *L3 pages* were destroyed, not just the local copy) — neither reachable from a control-path-only sidecar. Specifies `L3RegionBackend` as a **backend swap** under the frozen `abi.RegionBackend` seam (`internal/abi/registry.go:609`) with **no ABI edit**, each method named against the external store's `mget`/`mset`/evict, the per-page `Ref.Digest` verify stated as a **fail-closed** page-in admission gate (G1), `evict(from,n)` mapped through fak-owned `KVCache.Evict` re-rotation (bit-exact `max|Δ|=0` survivors) to an L3 page-key delete + re-key, and `deletioncert.Mint` folded to attest the L3 page-key set offline-verifiably. Honest spine: the in-kernel engine (v0.2) OR a co-residence handshake is a **HARD [GAP] ~120h-class precondition**, the design stays on the **control path** (§6.5: opt-in admission verify, not an inline per-RDMA-read byte-scan; ~1–5 µs L3 read budget named), the staged plan gates run on a **mock/local** L3 (real-store wire optional/follow-on), it composes with [#493](https://github.com/anthony-chaudhary/fak/issues/493) (network `StageTransport`) for the multi-node case, and the whole backend is **gated behind Option A** (the referee sidecar) proving the seam first. The design row [`L3-DISAGGREGATED-CACHE-REIMAGINED`](docs/notes/L3-DISAGGREGATED-CACHE-REIMAGINED.md) (epic [#79](https://github.com/anthony-chaudhary/fak/issues/79)) labelled "child B".
- [Frontier agent leaderboard survey (#1068) (2026-06-27)](docs/notes/AGENTIC-LEADERBOARD-SURVEY-1068-2026-06-27.md) — surveys the frontier agent / tool-use leaderboards to choose the external benchmark fak measures itself against for [#1068](https://github.com/anthony-chaudhary/fak/issues/1068); recommendation: BFCL V4.
- [Combinatorial-growth epic — a stable core as models × backends × features multiply (#1079) (2026-06-27)](docs/notes/COMBINATORIAL-GROWTH-EPIC-2026-06-27.md) — the decomposition for [#1079](https://github.com/anthony-chaudhary/fak/issues/1079): fak's correctness cross-product (16 model families × 4 backends × the perf-feature set) is tracked by hand-written prose that rots (#487's grid opens with "the epic thesis is stale") and by oracle tests that SKIP in CI, leaving 12 `requirePreNorm` panic cells and 87 boundary markers invisible. Frames five children that make growth legible and gated without a core edit or a brittle weight-backed test: C1 #1080 (generate the support matrix FROM the tree + a `growth_debt` metric in the existing control-pane), C2 #1081 (a weight-free per-family conformance contract that actually runs in CI), C3 #1082 (`fak new-model` leaf scaffold), C4 #1083 (a researcher experiment registry), C5 #1084 (the growth-gardening cadence + the stable-core ritual). Distinct from `steerability` (structure), `industry-scorecard`/#1050 (the field), and #487 (building the seam) — this owns the seam between them.
- [score-signal autonomous live-filing posture (#980) (2026-06-27)](docs/notes/SCORE-SIGNAL-AUTO-ARM-2026-06-27.md) — the operator decision (full flip to `--live` on the daily schedule) that makes the score-signal feeder file tickets without a human, and why it is safe: the storm bound is the feeder's own label-scoped dedup + worst-first cap + refresh-not-re-file (#981), not a human in the loop.
- [Dojo `cross_session_warm_hit_rate` is bimodal by workload (#963) (2026-06-26)](docs/notes/DOJO-WARM-HIT-BIMODAL-963-2026-06-26.md) — resolution note for [#963](https://github.com/anthony-chaudhary/fak/issues/963): the `fak dojo` resume-posture lever's warm-hit claim (a fixed 0.17) is bimodal by workload — realized 0.65 on a long-running dev tree (`C--work-fak`, UNDER_CLAIM) and ~0.00 on batch corpora (`C--work-job`, `C--work-Benchmark`, OVER_CLAIM), while the sibling `cold_write_share`/`posture_accuracy` claims calibrate fine. Records the shipped increment (claim recalibrated 0.17 → 0.0 as the conservative never-over-claim lower bound in `f306cfb9`/`265ce039`, plus the duplicate-`registerDojoLevers` build fix in `76bc0806`) and the deliberately deferred follow-on (option 2: report `cross_session_warm_hit_rate` as an OBSERVED spread excluded from the calibration grade, which needs an `internal/dojo` report-only verdict plus `cmd/fak/dojo.go` wiring).

- [Verified resume packet — sourcing the checkpoint from witnessed state (#636) (2026-06-26)](docs/notes/VERIFIED-RESUME-PACKET-CHECKPOINT-2026-06-26.md) — design note for [#636](https://github.com/anthony-chaudhary/fak/issues/636): make `tools/session_checkpoint.py` a **verified, resumable packet** instead of a self-reported git-snapshot note. Sketches the `fak-session-checkpoint/2` schema that demotes the free-text `in_flight` line to a fallback and adds a `witnessed` block (the `dos_status` `{liveness, progress, region, resume}` digest — which has no `claimed` field by construction — plus the last *N* `trajectory.Turn` verdict rows for the active trace) and an agent-facing `resume` block. Specifies the fail-soft consume path (`--witnessed --run-id … [--corpus …]`, degrading cleanly to v1) and the exact three things a fresh/cloud session needs to continue (region = held lease, last witnessed phase = ledger-VERIFIED rung + verdict tail, context pointer = the transcript path today / a digest-addressed `abi.RegisterKVBackend` KV span next). Names the flag-gated code fold as the `tools`-lane follow-on (per `AGENTS.md`, its end-state is a Go `fak checkpoint` with the Python script as reference consumer).
- [Agent-OS scheduling SOTA readout: lease, heartbeat, fence, schedule, autoscale (#906) (2026-06-26)](docs/notes/ORCHESTRATION-LEASE-HEARTBEAT-SCHEDULE-SOTA-2026-06-26.md) — research/SOTA readout for [#906](https://github.com/anthony-chaudhary/fak/issues/906): maps Kubernetes Lease + leaderelection, Temporal heartbeats, Argo Workflows synchronization, and Ray Serve autoscaling against fak's current loopmgr/lease/heartbeat seams with file:line citations, keeping the five decisions distinct (heartbeat = liveness, lease = admission, fence = stale-write rejection, schedule = overlap policy, autoscale = fair reallocation). Answers the issue's five questions from the tree (`leaseref.Record` is the cross-machine lease object — owner/acquired-at/TTL/target, no renew or fencing token; the witness rung grades *done* not *alive*; the governor is cadence/back-pressure not an overlap policy) and names the concrete gaps as children: no fencing/generation token on `leaseref.Record`, a defined-but-unproduced loop `heartbeat` event ([#750](https://github.com/anthony-chaudhary/fak/issues/750)), and no skip/queue/coalesce/replace overlap policy distinct from the cadence floor.
- [Backend SOTA matrix: where fak should borrow, bind, or stay minimal (#905) (2026-06-26)](docs/notes/RESEARCH-backend-sota-matrix-2026-06-26.md) — inward engineering map for [#905](https://github.com/anthony-chaudhary/fak/issues/905): for each compute operation fak's kernel actually performs, records the current fak path (verified against the tree), the production kernel stack to learn from (CUTLASS/FlashInfer/TRT-LLM/Marlin/AWQ), the candidate integration route (borrow/bind/stay minimal), the verification oracle, and the expected bottleneck. Selects the AWQ CUDA witness gap as the falsifiable next optimization target; honest about the one gate this environment cannot reach.
- [Structured-output decoding for schema-valid tool-call candidates (#907) (2026-06-26)](docs/notes/RESEARCH-structured-output-decoding-2026-06-26.md) — guided-decoding SOTA readout + field map for [#907](https://github.com/anthony-chaudhary/fak/issues/907): the current structured-output engines (vLLM/SGLang `response_format`/`guided_*`/`json_schema`, XGrammar/llguidance/Outlines as the mask backends) with docs linked, and a field map from every constraint surface (OpenAI `response_format`/`logit_bias`, vLLM/SGLang guided fields, Anthropic/MCP tool schema, fak `grammar.Grammar`) onto **one canonical internal shape** — `grammar.Grammar` → `oneOf` JSON Schema → the `response_format` carrier (ride mode) or a logit mask (native). Wires the **ride-mode passthrough** the issue asked for: the OpenAI proxy now forwards `response_format`/`logit_bias` to the ride engine verbatim and adjudicates the constrained candidate after generation (`internal/gateway/structured_output_passthrough_test.go`, GPU-free, bit-exact-off when absent). Native sampler (logit-bias first, schema mask flagged, bit-exact-off acceptance) is filed as [#929](https://github.com/anthony-chaudhary/fak/issues/929); builds on [#469](https://github.com/anthony-chaudhary/fak/issues/469)/[#560](https://github.com/anthony-chaudhary/fak/issues/560).
- [Resume & rehome runbook — restarting rate-limit-crashed Claude sessions (2026-06-26)](docs/notes/RESUME-REHOME-RUNBOOK-2026-06-26.md) — the durable procedure + tool index for restarting rate-limit-crashed Claude Code sessions: the four-stage pipeline (`resume_sweep` discover → `fleet_sessions registry --probe` plan → `fleet_resume_watchdog --live` launch → `resume_relaunch_audit` verify), the two gates that make a fresh account an admissible rehome target (a `projects/` marker + a live probe for positive-evidence — the day26 lesson), why the "organization has disabled subscription access" banner is the token-twin smear and not org policy, the inter-launch-spacing fix (`FAK_LAUNCH_SPACING_SEC`) that stops a resume burst self-congesting on a transient 529, and the failure-class disposition (API_ERR self-heals, LIMIT defers to reset, AUTH needs login/rehome). Names the Go port (`fak resume`) as the next step — the tools are frozen Python. — inward engineering map for issue #905: for each compute operation fak actually performs, records the current path, production kernel stack to learn from, integration route, verification oracle, and expected bottleneck; selects the AWQ CUDA witness gap as a falsifiable next optimization target without claiming it shipped.
- [The top unscored surfaces — a scorecard-coverage gap map (2026-06-26)](docs/notes/SCORECARD-COVERAGE-GAPS-2026-06-26.md) — backlog of high-value deterministic scorecards not yet folded into the control pane, anchored by the shipped skill-effectiveness scorecard and ranked across type contracts, refusal taxonomy, benchmark catalog, witness completeness, integration coverage, lint coverage, SLAs, metrics, examples, and migrations.
- [Typed virtual views with provenance gates — the memory-view contract (#904) (2026-06-26)](docs/notes/MEMORY-VIEW-CONTRACT-2026-06-26.md) — research/SOTA readout + design note for issue #904: a memory/context cell is CANONICAL (the raw bytes), and every summary/QA/graph/prompt-prefix/KV-prefix projection is a DERIVED `MemoryViewRecord` (`internal/memview`) that binds to its source by a sha256 digest + byte span, inherits the source taint, carries an `abi.Verdict` admission gate, and re-enters adjudication before any effect. Surveys seven primary sources (MemGPT/MemOS/Mem0/GraphRAG/LightRAG/HippoRAG/A-MEM), maps the prompt-MMU/recall/vcachechain/ctxplan/ctxmmu leaves onto the view table, and fences exact lossless prompt/KV reuse apart from lossy semantic views. One lossless view (snippet) is materialized from raw bytes and invalidated on a source-digest change (test-witnessed green).
- [Coding as a primary use case — scorecard + next-steps spine (2026-06-26)](docs/notes/CODING-USE-CASE-SCORECARD-2026-06-26.md) — steps through all 29 examples from a coding-agent lens (the floors are solid; the demos are mostly generic-capability proofs — no re-runnable "coding agent behind `fak guard`" demo yet, the open #318/#344/#321/#632 cluster) and grades the use case across five dimensions: **adopt A−** (`fak guard -- claude` one command, 38/44 harnesses repointable), **floor B+** (deny-by-structure gitgate + self-modify globs, proven by tests not a demo), **cost C+** (cache-preserving compaction dogfooded at 95% shed / byte-identical prefix but on a **mock** upstream — cascade-on-real-traffic unverified, [#745](https://github.com/anthony-chaudhary/fak/issues/745)), **witness D+** (zero measured raw-vs-fak coding result; SWE-bench `pass_rate=0` GPU-gated; Terminal-Bench all contract-phase, [#897](https://github.com/anthony-chaudhary/fak/issues/897)), **in-kernel B−** (argmax-exact forward shipped, no coding instance solved through it, [#610](https://github.com/anthony-chaudhary/fak/issues/610)). Maps the ordered spine (witness → cost → make-floor-visible → finish-adopt → in-kernel) onto the live epics and names the one unowned gap: no umbrella epic frames "coding agent behind fak" as the primary use case.
- [Decisions audit log: git-notes readback for adjudication records (2026-06-26)](docs/notes/DECISIONS-AUDIT-LOG-2026-06-26.md) — reader path for [#833](https://github.com/anthony-chaudhary/fak/issues/833): `witness.Decision` JSON-lines notes on `refs/notes/fak/decisions`, with `git notes --ref=refs/notes/fak/decisions show <sha>` for commit-anchored records and the empty-tree sentinel for pre-commit refusals. Documents that the ref stays off `main`, does not change `git log main`, and needs explicit fetch/push.
- [Witness attestation signing-key decision: operator-supplied Ed25519 first (2026-06-26)](docs/notes/WITNESS-ATTESTATION-SIGNING-DECISION-2026-06-26.md) — signer decision for [#832](https://github.com/anthony-chaudhary/fak/issues/832): v0 portable witness attestations should use an operator-supplied Ed25519 DSSE key so the first token stays zero-dependency and offline-capable; Sigstore/gitsign remains a later identity upgrade once the fleet has an OIDC/root policy. Pins the in-toto Statement / DSSE envelope shape and repeats the honest scope: the SHA is already content-addressed; the additive guarantee is the signed identity over fak's local witness verdict.
- [The readiness / durability verdict ladder as a domain-free DOS primitive (2026-06-26)](docs/notes/CONCEPT-DOS-READINESS-VERDICT-LADDER-2026-06-26.md) — concept capture for [#582](https://github.com/anthony-chaudhary/fak/issues/582): the mechanism behind the product scorecard ([`tools/product_scorecard.py`](tools/product_scorecard.py) / [PRODUCT-STATUS](docs/PRODUCT-STATUS.md)) is not fak-specific — it is a generic DOS primitive. A **closed maturity ladder** (`durable-product → … → concept-only`) where every rung's promotion is gated by **evidence the claimant did not author** (the CLAIMS tag a concept carries, whether its first command resolves to a real `cmd/` dir + documented verb, whether its witness/entry docs exist on disk), plus a **surface-ceiling gate** that stops a benchmark from posing as a durable product and a stub from posing as shipped — so a verdict can only move by changing the real tree, never the data. The note (1) extracts the surface-gate + evidence-binding core into a domain-free five-part form (closed rung vocabulary, surface→ceiling cap, capability set, evidence predicates over ground truth, evidence-bound adjudication with overclaim-refusal), (2) sketches a `dos`-grounded variant where the top rung is closed by a `dos` **witness** (`dos_verify` reads git ancestry, `dos_commit_audit` separates a `diff-witnessed` claim from a forgeable `subject-only` one) and an overclaim is refused with a structured reason from a closed vocabulary (cf. `dos_refuse_reasons`, proposed token `READINESS_OVERCLAIM`), and (3) decides where it lives: **keep the tree-cross-check shell a fak tool, lift the closed-ladder + ceiling-gate + evidence-bound-adjudication + refusal core into the DOS concept vocabulary** — building a `dos readiness` verb is a dos-kernel follow-up named as the next step, not committed here (the issue scoped this to concept capture, no code).
- [One machine: the session lifecycle IS serving admission (2026-06-26)](docs/notes/SESSION-LIFECYCLE-IS-SERVING-ADMISSION-2026-06-26.md) — explores the parallel between session start/resume and dynamic fused serving of random-length, flexible-turn sessions. The thesis: the `internal/session` run-state machine (start/throttle/pause/drain/stop + cold `Restore` + `Recontinue`) and the continuous-batch serving operation (admit/preempt/evict/resume a sequence) are **one state machine at two altitudes**, with the agent **turn boundary** as the single admission/preemption/resume quantum. fak already implies this but spells the machine twice (`session.RunState` vs `loopmgr.LoopState`, two enums sharing `paused/draining/stopped`) and only advisory-couples the halves (`TurnIntent` is consumed by prewarm/discard admission but gates no live served batch). Maps the verified correspondence (session verb ↔ serving verb ↔ status ↔ grounding symbol), separates the buildable seams (shared vocabulary, one epoch lineage, `SlotEvent`→KV reclaim, warm-swap on resume) from the analogy-only rows (cross-host live migration; `KVIncluded=false` by design), positions against prior art ([#805](https://github.com/anthony-chaudhary/fak/issues/805)/[#748](https://github.com/anthony-chaudhary/fak/issues/748)/[#637](https://github.com/anthony-chaudhary/fak/issues/637)/[#809](https://github.com/anthony-chaudhary/fak/issues/809)/[#844](https://github.com/anthony-chaudhary/fak/issues/844)), and proposes the unification epic [#912](https://github.com/anthony-chaudhary/fak/issues/912) (children [#913](https://github.com/anthony-chaudhary/fak/issues/913)–[#916](https://github.com/anthony-chaudhary/fak/issues/916)). Decomposition adversarially verified by a multi-agent workflow; every cited file:symbol and issue state confirmed against the tree.
- [Is witnessed span-attention a valid reward? Verdict, aggregation, and failure modes (2026-06-26)](docs/notes/RESEARCH-witnessed-span-attention-validity-2026-06-26.md) — prior-art survey 1/5 for the reward-over-spans epic [#860](https://github.com/anthony-chaudhary/fak/issues/860): the attention-as-explanation debate resolved into a usable rule for [#861](https://github.com/anthony-chaudhary/fak/issues/861). Verdict: witnessed span-attention is a cheap, relative, span-level proposal signal, not a standalone causal explanation or accepted reward until it correlates with exact-eviction leave-one-out. The note maps Jain/Wallace, Wiegreffe/Pinter, Serrano/Smith, and Abnar/Zuidema to fak's actual post-softmax observer and span ledger, then pins the aggregation rule: consumer rows only, span-level mass, all observed heads/layers summed for direct cache-read accounting, position/length normalization, and top/bottom LOO validation before any live planner or RSI promotion. Satisfies [#861](https://github.com/anthony-chaudhary/fak/issues/861).
- [Span-attention confound normalization: sinks, position, recency, and length (2026-06-26)](docs/notes/RESEARCH-span-attention-confound-normalization-2026-06-26.md) — prior-art survey 2/5 for the reward-over-spans epic [#860](https://github.com/anthony-chaudhary/fak/issues/860): the normalization contract for [#862](https://github.com/anthony-chaudhary/fak/issues/862). Raw attention is demoted to telemetry unless `expected_attention_mass` subtracts sink/preamble positions, massive-activation/outlier token effects, span length, relative-position/U-shaped long-context bias, and distance-to-query/recency defaults. The note defines the null-model rungs (uniform-visible fallback, position-length baseline, distance/age baseline, sink mask, per-head/layer calibration) and maps them to `SpanRewardSegment.ExpectedAttentionMass`, `NormalizedReward`, and `ConfoundNormalizationImproved`, preserving the rule that exact-eviction LOO decides whether the residual attention actually mattered. Satisfies [#862](https://github.com/anthony-chaudhary/fak/issues/862).
- [Span-reward novelty boundary: H2O, ContextCite, PRMs, and the defensible claim (2026-06-26)](docs/notes/RESEARCH-span-reward-novelty-boundary-2026-06-26.md) — prior-art synthesis 5/5 for the reward-over-spans epic [#860](https://github.com/anthony-chaudhary/fak/issues/860): the honest novelty boundary against H2O/SnapKV/Quest, ContextCite, influence methods, and PRMs. The defensible claim is a witnessed, replayable, falsifiable span-credit proxy, not "attention proves causality"; the note lists the exact fak deltas, the H2O-with-new-names dimensions, and the forbidden overclaims downstream docs must avoid. Satisfies [#865](https://github.com/anthony-chaudhary/fak/issues/865).
- [Span-credit signal menu: attention, gradients, leave-one-out, influence, and the fak fallback (2026-06-26)](docs/notes/RESEARCH-span-credit-signal-menu-2026-06-26.md) — prior-art survey 3/5 for the reward-over-spans epic [#860](https://github.com/anthony-chaudhary/fak/issues/860): ranks candidate context-span credit signals by faithfulness times cost, with the recommended design for [#863](https://github.com/anthony-chaudhary/fak/issues/863): attention is a cheap proposal distribution, exact-eviction leave-one-out verifies the top/bottom candidates, and `CORRELATE` / `REFUTE` / `INSUFFICIENT` decides whether attention may be promoted, replaced by LOO deltas, or held for more evidence. The note maps Integrated Gradients, Grad x Input, occlusion, influence functions, TracIn, ContextCite, and the attention-explanation debate onto fak's shipped `span_reward_shadow` and `ctxplan` seams, while preserving the overclaim fence that no live planner/RSI flip happens until #866 proves correlation against the eviction witness. Satisfies [#863](https://github.com/anthony-chaudhary/fak/issues/863).
- [Mac Qwen3.6-27B Metal Q4_K perf diagnosis: decode 1.2 / prefill 0.6 tok/s, the per-call command-buffer wall (2026-06-26)](docs/notes/MAC-QWEN36-27B-Q4K-METAL-PERF-DIAGNOSIS-2026-06-26.md) — a clean on-device measurement (M3 Pro, `-tags fakmetal`, `FAK_Q4K=1 FAK_METAL=1`, llama-server stopped) of fak's resident-Q4_K Metal path for the big Mac model, toward the 3× decode goal. The kernels are **bit-correct** (q4k GEMV cosine 1.000000, greedy token-parity vs CPU, both green on-box) but throughput is **0.16× of SOTA**: decode 1.2 tok/s vs llama.cpp-Metal 7.29, prefill 0.6 vs 51.55. `FAK_QPROFILE` phase profiles + the `q4k_gemv`/`q4k_gemm` microbench locate the wall precisely — each decode token issues ~336 *separate* Metal command-buffer GEMVs (≈7 matmuls × ~48–64 layers) and an isolated GEMV is **~360 µs launch/sync-bound** on top of ~98 µs of actual work (GEMV 32 GB/s ≈21% bandwidth; GEMM 364 GFLOP/s ≈5% FLOP). Re-prioritizes epic [#59](https://github.com/anthony-chaudhary/fak/issues/59): the kernel children (#515 q4_k GEMM / #516 resident weights / #517 decode GEMV / #71 hybrid prefill) have effectively **landed**, so the binding levers are now [#67](https://github.com/anthony-chaudhary/fak/issues/67) (one MTLCommandBuffer per forward — the GPU-resident decode forward, decode twin of the shipped `mg_prefill`) and a kernel-efficiency pass. Witness: `experiments/benchmark/runs/by-machine/node-macos-a/20260626T055239Z-q4k-metal-decode-27b/score.json`.
- [Mac Qwen2.5-7B Q8 GPU-resident decode forward: at performant parity with llama.cpp-Metal (0.99×) (2026-06-26)](docs/notes/MAC-QWEN25-7B-Q8-RESIDENT-DECODE-2026-06-26.md) — the [#67](https://github.com/anthony-chaudhary/fak/issues/67) one-command-buffer GPU-resident **dense Q8 decode forward** (the decode twin of the shipped `mg_prefill`), built, optimized and measured on the M3 Pro. **Correct** — logit cosine **0.999991** + greedy token-parity vs the CPU Q8 decode (`TestMetalDecodeResidentMatchesCPU`), and the real Qwen2.5-1.5B Q8 emits the same text as CPU (`"...France is" -> "Paris"`); engages on Qwen2.5-7B Q8 with attention bias. **Six shipped optimizations took clean 7B Q8 decode 10.0 -> 17.6 tok/s (0.56× -> 0.988× of llama.cpp-Metal 17.82) — AT PARITY** (within ~1.2%, inside run-to-run variance): a **parallel RMSNorm** (the v0 ran the H-wide norm on ONE GPU thread ×56/token — a matmul-only split found it; +0.24×), the **LM head + final norm on the GPU** (+0.08×), **f16 block scales** + fused bias (GGUF Q8_0 std, ~6% fewer bytes; +0.04×), **persistent on-GPU KV** (seed once, append in place; +0.025×), and **key-parallel flash-decode attention** (8 simdgroups/head split the keys + flash-combine — a skip-attention split isolated the serial O(ctx) attention as the last residual; +0.04×). fak's projection GEMVs already run at **~154 GB/s, ABOVE llama's ~143**, and the matmul+head floor (~55.5 ms) is below llama's full decode (~56.1 ms). Shipped `5a11a31`..`d6188182`. Continues [MAC-QWEN36-27B-Q4K-METAL-PERF-DIAGNOSIS](docs/notes/MAC-QWEN36-27B-Q4K-METAL-PERF-DIAGNOSIS-2026-06-26.md).
- [idea-scout triage: out-of-band injection-defense taxonomy + adaptive evaluation (#909) (2026-06-26)](docs/notes/RESEARCH-out-of-band-injection-defense-taxonomy-triage-2026-06-26.md) — triage of arXiv:2606.26479 (Narisetty/Kore/Kattamanchi/Kumarapu, "Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents"): the **survey that names fak's own family** — defend a tool-using agent against indirect prompt injection NOT by training the model to refuse but by enforcing security *outside* the model with a deterministic policy that mediates its actions (CaMeL/FIDES/Progent/RTBAS/FORGE), organized as classical **reference monitoring + Biba integrity + least privilege**. Verdict: **prior art to cite** — fak IS an out-of-band defense (default-deny capability floor = reference monitor + least privilege, IFC `Ref.Taint` sink-gating = Biba integrity, result-admit quarantine = containment that holds when the model is fooled), so the taxonomy is the academic name for the seams [`docs/industry-scorecard/security.md`](docs/industry-scorecard/security.md) already calls "FIDES/CaMeL-class". The paper's second contribution — every one of these defenses is validated only on **static** benchmarks, the same methodology that made in-band defenses look strong until adaptive attacks broke twelve at >90% — independently backs fak's deliberate non-load-bearing-detection bet (~100% evadable, by design) while **raising the bar** fak's own `internal/agentdojo` ASR battery should meet (adaptive, defense-aware, not static); the paper's own adaptive result is one small black-box data point (Progent on AgentDojo, Qwen2.5-7B/H200, mean ASR 25.8%→4.2%, adaptive 2.6%, white-box GCG still open), cited as a protocol to adopt for evaluation, never as evidence fak's containment is adaptively robust. No capability adopted (fak already enforces out-of-band); not a threat (a parallel defense on fak's side of the trust boundary). Resolved by `e7a6607`.
- [Compaction vs. the industry: drop-and-splice vs summarize-and-resend (2026-06-25)](docs/notes/COMPACTION-VS-INDUSTRY-2026-06-25.md) — a sourced audit of how fak's cache-prefix-preserving history compaction differs from the built-in compaction in Claude Code, the Anthropic API context-editing feature, Cursor, OpenAI Codex, GitHub Copilot, Aider, and LangChain. Industry mechanisms web-sourced; every fak claim adversarially verified against `internal/agent/anthropic_compact.go` and the gateway. The crux: almost everyone summarizes/clears and re-sends a **rewritten** prompt (which the providers' own docs say breaks the prompt cache); fak drops middle turns and **byte-splices** so the cached prefix stays byte-identical (`bytes.Equal` proven, 13 fail-safe identity exits). Records the four disambiguations that survived adversarial review — the provider cache **cascade** is an unverified hypothesis not a measured fact (the audit's biggest open risk; the `/metrics` instrument exists, it needs one credentialed Anthropic session, [#745](https://github.com/anthony-chaudhary/fak/issues/745)); fak vs Anthropic context-editing is **orthogonal** (cache-preservation vs recoverable tool-result clearing), not "better"; "lossless" is **overloaded** → a four-axis table (cache-bytes / trust-boundary / model-context / recoverability); Anthropic-wire-shaped **by implementation, not necessity**. Adds the durable surface: a new `client-compaction` dimension in the industry scorecard (a categorical byte-splice **lead** row + an explicit **no-claim** on realized cache reuse).
- [idea-scout triage: attention-located malicious-skill detection (#771) (2026-06-25)](docs/notes/RESEARCH-malicious-agent-skills-attention-triage-2026-06-25.md) — triage of arXiv:2606.23416 ("Detecting Malicious Agent Skills in the Wild using Attention", Etteib/Lunghi/Bissyandé): marketplace skills run with user privileges, and the paper's load-bearing claim is that prompt-injection defenses collapse because a skill *is* instructions (the trusted/untrusted-data boundary disappears). Its **Locate-and-Judge** detector scores skill spans by instruction-following **attention** and judges only top-K, auditing a marketplace at order-of-magnitude lower cost. Verdict: **prior art to cite** — it independently validates *why* fak gates the **capability** a skill exercises rather than classifying its instructions (exactly the boundary the paper shows collapses) — plus a real threat whose action step (exfiltrate=send, hijack=destructive call, persist=write) fak's default-deny capability floor already gates a layer **below** a static pre-load scanner. The attention-locator is **not adopted** (best-effort, no kernel load surface, and its attention-is-importance premise is what fak's own [#861](https://github.com/anthony-chaudhary/fak/issues/861)/[#862](https://github.com/anthony-chaudhary/fak/issues/862) is still auditing).
- [fak in-kernel CUDA serve on an L4: live tok/s + a concurrency crash fixed (2026-06-25)](docs/notes/L4-INKERNEL-SERVE-AND-CONCURRENCY-FIX-2026-06-25.md) — the reachable-hardware companion to the [GPU server cross-engine](docs/notes/DGX2-CROSS-ENGINE-DATA-2026-06-25.md) note: with the 8-GPU server nodes reachable only through a down control-bridge, this records what could be measured on the one live GPU node (the `fak-realmodel` GCP L4). Two results. (1) The first **warm steady-state** decode rate against fak's *live* in-kernel CUDA serve: a real Qwen2.5-0.5B Q8_0 decodes at **~466 tok/s** single-stream (median of 8, range 437–510; ~2.25 GB of 23 GB VRAM) — an order of magnitude over the WSL-laptop Q8 numbers, confirming [GPU-QWEN-RESULTS](docs/benchmarks/GPU-QWEN-RESULTS.md)'s thesis that the laptop gap was the WSL launch tax, not the kernel (the *cold* first decode is ~66 tok/s and must not be quoted as steady-state). (2) The serving bug live traffic exposed: a concurrent `/v1/messages` burst **took the GPU serve down** — the single-stream CUDA backend (one `g_stream`, one cuBLAS handle, a shared device free-list) was driven by two concurrent `InKernelPlanner.Complete` goroutines whose per-token op sequences interleaved and corrupted each other's device buffers → sticky `cuda_kernels.cu` illegal-memory-access → poisoned context until restart (the sibling **CPU** serve answered correctly throughout, isolating the fault). Fixed by holding a dedicated `devMu` across the whole forward when a backend is wired (safe queuing, correct for a single-stream device; CPU path untouched), with a **proven non-vacuous** GPU-free test (3719 op-overlaps without the lock, 0 with it). Honestly scoped: a small-model device-decode serving rate, not a 753B / GPU server / stock-engine number.
- [Credit assignment over spans: PRMs, RL credit, agent-memory usefulness (2026-06-25)](docs/notes/RESEARCH-credit-assignment-over-spans-2026-06-25.md) — prior-art survey 4/5 for the reward-over-spans epic [#860](https://github.com/anthony-chaudhary/fak/issues/860): how the RL / agent-training literature assigns credit to intermediate steps and retrieved items, and the span-credit-assignment design those patterns produce. Folds four families into one reward equation — `reward(s,T) = success_gate(T) · Σ γ^(T−t) · m_s(t)` — with each term justified by a named pattern (**outcome gate** from PRMs / Math-Shepherd; **recency discount** from TD(λ) eligibility traces / GAE; **confound normalization** from attention-sink + the "attention is/is-not explanation" contest) and each mapped onto a fak seam that already ships (`ctxplan.OutcomeFromAttention` produces it, `Forecast.Learn` / `Weights.Learn` consume it into the `recall.Page.Utility` Q-slot, `rsiloop` keeps-or-reverts on witnessed signal/noise). Every term is **degenerate-to-current** (identity knobs reproduce the shipped flat cumulative attention) so [#866](https://github.com/anthony-chaudhary/fak/issues/866) can ablate each independently; carries the epic's honest spine verbatim — attention-as-importance is **contested**, so the producer is a swap point that takes the leave-one-out signal ([#863](https://github.com/anthony-chaudhary/fak/issues/863)) at the same `Outcome` interface if validation refutes attention, and the outcome gate demands a **witnessed** verdict, never the model's self-report.
- [Shared live trunk vs. branch / worktree / VM-per-agent (2026-06-25)](docs/notes/SHARED-TRUNK-VS-PER-AGENT-ISOLATION-2026-06-25.md) — the positioning half of epic [#822](https://github.com/anthony-chaudhary/fak/issues/822) / [#834](https://github.com/anthony-chaudhary/fak/issues/834): the field (Cursor background agents, Devin, Sculptor, OpenHands, Dagger `container-use`, Google GitFarm) converged on **never share a tree** — branch/worktree/VM per agent, integration gated on a human merge. That validates fak's contrarian bet (one **live trunk** + **pre-call adjudication** + **disjoint-lease admission**) while giving it **nothing to import** for the hard part, because every surveyed system *avoids* the shared-tree problem rather than solving it. Names the trade as a table (what each side buys/costs), the three named git-admin gaps with their current closure status at HEAD, and carries the epic's honesty caveats **verbatim**: `mvdan/sh` cannot resolve `$VAR`/`alias`/`eval` (fail closed); `grite` = distribution **not** atomicity + the **synthetic** "78%→0%"; a signature is an **identity envelope only** (the SHA already content-addresses); AgenticFlict **sizes the problem, never claims fak's benefit**.
- [Fusion, ref-counting, and GC for the agent loop (2026-06-25)](docs/notes/FUSION-REFCOUNT-GC-FOR-THE-AGENT-LOOP-2026-06-25.md) — the runtime-heap lens on the loop: every turn and tool result is a **heap object**, a pinned goal / active slash-command / open task is a **GC root**, compaction is **garbage collection**. The decisive finding after mapping the tree: the collector machine already ships at the byte/KV depths (`abi.CASPinner` refcount-by-digest, `ProvisionalSink.Promote/Rollback` commit-or-collect, `ctxplan.Forecast.Pins` whose own doc names "the active goal" as the canonical pin, `cachemeta.Lifecycle` TTL+`Touch`-revive) — what is missing is the single **edge from an intentional root to the heap objects it keeps alive**. Locates the gap exactly at `SessionPlanner.pins()` (the complete current root-set is system/first-user/last-user; the goal is absent), defines the **ref-count of a turn** (its live referents: an open goal, a later citing turn, a pending consumer), the conservative over-retain safety asymmetry (a false-free silently loses needed context; a false-retain costs a few tokens), **turn-fusion** (collapse a refcount-1 producer→consumer intermediate, the sound version of `maybeCompactInboundTools`) and **command-tenuring** (a recurring slash-command promotes to a compact rollup — the "store it for aggregate/GC" the goal asked for), and a 4-step first build that wires the goal into the per-turn pin set and measures the effect on the shipped signal/noise metric.
- [vToolcall, forked — best-effort serve-tiers and owning the loop (2026-06-25)](docs/notes/VTOOLCALL-FORK-AND-BESTEFFORT-2026-06-25.md) — the forward-looking sequel to the materialized-view note, answering "best effort" + "fork an open harness (Crush / opencode)". Adds (1) a **consistency-level QoS axis** (`STRICT | BOUNDED_STALE | BEST_EFFORT | SPECULATIVE` threaded as `c.Meta["consistency"]`, a DB-read-consistency dual) with a per-topology graceful-degradation capability matrix, and (2) the **fork direction**: make fak the tool *dispatcher* so the prior note's "impossible on the proxy" verdict flips and serve-as-ran runs closed-loop on real built-in tools. Honest spine, all three stated plainly: forking does not *soften* un-ring, it **relocates** it (after-consumption → a before-consumption write barrier fak owns, needing a net-new suspend-and-resume turn primitive — today's `gateTurn` only terminates); **Crush is FSL-1.1-MIT** (source-available, commercial-restricted at HEAD) so the license-clean call is **build the minimal native TUI on the shipped `internal/agent` seam** (Apache-uniform, single-binary) or host **opencode-as-server** (MIT), never fork Crush into the Apache module; and the loop fak would extend is a **benchmark A/B comparator (`RunArm`) today**, not a production loop. Portfolio verdict: keep the proxy as the universal gate, lead the fork with the native build.
- [vToolcall — tool results as a materialized view (2026-06-25)](docs/notes/VTOOLCALL-MATERIALIZED-VIEW-2026-06-25.md) — the *closed-loop* dual of [vCache](docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md): serve a tool result from the kernel's own cache **as if the tool ran**, framed as one materialized view in a query engine over the whole harness-facing surface (tool-defs via `promptmmu`, history via `agent.CompactAnthropicHistory`, context via `contextq`, KV via vCache — and now results via the vDSO). The serve mechanism already ships as the vDSO FastPath (`kernel.go:347` → `abi.FastPaths().Lookup`); this note is its design rationale with **cache invalidation as the spine**. Honest build boundary: result-synthesis is real only where fak *dispatches* the tool (`fak_syscall`/in-kernel), structurally impossible on the `/v1/messages` proxy (the harness runs tools there); witness-keying of the tier-2 key, a cross-process FILL pool, and the speculative-serve `ProvisionalSink` are named **unbuilt**. Law T (sound-before-serve) is the polarity flip from vCache's A2 — a stale tool result *corrupts*, it does not merely *cost*.
- [Fresh status snapshot (2026-06-25)](docs/notes/FRESH-STATUS-2026-06-25.md) — the pinned snapshot of the cross-domain rollup that `tools/fresh_status.py` folds: git context (HEAD/branch/dirty/ahead-behind) + benchmark catalog (run/machine counts, newest-run staleness, per-run **measured | modeled | unknown** provenance with unknown surfaced loudly) + work (plan_audit, zero-state SKIP) + industry parity (`industry_scorecard`), in one `schema/ok/verdict/finding/reason/next_action` control-pane envelope. The sibling of `scorecard_control_pane.py` one level up — that folds the scorecard FAMILY, this folds the four top-level domains. Re-generate with `make status` / `python tools/fresh_status.py --write-doc`.
- [What is an agent? The parts the word smears (2026-06-24)](docs/notes/EXPLAINER-what-is-an-agent-2026-06-24.md) — the *horizontal* complement to [engineering-is-building-loops](docs/explainers/engineering-is-building-loops.md): that doc decomposes an agent by *scale* (the five nested loops), this one decomposes it by *part* (engine, history, context view, system prompt, skill, tool, loop, adjudicator, quarantine, session, identity, communicator), each mapped to a real fak seam cited by symbol + test, not line number. Names the ten cross-cutting *cuts* the word collapses (substrate/view, soft-steering/hard-gate, propose/dispose, replaceable/durable, reasoning/action/answer, primitive/composed, turn/session/identity, drive/audit, single/fleet, residency/reuse/legality) and a glossary of seven overloaded terms (session→5 Go types, agent→4 senses, context→3, model→2, memory→3, tool-vs-skill, steering→3). Honest §6 fences mark the seam-vs-shipped gaps (ctxplan live loop off by default, the evadable detector floor, session `Decide` on the harness arm only, identity as a Python module not an `abi` type, the agent communicator as a pattern not a Go type).
- [Vocabulary disambiguation worklist (2026-06-24)](docs/notes/VOCAB-DISAMBIGUATION-WORKLIST-2026-06-24.md) — the actionable companion to the explainer above: the term-conflation audit's per-term findings with real file locations and the proposed split (e.g. `session` → 5 Go types: `model.Session` decoder, `recall.Session` core-image, `session.Table` drive-state[canonical], `gateway.SessionState` wire, `agent.SessionPlanner` planner). Split into a docs-lane glossary (#721) and a code-lane rename + trust-framing fix (#722, the load-bearing one: stop "agent" naming both the kernel and the untrusted guest). Lists what is already tracked elsewhere so the comm/ctxplan/session/identity gaps are not refiled.
- [GPU server cross-engine data: what runs, how it compares, what's next (2026-06-25)](docs/notes/DGX2-CROSS-ENGINE-DATA-2026-06-25.md) — a run-log companion to the GLM-5.2 throughput/benchmark plan: the 8-GPU datacenter node runs a stock SGLang server serving `Qwen/Qwen3.6-27B` (tp8, bf16), measured here at **93.05 tok/s single-stream decode / 607.7 tok/s agg @ concurrency 8, 0 errors**. Puts three A100-class numbers on one board with their category boundaries kept honest (real-serving SGLang 27B vs real-serving llama.cpp 753B 2.62 tok/s vs fak *synthetic* kernel cost 13.5–26.5 tok/s — the last is NOT a serving rate and can't sit next to the others), explains why the native fak sweep belongs on the idle 80GB node, and prioritizes next steps (P0 = the same-checkpoint B2 rung now that a live stock server exists + the carried DSA illegal-access bisection; P1 = a chunked-stage fix for the ~4 KB control-channel launch limit that silently dropped large remote launches this run). Hardware referred to by class, never lab host/IP/path.
- [vLLM/SGLang pre-agentic assumptions, and the agent-era repairs (2026-06-25)](docs/notes/VLLM-SGLANG-AGENTIC-ASSUMPTIONS-2026-06-25.md) — a source-backed synthesis of the request/cache/scheduler/tool/replica/L3 assumptions serving engines inherited from the chat-completion era, and the fak-shaped repairs: agent-run envelopes, cache hits as verdicts, tool calls as syscalls, authority-aware placement, witnessed completion, and agentic KPIs.
- [Token streaming TTFT with whole-turn tool gating (2026-06-25)](docs/notes/TOKEN-STREAMING-TTFT-2026-06-25.md) — the #47 design note: live prose deltas stream on OpenAI and Anthropic wires through `agent.StreamingPlanner`/Anthropic passthrough, while native and text-form tool-call bytes remain buffered until the whole proposed call set clears `k.Decide`. Names the perceived-TTFT split for prose-first, pure tool-call, and all-denied turns.
- [Internal benchmark KPIs, from the agent's point of view (2026-06-25)](docs/notes/AGENTIC-LOOP-KPIS-2026-06-25.md) — an inventory of what fak measures today (work eliminated + cost of one `Decide`), organized by the five-layer loop ladder, then ~30 NEW agentic *lifecycle-latency* KPIs that fill the gap the current catalog is silent on — the numbers an agent author budgets a run against: time to spawn a turn (`ctxplan.RenderTurn`), reap a turn (`ctxmmu.Admit`), query the planner (`ctxplan.Optimize` — today only op-*counts* exist, never wall-clock), checkpoint/fork a session (`sessionimage.DumpDir`), spawn a fan-out wave (`NewBatchFromPrefixReserve`), plus TTFT/TPOT/ITL (now measurable via `agent.StreamingPlanner`) and the rsi keep-rate/cycle-time. Every new KPI is grounded against a real seam with a status tag (standing/modeled/guarded/frozen-sync/proposed) and a one-line honesty fence; flags the four traps (measured≠modeled, latency≠op-count, live≠replay, the frozen-but-sync `Reap`) and a cheapest-to-wire shortlist. Surfaces one cleanup: `preflight_catch_rate` is a declared KPI field `bench.Run` never populates.
- [Fresh agentic benchmark inventory and fak win map (2026-06-25)](docs/notes/AGENTIC-BENCHMARK-INVENTORY-2026-06-25.md) — current external benchmark map for coding, terminal, browser/computer-use, tool/state, and safety surfaces, split into model-ceiling vs agent-contract benchmarks with a falsifiable "same base model, better safe completion per dollar/evidence" fak harness thesis for Opus-class, GLM-5.2, and mixed Opus+GLM arms.
- [Agentic benchmark run packets for fak harness wins (2026-06-25)](docs/notes/AGENTIC-BENCHMARK-RUN-PACKETS-2026-06-25.md) — execution packets derived from the inventory: what runs now (`cmd/agentdojoredteam`, locally witnessed at 38 attacks / 29 detection-only successes / 0 full-stack successes), what is GLM-5.2 hardware-gated, what needs a DeepSWE/tau3/ToolSandbox/Terminal-Bench adapter, and the exact evidence needed before any benchmark win is quotable.
- [Frontier agent leaderboard enter/skip map for #1068 — BFCL V4 the pick (2026-06)](docs/notes/FRONTIER-AGENT-LEADERBOARD-SURVEY-2026-06.md) — ranked enter/skip table over BFCL V4 / AA Agentic Index / Galileo v2 / GAIA2 / Vals Index (HAL as cost-axis anchor), each row carrying a dated source URL, the cost to run, the exact fak-attributable number that would ride it, and a WITNESSED-vs-OBSERVED label. Pick = **BFCL V4**, the only board with both a USD-cost and a latency-seconds column, so a held-accuracy-constant fak-in-vs-fak-out cost delta (~3% gateway tax; KV-reuse marginal-over-TUNED 4.1× on a 50×5 fleet, both WITNESSED) is postable against a real public column — fak rides the cost column, never the accuracy rank. Records the negative result that **no public board in this family scores a tool-call adjudication gateway's safe-completion / policy-compliance / provable-deletion as a first-class axis**, so fak's model-free ASR-0.000 floor has no leaderboard home. Names the next-step run-contract stub `experiments/agent-live/bfcl-v4-raw-fak-contract-20260627.json` (`result_claim_allowed=false`).
- [Long-running agent loops: make fak the loop kernel, not another cron (2026-06-25)](docs/notes/LONG-RUNNING-AGENT-LOOPS-2026-06-25.md) — the operating-system-shaped strategy for rolling cron/launchd/Scheduled Tasks, cloud and remote nodes, phone/Slack/WhatsApp control, notifications, foreground vs background sessions, and green-thread-like logical loops into one fak surface. The key split: schedulers and chat are interrupt sources; fak should own loop identity, admission, leases, run ledgers, task snapshots, witnessed completion, notification discipline, and cache-aware scheduling. First shipped slice: `internal/loopmgr` plus `fak loop append|run|status` provide the hash-chained loop-event ledger, OS-scheduler wrapper, and fold; `tools/issue_resolve_dispatch.py` and `tools/issue_resolve_progress.py` are the first producers; `tools/register_issue_dispatch.ps1` is the first Task Scheduler adapter migrated through `fak loop run`, while Mac dogfood and other scheduler paths remain next.
- [The gardening bundle: default-on the cleanup we run by hand (2026-06-25)](docs/notes/GARDENING-BUNDLE-DEFAULT-ON-2026-06-25.md) — the gardening-workload companion to the loop-kernel note. fak already has three overlapping self-maintenance orchestrators (`scorecard_control_pane` folds 13 scorecards, `fresh_status` folds 4 domains, `fleet_control_pane loop-audit` runs 19 loops) and a built loop runtime (`loopmgr` ledger + governor + `fak loop`), but nothing fires a gardening pass on a cadence and almost nothing auto-fixes. The converge-and-arm plan: one `tools/garden_bundle.py` fold (`make garden`) over the read-only passes, a daily `garden.yml` + a `--mode garden` host tick, the governor as the brake (`FAK_GARDEN=off` / `min_interval_seconds`), then auto-fix behind a `dos commit-audit` witness gate, then a `fak garden` verb. Rungs 0-2 shipped; 3-4 designed.
- [Inbound prompt-MMU: curate WHAT enters the window (2026-06-25)](docs/notes/INBOUND-PROMPT-MMU-2026-06-25.md) — the INGRESS dual of the result-side `ctxmmu`. fak gates the outbound/result half of the context window end-to-end (quarantine results, adjudicate calls, compact old turns) but the inbound composition — tool DEFINITIONS, system, injected skills/memory — forwards byte-identical on the `fak guard -- claude` passthrough. The epic + rungs to curate the ingress, on-by-default both directions with flags only for opinionated overrides, all under the #555 cache-prefix byte-splice + fail-safe-identity discipline. Rung 1 (`internal/promptmmu` `CompactInboundTools`, denied-tool-def pruning) SHIPPED; cache geometry forces it to fire at the session-start/RESET prefix rebuild, refusing pre-breakpoint prunes that would bust the session cache.
- [The system-prompt MMU: fak owns its own base context (2026-06-29)](docs/notes/SYSTEM-PROMPT-MMU-2026-06-29.md) — the AUTHORSHIP dual of the inbound prompt-MMU. #751 prunes a harness-authored prompt as it passes through; this epic takes ownership of the *composition* of the head — a fak-first base context where the irreducible resident spine is fak's own concepts (the attention-sink anchor, byte-identical every turn) and the harness's rules/skill-menu/environment become a queried, paged, append-after-the-breakpoint overlay assembled from the same capability substrate the skill loader (#1103) already ships. The two end-states: (a) the minimal base where the resident head is *only* fak plus a retrieval affordance, and (b) the live base where the prompt is a first-class object fak rewrites at runtime by page-in+mask under a witness gate. The cache doctrine is REGIME-SCOPED, not universal: "append-and-mask, never edit-in-place" is a hard law only where fak does *not* own the cache (the provider passthrough and the proxy-to-local-engine regimes, whose radix-tree-keyed prefix cache goes cold the moment the head changes — Manus' measured ~10×); when fak owns the engine it keeps the pre-RoPE `Kraw` plane and can mutate the head while keeping survivors reusable via **bit-exact span deletion + re-RoPE** (witnessed `max|Δ|=0`, live behind `FAK_INKERNEL_KVMMU`) — though relocated-span *reuse* is not shipped (the repo's own audit faults it to recompute). Grounds the fak-first inversion in attention geometry (regime-independent) plus a cache-stability reason on the passthrough path, states the five load-bearing invariants (spine byte-identical on the provider path; append-and-mask in the provider-uncontrolled regime; safety-critical always resident; pointers-not-bodies with a bounded index; self-modification witness-gated, versioned, append-mostly — the agent never rewrites its spine), maps the built-but-request-path-dead substrate this would *wire* rather than reinvent (`cachemeta.PromptSegment`/`promptmmu`/`ctxplan`/`capindex`/`contextq`/`ctxmmu`/`ctxresidency`/`sessionreset` plus the regime-B `model`/`radixkv`/`kvmmu` span machinery), and lays out six rungs from a new `internal/syspromptmmu` spine to the `fak debug` re-derivation surface that feeds #1217. Planning + tickets only.
- [Bottleneck map and durable process loops (2026-06-25)](docs/notes/BOTTLENECK-MAP-2026-06-25.md) — the current system + GitHub/open-work bottleneck map, with the exact read-only/ignored-artifact commands used to refresh it and the public/private publication boundary for future repeats.
- [Issue, learning, and durable skill-loop refresh (2026-06-25)](docs/notes/ISSUE-LEARNING-SKILL-LOOP-REFRESH-2026-06-25.md) — a dated queue-gardening snapshot: issue triage evidence, label batches applied, and the repeatable loops/skills that keep priority work organized without closing or assigning work blindly.
- [Making fak attractive to mobile / edge / IoT providers (2026-06-24)](docs/notes/MOBILE-EDGE-IOT-STRATEGY-2026-06-24.md) — a grounded go-to-market: sell the hardware-independent half fak already ships (the adversarial capability gate + the tamper-evident audit trail), not on-device inference speed. The crux: Apple and Google both ship an on-device model with a typed tool/intent contract but leave adversarial enforcement in-process (Android even auto-authorizes "related sub-tools" from one grant), and fak's SHA-256 hash-chained journal already structurally matches the EU AI Act Article 12 audit-log mandate landing Aug 2026. Every claim cites a shipped artifact (cosine=1.0 parity, 3-tier offline, the swappable EngineDriver seam, Qwen2.5-1.5B adjudicated on CPU) or a dated source; names the net-new work honestly — no published linux/arm64 binary (one matrix line), no Pi/Jetson footprint witness, no NDK/Swift bindings, no NPU adapter.
- [Serving the strongest model on a MacBook + cross-laptop agentic bench (2026-06-24)](docs/notes/MACBOOK-SERVE-AND-AGENTIC-BENCH-2026-06-24.md) — what the pure fak stack can serve on Apple Silicon today and how to A/B it agentically from a second laptop, grounded in shipped code + on-device M3 Pro numbers. The crux: fak's own forward is purest but slowest (Qwen2.5-7B Q8 @ ~8.7 tok/s is the agentically-usable ceiling), the gateway-in-front-of-Ollama path is fast but the inference isn't fak's. Corrects a first-draft error — `fak swebench run --agent fleet --gateway <mac-ip>:8080` already ships the dataset-scored cross-laptop runner (real SWE-bench Verified RESOLVED N/Total); the only genuine residual is a Docker-free Mac-hostable grade so the loop closes on two laptops alone.
- [vCache — a virtual API cache over providers we don't control (2026-06-24)](docs/notes/VCACHE-VIRTUAL-API-CACHE-2026-06-24.md) — the active control plane proposed *on top of* the passive `internal/cachemeta` tier: treat provider prompt-caching as virtual memory we can observe but not address (vBlock = virtual page, a warm provider prefix = physical frame, the manifest = page table, the request scheduler = MMU), and recall a unit by shaping the *order, shape, and timing* of requests so the provider serves the prefix from its own cache. Audit-grounded: every `cachemeta` symbol checked against HEAD (the fabricated `CacheLane` reference removed; the real seam is `ShapeGLMTurnSegmentWitnessed` + `glm_coherence.go`), the Anthropic per-model min-prefix corrected to 1024 (Opus 4.8 / Sonnet 4.6 / 4.5; 4096 is Haiku 4.5), and the economics (break-even N≥2/≥3, Zipf `s≈1.74` for "7 anchors→85%", chain-horizon `C₀=103`, the 300× recall-by-rebuild loss) independently re-derived. Phased M1–M5 plan + four adversarial laws (warmth is a belief never a boolean; fingerprint the wire bytes; the warm primitive has an irreducible race; calibrate-don't-assume on implicit providers).
- [Budget-triggered session reset (2026-06-25)](docs/notes/BUDGET-TRIGGERED-SESSION-RESET-2026-06-25.md) — the long-context reset design and shipped slice: context budget exhaustion mints a continuation id, `--reset-on-budget` distills a carryover seed and re-arms the fresh trace, while live KV splice and hard child-process relaunch remain named follow-ons.
- [Agent optimization methods — field inventory, survey & index (2026-06-23)](docs/notes/RESEARCH-agent-optimization-methods-survey-2026-06-23.md) — 370 distinct methods across 16 families spanning the whole stack (reasoning, test-time compute, context/memory, retrieval, KV reuse, tools, planning, multi-agent, routing, serving, training, reliability), each with a one-line definition + what it optimizes + maturity, plus an alphabetical master index. The umbrella that cross-links the deep notes ([agentic caching](docs/notes/AGENTIC-CACHING-SOTA-2026-06-19.md), [scaling laws](docs/notes/SCALING-LAWS-OF-AGENTS-2026-06-19.md), [O(1) context economics](docs/explainers/o1-context-window-economics.md)).
- [Three layers of agent optimization — skill, trajectory, substrate (2026-06-24)](docs/notes/RESEARCH-three-layers-of-agent-optimization-2026-06-24.md) — the conceptual companion to the field inventory above: separates *what* an agent should do (skill), *how any run unfolds* abstract over skill (trajectory), and *what is kept hot* (substrate), then spends its length on the three differences. Uses only the refined claims that survived an adversarial pass — the "harness carries the weak agent" convergence is true on a live re-decode and false for a frozen trajectory (fak's astropy 1/1→0 counterexample + the `turnbench/ope.go` divergence frontier); trajectory↔substrate is a complement not an adjoint; the compiler-stack analogy is a leaky gradient because fak fuses the safety and reuse boundary. Closes on the LIVE-vs-DORMANT `req.Raw` passthrough gap.
- [Agentic caching SOTA (2026-06-19)](docs/notes/AGENTIC-CACHING-SOTA-2026-06-19.md)
- [Planned view measured over real transcripts (2026-06-23)](docs/notes/CTXPLAN-REAL-TRANSCRIPT-MEASUREMENT-2026-06-23.md) — the empirical counterpart to scaling.go's synthetic model: replays the heaviest real Claude Code sessions turn-by-turn through the real planner + page-fault handler. 13.3× fewer resident tokens than linear; 31.7% forecast-miss rate with 100% of misses served; exact recall 715/715 turns vs compaction losing facts on 695/715. Closes #559 (`cmd/ctxplanbench`).
- [ctxview default-on witness (2026-06-28)](docs/notes/CTXVIEW-DEFAULT-ON-WITNESS-2026-06-28.md) — the GPU-free, re-runnable evidence that the O(1) planner (`--ctx-view-budget`) is correct and fail-open enough to flip from off-by-default to a conservative default-on: `ctxplanbench -selfcheck` (resident 16/20, exact recall 5/5, faults 3/3 served, bounded-probe == full-scan), the on-the-wire `TestCtxViewHTTP` (OFF byte-equals inbound; ON keeps the Anthropic cache prefix byte-identical with exact recall), and the fleet's realized-reuse dogfood (75.1% from #1114). Names the residual: the flip is blocked on `cmd/fak` building (peer WIP).
- [Dynamic ctxview budget — 8000 is below the agentic floor (2026-06-28)](docs/notes/CTXVIEW-DYNAMIC-BUDGET-2026-06-28.md) — why the flat `--ctx-view-budget 8000` default is the wrong absolute number for agentic sessions (below the faithfulness floor and far below the ~34K economic crossover), the [pins+recency .. ~12%-of-billed-prompt] band the budget lives in, and a workload-adaptive policy that scales the O(1) resident target to the model's context window (prefix-floored, economics-aware control-loop follow-on). The next-steps ladder for the ctxview epic.
- [Planner per-turn compute flatten, measured (2026-06-23)](docs/notes/CTXPLAN-PLANNING-COST-FLATTEN-2026-06-23.md) — the sibling that measures the planner's OWN work, not just its output: a persistent `ctxplan.Index` bounds the per-turn probe (Θ(N²)→Θ(c·N)) over the same real sessions. 851 turns: peak-probe ≤ cap on every turn, 1.5× less planner work (growing with N), resident-token efficiency preserved (within 1.2%), and the honest cost↔fidelity finding — the bounded probe is byte-identical to the full scan when it sees the whole candidate set (342/342) but diverges at default width on long sessions (every divergence a served page-fault, never a lost fact). #558/#559 (`cmd/ctxplanbench`).
- [Context-window baseline + self-reduce 2× (2026-06-23)](docs/notes/CTXWIN-CONTEXT-WINDOW-BASELINE-2026-06-23.md) — what a Claude Code session's context window is actually made of, and how much halves at low risk vs bounded-loss. The empirical pass over real transcripts (`tools/ctxwin.py`) the [O(1)-turn planner](docs/notes/O1-TURN-CONTEXT-PLANNER-2026-06-23.md) names as its missing measurement.
- [Multiple-sink transmission for the cache lifecycle (2026-06-23)](docs/notes/MULTI-SINK-CACHE-LIFECYCLE-2026-06-23.md) — is one kernel op fanning Promote/Rollback across every registered `ProvisionalSink` useful for the KV/context cache lifecycle? Yes, but latent: one registrant today, the fan never exercised with >1 sink (now witnessed in `internal/spec`), and best-effort not atomic. Ranks which cache tiers should become sinks next.
- [DOS effective-usage audit (2026-06-22)](docs/notes/DOS-EFFECTIVE-USAGE-AUDIT-2026-06-22.md)
- [DOS `salience` usefulness audit (2026-06-24)](docs/notes/DOS-SALIENCE-USEFULNESS-AUDIT-2026-06-24.md) — is the "is this true thing LIVE or true-but-PARKED?" verdict useful? Sound, fail-safe-to-RETAIN, fills a real gap (the keep-but-park dual of `retire`) and matches spec (PARKED→exit 3, LIVE→0, INDETERMINATE→4) — but **latent**: nothing routes on the verdict, the CLI is single-item only (the no-loss `partition` fold is import-only), the evidence bits are host-produced. Dogfooded over 10 real true-but-parked fak findings; names the wiring fak still needs.
- [DOS fresh-install value dogfood, from the laptop (2026-06-25)](docs/notes/DOS-FRESH-INSTALL-VALUE-DOGFOOD-LAPTOP-2026-06-25.md) — the outward fresh-user counterpart to the inward dogfood loop (`internal/dogfoodscore`): a genuine `pip install dos-kernel` into a clean venv on the laptop, then the first-60-seconds value path captured verbatim. One dependency (PyYAML only), ~20s install, and `dos quickstart` (1.4s) lands the whole pitch — an agent claims it shipped AUTH1+AUTH2, git says only AUTH1 landed (exit 0 vs exit 1), then a lease-lane collision is refused not silently overwritten. `dos commit-audit` caught a planted lie (subject claims a code fix, diff touches only a README → UNWITNESSED, exit 1) and passed an honest doc commit. Records the honest newcomer friction too: `dos --version` is not a flag, `--hooks auto` needs a real agent repo, and the install timing was warm-cache.
- [Gate down the stack (2026-06-22)](docs/notes/EXPLAINER-gate-down-the-stack-2026-06-22.md)
- [Trust floor, two lenses (2026-06-17)](docs/notes/EXPLAINER-trust-floor-two-lenses-2026-06-17.md)
- [GLM-5.2 DSA attention projections on the pure kernel (2026-06-22)](docs/notes/GLM52-DSA-PROJECTIONS-ON-PURE-KERNEL-GPU-SERVER-2026-06-22.md)
- [GLM-5.2 DSA sparse attention on the pure kernel (2026-06-23)](docs/notes/GLM52-DSA-SPARSE-ATTENTION-ON-PURE-KERNEL-2026-06-23.md)
- [GLM-5.2 DSA index selection on the pure kernel (2026-06-23)](docs/notes/GLM52-DSA-INDEX-SELECTION-ON-PURE-KERNEL-2026-06-23.md)
- [GLM-5.2 full DSA forward on the pure kernel, sm_80 GPU server (2026-06-23)](docs/notes/GLM52-DSA-FULL-FORWARD-ON-PURE-KERNEL-GPU-SERVER-2026-06-23.md)
- [GLM-5.2 fak-native serve: load works, load-speed open (2026-06-25)](docs/notes/GLM52-FAK-NATIVE-SERVE-LOAD-SPEED-2026-06-25.md) — full 466 GB GLM-5.2 loads in fak's own kernel; loader + MLA-dims panic fixed; the open item is a CPU-bound (not disk) ~100-min load and the path to <=10 min.
- [GLM-5.2 fak-native CPU serve: load works, the all-resident serve wedges on RAM (2026-06-27)](docs/notes/GLM52-FAK-NATIVE-CPU-SERVE-MEMORY-WEDGE-2026-06-27.md) — first fak-native attempt to serve the full ~433 GB GLM-5.2 UD-Q4_K_M on a 256-core/1 TB CPU-only host; the resident-Q4_K load (~95 min, ~0.06–0.10 GB/s) reaches ~458 GB resident and the all-resident serve wedges the host at gateway-init (no CPU-path memory-fit guard, #974); llama.cpp's mmap path is the memory-safe baseline.
- [GLM-5.2 five GPU server benchmarks (2026-06-22)](docs/notes/GLM52-PERFORMANT-GPU-SERVER-FIVE-BENCHMARKS-2026-06-22.md)
- [GLM-5.2 kernel + turn demos (2026-06-21)](docs/notes/GLM52-PURE-KERNEL-AND-AGENT-TURN-DEMOS-RESULTS-2026-06-21.md)
- [GLM-5.2 pure kernel on GPU server (2026-06-21)](docs/notes/GLM52-PURE-KERNEL-ON-GPU-SERVER-2026-06-21.md)
- [GLM-5.2 real-checkpoint generation matches HuggingFace on the pure engine (2026-06-23)](docs/notes/GLM52-REAL-ORACLE-GENERATION-ON-PURE-FAK-2026-06-23.md)
- [GLM-5.2 first native throughput, next steps & honest benchmarking plan (2026-06-25)](docs/notes/GLM52-NATIVE-THROUGHPUT-AND-BENCHMARK-PLAN-2026-06-25.md) — the first native `glm_moe_dsa` decode/prefill tok/s on a GPU server (26.53 decode @ L8/H2048, synthetic-kernel scope), the per-prefill-position VRAM-leak fix (`b68a182`) that unblocked it, the prioritized next steps (P0 = the DSA-kernel illegal-access at the largest configs), and a category-honest ladder for comparing fak to the llama.cpp 753B baseline (2.62 tok/s) / vLLM / SGLang without a scale-mismatch error.
- [GLM-5.2 decode: the path to 10 tok/s on the pure fak kernel (2026-06-27)](docs/notes/GLM52-DECODE-PATH-TO-10-TOKS-2026-06-27.md) — localizes the real 753B cpu-offload serve's <0.1 tok/s decode to structural device glue (~1100 synchronous device↔host round-trips/token), quantifies the host expert-kernel ceiling (single-core ~0.55 GiB/s; parallel scaling poor; batched dispatch ~1.8×), and prioritizes the three levers to 10 tok/s (pure-CPU vs hybrid, batched expert dispatch, a vectorized int8 reducer) with the GPU server experiment matrix.
- [Mac bench refresh: CPU Q8 parity + uncontended radix (2026-06-23)](docs/notes/MAC-BENCH-REFRESH-2026-06-23.md)
- [Mac bench battery: own-forward ladder + live session-value + radix regression + agent-live (2026-06-25)](docs/notes/MAC-BENCH-BATTERY-2026-06-25.md) — two sleep-resilient waves on node-macos-a: 7B own-forward decode revised up to ~10.4–10.9 tok/s (two-source), the multi-agent session-value stack measured live (1.13× vs warm cache / 3.28× vs cold), a clean RadixAttention regression pass, 14B/27B residency, and the agent-live coverage gap filled (incl. the read-only-policy-denies-the-task finding).
- [The O(1) current turn: a planned view over the lossless history (2026-06-23)](docs/notes/O1-TURN-CONTEXT-PLANNER-2026-06-23.md) — cost-based, forecast-driven context planner; the middle ground between an unbounded transcript and lossy compaction.
- [On-demand context KV reuse (2026-06-19)](docs/notes/ON-DEMAND-CONTEXT-KV-REUSE-2026-06-19.md)
- [Cloud/VM/remote-control agent landscape + fak strategy (2026-06-23)](docs/notes/RESEARCH-cloud-vm-remote-agent-landscape-2026-06-23.md)
- [Random time horizons of agent usage: dormancy clock + horizon-gated rehydration (2026-06-28)](docs/notes/RESEARCH-random-time-horizons-dormancy-rehydration-2026-06-28.md) — research+design backing epic #1178: make *how long an agent was off* a first-class MEASURED quantity and scale rehydration rigor to the gap (warm<5m → ancient≥30d). Maps DBOS/Temporal durable timers, Durable-Object hibernation+Alarms, CRaC afterRestore, etcd/Chubby fencing tokens, and Letta sleep-time memory onto fak's half-built, DISCONNECTED time primitives (`internal/resume` idle-vs-TTL shipped shadow-only, `session.WaitResume`/`WarmKVSplicer` unwired with `sessionimage.KVIncluded=false` → always cold re-prefill, `leaseref` TTL without a fence = #906-C1, `bgloop` fixed interval). Names the net-new layer — dormancy clock, rehydration orchestrator + rungs (lease-fence/cred/recall/cache), durable wake + duty-cycle, time-travel test harness — as the epic's ten children (#1179-1192). Planning/research only, no code.
- [idea-scout triage: Doberman-Core as prior art (2026-06-23)](docs/notes/RESEARCH-doberman-prior-art-triage-2026-06-23.md)
- [idea-scout triage: defensive misdirection (CMPE) — theory-side support for detector-is-not-the-floor, deceptive mechanism not adopted (2026-06-23)](docs/notes/RESEARCH-defensive-misdirection-triage-2026-06-23.md)
- [idea-scout triage: 'When AUC 0.998 Is Not Enough' — probe-AUC is not detection; evidence for detector-is-not-the-floor (2026-06-23)](docs/notes/RESEARCH-probe-auc-evaluation-protocol-triage-2026-06-23.md)
- [Git operations in the kernel prefilter — what's possible (2026-06-22)](docs/notes/RESEARCH-git-in-kernel-prefilters-2026-06-22.md)
- [Grammar-constrained tool-call decoding, upstream vs downstream (2026-06-22)](docs/notes/RESEARCH-grammar-constrained-tool-call-decoding-2026-06-22.md)
- [A local model on the wire: first use case + when-it-makes-sense (2026-06-23)](docs/notes/RESEARCH-local-model-on-the-wire-2026-06-23.md) — small local model as a witnessed lossy proposer; first rung is a semantic poison screen behind ctxmmu's regex floor; outbound compression is blocked on the req.Raw passthrough.
- [Handoff prompts: extending the local-model-on-the-wire spine (2026-06-23)](docs/notes/PROMPTS-local-model-on-the-wire-next-agents-2026-06-23.md) — paste-ready prompts for the next agents to build rungs 2-5 on the shipped spine (epic #568); names each seam, witness, and the #555 outbound blocker.
- [idea-scout triage: MCPPrivacyDetector — protocol-induced MCP-server leakage; prior art + a threat fak already gates at runtime (result-admit), static analyzer not adopted (2026-06-23)](docs/notes/RESEARCH-mcp-privacy-leakage-triage-2026-06-23.md)
- [idea-scout triage: Tool-Guard / isolated planning — a threat axis fak does not yet gate (2026-06-23)](docs/notes/RESEARCH-tool-guard-isolated-planning-triage-2026-06-23.md)
- [idea-scout triage: relinking at the compression boundary — fak immune (extractive compression + call-not-prompt floor); prior art + a guarded invariant for future generative summarizers (2026-06-23)](docs/notes/RESEARCH-relinking-compression-boundary-triage-2026-06-23.md)
- [idea-scout triage: CLAWAUDIT / source-code audit of the agent runtime layer — prior art validating 'the runtime IS the boundary' thesis + an audit methodology to mirror on fak's own seven components; static-rule tool not adopted (2026-06-24)](docs/notes/RESEARCH-agent-runtime-source-audit-triage-2026-06-24.md)
- [idea-scout triage: PrologMCP — a stateful Prolog solver exposed over MCP; a capability paper (symbolic delegation), not the MCP-security topic it surfaced under; close / not adopted — a server fak GOVERNS (sits behind the gateway), not a kernel component; its three named design properties each map to a shipped fak server-facing seam (2026-06-24)](docs/notes/RESEARCH-prologmcp-symbolic-tool-triage-2026-06-24.md)
- [idea-scout triage: agentic surveillance / SurveilBench — a trust topology INVERTED from fak's (the agent surveils its own user for a provider); fak gates the egress 'send-the-report' step ONLY when the operator runs the gateway for the user, and the paper's evasion defense (prompt-injection repurposed) is the inverse of fak's injection-is-non-load-bearing floor; prior art to cite + a named scope boundary, mechanism not adopted (2026-06-25)](docs/notes/RESEARCH-agentic-surveillance-evasion-triage-2026-06-25.md)
- [idea-scout triage: AgenticOS / intent-oriented secure OS (#770) (2026-06-26)](docs/notes/RESEARCH-agenticos-intent-os-triage-2026-06-26.md) — triage of arXiv:2606.21129 (Zhao et al., "AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents"): "resource exposure + permission checks" OS security fails once an agent runtime is compromised, because the attacker composes POSIX primitives past the user's task authorization; AgenticOS reframes the OS from a "resource manager" into an "intent filter" — agents submit structured **intent declarations** → the system synthesizes a least-privilege env with **mandatory mediation, auditing, and information-flow constraints** — via a four-layer kernel (Ghost Kernel, Logic Shutter, Agent Capsule, Semantic Boundary Gateway) + Intent ABI / Manifest-Only Runtime / Weaver capability generation / native-Skill admission. Verdict: **prior art to cite** — the cleanest **OS-altitude** statement of fak's founding premise, and its four required properties map onto shipped fak seams that realize them **in userspace** (default-deny capability floor, the one in-process syscall boundary, the witness/decision journal, result-admit quarantine + `wirescreen` + `SinkGate`). Same side of the trust boundary as fak (not a threat). The four-layer **OS-rebuild** architecture + Weaver synthesis are **not adopted** — fak's bet is one userspace binary at the tool-call seam ([one-binary-one-surface](docs/explainers/one-binary-one-surface.md)), not a new kernel; the honest fence is that an OS-altitude filter mediates a strictly larger primitive set at a strictly larger adoption cost.
- [idea-scout triage: Kamera / position-invariant multimodal KV cache (#583) (2026-06-26)](docs/notes/RESEARCH-kamera-position-invariant-kv-triage-2026-06-26.md) — triage of arXiv:2606.23581 (Ma, Eitzinger, Koestler, Wellein, "Kamera: Unified Position-Invariant Multimodal KV Cache for Training-Free Reuse"): prefix caches serve reuse only at a fixed leading position, so multimodal agents re-encode the same video frames / UI screenshots on every look-back; naive non-prefix KV reuse loses the **cross-chunk conditioning** a chunk absorbs from neighbours, and the loss is **asymmetric** — the direct readout is recovered free by the standard **state-merge**, but a diffuse low-rank residue in deep layers remains, invisible to single-hop retrieval yet **halving multi-hop accuracy**; Kamera repairs it with a training-free **low-rank conditioning patch** + one **RoPE re-rotation** operator across MLA/GQA/MHA (recovers full task accuracy on MM-NIAH + 2-page doc-QA, reconstructs KV within bf16 rounding in a production SGLang kernel across six backbones; strongest in vision/video). Verdict: **prior art to cite** — the paper fak's own [ON-DEMAND-CONTEXT-KV-REUSE](docs/notes/ON-DEMAND-CONTEXT-KV-REUSE-2026-06-19.md) note §2.2/§2.3 anticipated and left open (CacheBlend cross-attention loss + MiniPIC position-independent-but-insufficient), now characterized precisely and given a training-free repair — **and a candidate repair** for the conservative RECOMPUTE/REFUSE fault fak's #109 non-prefix-KV audit (`internal/model/nonprefix_kvreuse_audit_test.go`) takes by design. **Adopt only at fak's reserved corrective-path tier (ON-DEMAND §6 Step 5, at #109 × the governed vision seam #399) — NOT in this increment** (a GPU/kernel epic + it needs a gate fak lacks). **One named invariant:** Kamera's bar is full task accuracy + within-bf16-rounding KV, not fak's bit-exact last-logit; because the loss is asymmetric a patched reuse can pass fak's single-last-logit #109 oracle (a single-hop-shaped probe) while halving multi-hop accuracy — so any future patch that promotes a RECOMPUTE fault to a served HIT must clear a **multi-hop** cross-chunk-binding quality probe, never the single-logit check alone. Not a threat (a performance capability on the same side).
- [idea-scout triage: joint intent+harm verification (#910) (2026-06-26)](docs/notes/RESEARCH-intent-harm-joint-verification-triage-2026-06-26.md) — triage of arXiv:2606.26377 (Thota, Lei, Thangaraj, Jonnalagadda, Nilizadeh, "Verifying Intent and Harm: A Unified Defense Against LLM-Generated Threats"): prompt-only and response-only defenses miss attacks that exploit the **separation** between adversarial **intent** (in the prompt) and actionable **harm** (only in the response); the paper proposes a verify-before-deliver framework — a specialized **Intent Analyst** (scores prompt intent) + a specialized **Harm Analyst** (scores response harm) + a **Judge** that resolves conflicts (reported F1 0.90→0.95, ASR 4.1%, benign-sensitive FPR 0.12→0.06 across jailbreaks/prompt-injection/phishing/cyber-abuse/harmful-content, tested under adaptive attackers who know the verifier). Verdict: **prior art to cite** — the join-intent-with-harm thesis is fak's **two-sided adjudication** design at the detector altitude: the kernel already splits the same axis structurally (`k.Decide` folds **only** the pre-call **intent** chain; `k.AdmitResult` is the in-code documented **dual of Decide** and folds the result-side **harm** chain — quarantine + IFC taint + `wirescreen`/`SinkGate` egress floor), and the `dos verify` / `dos commit-audit` referee re-checks claimed intent against the actual diff-borne harm. The three-LLM-analyst + Judge **mechanism is NOT adopted** — it is a learned detector, and fak's recorded position is **detector-is-not-the-floor** ([defensive-misdirection](docs/notes/RESEARCH-defensive-misdirection-triage-2026-06-23.md), [AUC-is-not-detection](docs/notes/RESEARCH-probe-auc-evaluation-protocol-triage-2026-06-23.md)); the paper's own adaptive-attacker result is the evidence that a learned verifier is evadable where fak's default-deny capability floor the model "can't talk past" is not. **Named residual:** the Harm Analyst scores **content harm in text** (the model emitting phishing/harmful words) that fak's capability gate does not score at the tool-call seam — a genuine best-effort-detector rung fak hosts **above** its floor, not on the load-bearing path. Not a threat (a parallel defense on the same side of the boundary).
- [idea-scout triage: ShareLock / multi-tool threshold tool-poisoning against MCP (#911) (2026-06-26)](docs/notes/RESEARCH-sharelock-multitool-threshold-poisoning-triage-2026-06-26.md) — triage of arXiv:2606.27027 (Liu, Han, Liu, Dong, Ruan, "ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP"): a Tool Poisoning Attack that fragments its malicious instruction with **Shamir's (t, n) threshold secret-sharing** across MULTIPLE innocent-looking MCP tool descriptions, reconstructing the hidden instruction only on a **trigger (a server update)** — claiming **information-theoretic** stealth (no description below threshold reveals intent), >90% success, and provable outperformance of single-tool poisoning against **tool-description-based detectors**. Verdict: **prior art to cite + a real threat whose consequence the capability floor already contains** — ShareLock attacks the **detection layer** fak deliberately keeps **off the load-bearing path** (`CLAIMS.md` "Honest ceiling": detection is ~100% evadable, **non-load-bearing**), so its core move (disperse-to-evade a description scanner) is **neutralized by construction** against a floor that never reads the descriptions for a verdict and gates the resulting **action** (default-deny capability lock, units 15/29) and **result** (result-admit quarantine, unit 48) instead. ShareLock is the cleanest external **information-theoretic** proof of fak's *detector-is-not-the-floor* thesis, alongside [defensive-misdirection](docs/notes/RESEARCH-defensive-misdirection-triage-2026-06-23.md) / [AUC-is-not-detection](docs/notes/RESEARCH-probe-auc-evaluation-protocol-triage-2026-06-23.md) / [MCPPrivacyDetector](docs/notes/RESEARCH-mcp-privacy-leakage-triage-2026-06-23.md). **Named residual:** fak does not screen inbound third-party tool descriptions, and a poisoned description can still induce a **policy-ALLOWED** call with malicious arguments — the standing residual of any capability floor, **contained** (not intercepted) by IFC taint + egress sink-gating. The Shamir-sharing mechanism is **not adopted** (adding a description scanner is the anti-pattern ShareLock refutes); the smallest honest follow-on is to treat a downstream **tool-definition change** as a witnessed provenance event (the trigger fires on server update), filed against the `fak_refute_witness` / `fak_changes` seam. No change to `tools/idea_scout.py` — surfaced and scored correctly (topic mcp-security, score 53).
- [idea-scout triage: teaching software engineering with LLM + MCP (#1009) (2026-06-27)](docs/notes/RESEARCH-llm-mcp-se-education-triage-2026-06-27.md) — triage of arXiv:2606.19167 (Chen, Keung, Li, Shao, Li, Ma, "Teaching Software Engineering with LLM and MCP Integration: From Classroom to Industry Practice"): a software-engineering **EDUCATION / pedagogy** study that embeds LLM- and MCP-driven tools into a collaborative **teaching model** (daily teaching, code assistance, engineering simulations) plus industry-internship partnerships, to bridge classroom instruction and industrial workflows. Verdict: **close / not adopted — out of kernel scope** — fak is a runtime trust + performance gate at the tool-call seam, not a curriculum, teaching platform, or learning framework; the paper proposes **no system fak would adopt, no attack to defend against, and no mechanism-level prior art** for fak's adjudication / cross-turn-reuse design (a clean off-mission sibling of the [PrologMCP capability/security miscategorization](docs/notes/RESEARCH-prologmcp-symbolic-tool-triage-2026-06-24.md)). **Recorded residual (context, not a citation):** the paper is one more external data point that **MCP is moving into mainstream industrial — and now academic — SE practice**, the adoption trend that makes a default-deny capability floor on MCP tool calls worth shipping; it is kept as *why-now* context, never cited as prior art for a fak mechanism. **Scout calibration:** surfaced under `mcp-security` (score 47, the lowest of the day's three hits) on a bare `model context protocol` / `mcp (title)` keyword match + freshness — a true **on-topic-by-keyword, off-mission-by-content** candidate, the scout working **as designed** (judges new-and-on-topic, never worth-building; hands to human triage). No change to `tools/idea_scout.py`.
- [idea-scout triage: where do CoT training gains land in agents? (#1008) (2026-06-27)](docs/notes/RESEARCH-cot-training-gains-agents-triage-2026-06-27.md) — triage of arXiv:2606.26935 (Liu, Wang, Jing, Zhou, Liu, "Where Do CoT Training Gains Land in LLM based Agents?"): an **interpretability / training-analysis** study that asks where CoT-training gains land — in **changing the action through generated reasoning** (CoT actions) or in **predicting the action directly from the prompt** with no CoT (prompt actions) — and finds, across checkpoints, that **prompt-action quality improves substantially**, i.e. much of the gain lands in the direct prompt→action mapping rather than in reasoning-driven action change, consistent with prior **CoT-unfaithfulness / post-hoc-rationalization** findings. Verdict: **prior art to cite — not adopted, not a threat** — fak never reads the model's verbalized reasoning for a verdict and never trusts a self-report; it gates the resulting **action** at the tool-call seam (default-deny capability floor) and re-checks claimed work against the **diff** (`dos verify` / `dos commit-audit`), so this is independent **training-time** evidence for fak's **detector-is-not-the-floor / witness-not-self-report** bet (the action is largely fixed by the prompt before the CoT is written, so a CoT-reading detector audits a post-hoc narrative). It is the **CoT-as-explanation** sibling of the contested **attention-as-explanation** demotion in fak's reward-over-spans epic [#861](https://github.com/anthony-chaudhary/fak/issues/861)/[#862](https://github.com/anthony-chaudhary/fak/issues/862) ([witnessed-span-attention-validity](docs/notes/RESEARCH-witnessed-span-attention-validity-2026-06-26.md)): a self-generated explanation is a **proposal to verify against an action-level witness**, never an accepted causal account. **Recorded residual (NOT adopted):** high prompt-action quality means CoT tokens are non-load-bearing on the easy mass of steps — a **token-economy** lever for the `fak dojo` gym ([#951](https://github.com/anthony-chaudhary/fak/issues/951)) / token-saving-defaults program — but only behind a **per-model, per-task accuracy acceptance gate fak lacks**, and the paper itself shows CoT still **changes the action on the hard tail**, so blind CoT-dropping is unsafe and explicitly not shipped. **Scout calibration:** surfaced under `agent-model-arch` (score 50) on genuine `training (title)` / `checkpoint` / `reasoning` terms + freshness — correctly on-topic and **closer-to-mission** than the day's #1009 pedagogy hit; the scout working **as designed**. No change to `tools/idea_scout.py`.
- [idea-scout triage: MIRROR / novelty-constrained memory-guided MCTS red-teaming for agentic RAG (#1007) (2026-06-27)](docs/notes/RESEARCH-mirror-novelty-mcts-redteam-triage-2026-06-27.md) — triage of arXiv:2606.26793 (Singh, Murillo, Sekiya, Unno, Suga, "MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG"): an **offensive cross-surface attack GENERATOR** for multimodal agentic RAG — memory-guided Monte Carlo tree search that conditions candidate generation on retrieved context under a **deterministic Novelty Gate** (rejects any candidate matching the retrieval set under normalized comparison) across **text poisoning / image injection / direct-query / orchestrator-level tool manipulation**, motivated by measuring **73-84% exact template duplication** in existing surface-specific red-teaming. Verdict (three-part, the shape of [#909](docs/notes/RESEARCH-out-of-band-injection-defense-taxonomy-triage-2026-06-26.md) / [#911](docs/notes/RESEARCH-sharelock-multitool-threshold-poisoning-triage-2026-06-26.md)): **(1) prior art to cite** — MIRROR is the **SOTA academic form of fak's own dynamic red-team** (`internal/agentdojo`'s `{plain,obfuscated,paraphrased}` adaptivity axis + `examples/agentdojo-redteam`'s marker-free generative expander) and the **named answer** to the #909 follow-on (make fak's AgentDojo-style ASR battery adaptive, defense-aware, and **cross-surface**, not a static injection set); its deterministic Novelty Gate is the formal sibling of fak's own `tools/idea_scout.py` dedup/novelty rungs (seen-cache + Jaccard near-dup rejection). **(2) A real threat whose CONSEQUENCE the structural floor already contains** — MIRROR's entire edge is **novelty engineered to evade template/pattern detectors**, but fak's full-stack defense taints by **PROVENANCE not content**, so the egress/destructive sink is barred *"regardless of phrasing"* (`internal/agentdojo/agentdojo.go`: ASR(full-stack)==0 vs ASR(detection-only)>0) — the novelty axis is **invariant against the floor by construction**, the same outcome as [ShareLock #911](docs/notes/RESEARCH-sharelock-multitool-threshold-poisoning-triage-2026-06-26.md); the novelty advantage lands entirely on the detection-only layer fak keeps **off the load-bearing path** (~100% evadable, by design). **Named residual:** containment is not a *measured number* — fak has no adaptive cross-surface ASR-under-containment metric, and the **image-injection** (#290, `internal/model/multimodal`, fail-closed `MultimodalModeQuarantine`) / **orchestrator** (gateway/MCP, adjudicated tool call) surfaces are governed but unmeasured against an adaptive generator. **(3) Mechanism NOT adopted** — fak is a defense; the one-binary zero-dep kernel does not generate attacks (no MCTS / memory / LLM-conditioned generator on the request path; `OUT_OF_DIRECTION` would refuse it). The smallest honest follow-on is the **evaluation upgrade** (expand `internal/agentdojo` toward a novelty-constrained cross-surface generator + add the image/orchestrator surfaces, turning the standing `docs/industry-scorecard/security.md` "no measured adaptive ASR" fence into a tracked agentdojo-lane task), filed not built — with the fence that MIRROR is cited as a **methodology + a contained threat**, never as evidence fak's containment is adaptively robust. No change to `tools/idea_scout.py` — surfaced and scored correctly (topic `prompt-injection-defense`, score 50).
- [idea-scout triage: how reliable is your jailbreak judge? / ASR-judge calibration + adversarial robustness (#1097) (2026-06-27)](docs/notes/RESEARCH-jailbreak-judge-asr-reliability-triage-2026-06-27.md) — triage of arXiv:2606.25487 (Yang Gao, "How Reliable Is Your Jailbreak Judge? Calibration and Adversarial Robustness of Automated ASR Scoring"): a **measurement-validity** study that checks the automated **judge** assigning nearly every reported attack-success-rate (ASR) — a safety classifier or a prompted chat model — against **596 human-labeled** HarmBench completions, then attacks it. The two families fail in opposite ways: the dedicated classifier **over-flags** (P **0.835**, R **0.974**); three LLM-as-judges keep high precision (**0.81-0.94**) but **erratic recall (0.06-0.65)**, so the same responses yield very different ASR by judge. **Benign framing wrappers** that leave the harmful text intact flip **every LLM-judge 57-100%** (a single prepended refusal sentence = **39-88%**); the classifier resists surface attacks (**≤6.7%**) but a small-budget **white-box GCG** on its open weights flips **70%** of its confident true positives (21/30) — an 80-sample audit confirms the flips left the harm intact. Verdict: **prior art to cite — not adopted, not a threat** — it is measured, external evidence for fak's **detector-is-not-the-floor / witness-not-self-report** thesis and a direct validation of fak's **choice of success criterion**: fak's own ASR (`asr_fullstack=0` = 0/38, `asr_detection=0.763` = 29/38, `benign_completion_rate=1`) is assigned by **no judge model at all** — `internal/agentdojo/agentdojo.go` computes `succeeded := injectionReachedContext && sinkExecuted` from deterministic adjudicator verdicts (`VerdictQuarantine` / `VerdictDeny`; the code comment reads *"Deterministic, in-process, no model"*), `catch_reasons` drawn from the closed structural vocabulary (`TRUST_VIOLATION` 29 / `MALFORMED` 9). Because there is no judge model in fak's success decision, the three attack families the paper documents (framing wrappers, prepended-refusal, GCG-on-judge-weights) are **out of fak's metric by construction** — you cannot frame your way past a `VerdictDeny` that gates **PROVENANCE** (tainted→sink), not content (same shape as [MIRROR #1007](docs/notes/RESEARCH-mirror-novelty-mcts-redteam-triage-2026-06-27.md) / [ShareLock #911](docs/notes/RESEARCH-sharelock-multitool-threshold-poisoning-triage-2026-06-26.md)). The metric-side twin of [AUC-is-not-detection](docs/notes/RESEARCH-probe-auc-evaluation-protocol-triage-2026-06-23.md) / [defensive-misdirection](docs/notes/RESEARCH-defensive-misdirection-triage-2026-06-23.md) and the [FRONTIER survey](docs/notes/FRONTIER-AGENT-LEADERBOARD-SURVEY-2026-06.md) HAL *"benchmarks gameable to near-perfect without solving tasks"* anchor. **Honest fence (carried forward):** the immunity is specific to fak's **structural flow-reachability witness** — the day fak reports a **judge-mediated** ASR (a content-harm probe, or any external benchmark whose ASR is LLM-graded and that fak compares against), it must adopt the paper's protocol: report **judge precision/recall on a human-labeled slice**, report **ASR corrected for judge precision**, and include an **adversarial check of the judge**. **Mechanism not adopted** (a measurement-validity result, no kernel surface). No change to `tools/idea_scout.py` — surfaced and scored correctly (topic `prompt-injection-defense`, score 47).
- [idea-scout triage: data-centric survey of privacy in LLM agents (#1098) (2026-06-27)](docs/notes/RESEARCH-agent-privacy-data-centric-survey-triage-2026-06-27.md) — triage of arXiv:2606.26627 (Lahjouji, Colaco, "Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents"): a **survey** that organizes LLM-agent privacy around the **data an agent touches** — taxonomizing the data sources (databases, document collections, external APIs, agent memory, cross-session state), the privacy risk each creates (**query leakage, intermediate-result exposure, memory-write vulnerabilities, inter-agent messaging**), and the **governance mechanisms** that address them (it names **information-flow control** + access control), then maps the benchmarks and identifies what is missing. Verdict: **prior art to cite + a real multi-channel threat fak's own IFC governance gates UNEVENLY by provenance** — fak ships one of the two governance families the survey names (`internal/ifc`: a provenance taint `Ledger` (`SourceTaint`) → a `SinkClass` (Egress/Exec/Destructive) → `Policy.Gates` refusing a tainted→gated-sink flow, `DefaultGatedSinks`=EGRESS+DESTRUCTIVE, CaMeL-style `Authorize` escape), so the **final-answer/egress** sink and the **secret-shaped intermediate-result** channel (the [#552 result-admit gate](docs/notes/RESEARCH-mcp-privacy-leakage-triage-2026-06-23.md)) are **gated-by-provenance**; but the survey's **query-issuance** channel is gated-by-capability not by a privacy assessment of the query content, **memory-write** rides the [memory-view contract](docs/notes/MEMORY-VIEW-CONTRACT-2026-06-26.md) read-side only, and **inter-agent messages** cross a boundary the session-scoped taint ledger does not provably propagate across — all **gated-by-capability-only or unmeasured** — and fak reports **no measured privacy-leakage number** (the same *containment-is-not-a-measured-number* residual as [MIRROR #1007](docs/notes/RESEARCH-mirror-novelty-mcts-redteam-triage-2026-06-27.md), now stated for the privacy axis). **Mechanism NOT adopted** (a survey, no kernel component); the smallest honest follow-on is a **per-channel privacy-posture audit** (the survey's data-source x risk grid → each channel labeled gated-by-provenance / gated-by-capability-only / unmeasured) + a **candidate privacy-leakage metric**, FILED not built — with the fence the survey is cited as field framing + a coverage map, never as evidence fak's privacy containment is complete or measured. The field-level umbrella over the source-specific [MCPPrivacyDetector triage (#552)](docs/notes/RESEARCH-mcp-privacy-leakage-triage-2026-06-23.md), which instantiates one cell (MCP-server returns). No change to `tools/idea_scout.py` — surfaced and scored correctly (topic `prompt-injection-defense`, score 47).
- [idea-scout triage: PRCR / position-rebinding cache reuse for replay-free visual revisiting (#1099) (2026-06-27)](docs/notes/RESEARCH-position-rebinding-cache-reuse-triage-2026-06-27.md) — triage of arXiv:2606.26631 (Wang, Ji, Zuo, Ye, Tu, "Position Rebinding Cache Reuse: Replay-Free Visual Revisiting for Interleaved Multimodal Reasoning"): interleaved multimodal reasoning revisits visual evidence during multi-step generation and pays for it with **token replay** (re-forwarding selected visual tokens); the shortcut — reusing the historical visual KV cache directly — has a critical failure mode, **cached visual keys are bound to their ORIGINAL positional context**, so reuse under a later decoding context distorts attention and can trigger **SEVERE AUTOREGRESSIVE DECODING COLLAPSE**; PRCR's fix is **position rebinding** (store raw visual KV with original coords, reassign position-compatible coords to selected entries, rebind keys before injecting into the active decoder cache — preserving textual positional continuity + relative visual structure), reporting replay-level-or-better quality, **+5%** average accuracy, and up to **tens-of-thousands×** less visual-revisiting compute. Verdict: **prior art to cite — the collapse-naming sibling of [Kamera #583](docs/notes/RESEARCH-kamera-position-invariant-kv-triage-2026-06-26.md)** and the second hit in the non-prefix / position-aware visual-KV-reuse neighbourhood fak's own [ON-DEMAND-CONTEXT-KV-REUSE](docs/notes/ON-DEMAND-CONTEXT-KV-REUSE-2026-06-19.md) note §2.2/§2.3 anticipated and its **#109** non-prefix-KV audit (`internal/model/nonprefix_kvreuse_audit_test.go`) proves locally. Where Kamera characterized the loss as a diffuse residue that **halves multi-hop accuracy**, PRCR names the **worst case** (an outright collapsed decode) — the strongest external justification yet for fak's **#109 RECOMPUTE/REFUSE** conservative default (*"a failed exactness budget must produce RECOMPUTE/REFUSE, never HIT"*). The sharp insight: fak's shipped EXACT reuse is **prefix-only**, where cached tokens occupy the **same** leading positions on reuse, so PRCR's failure mode **cannot arise on fak's exact surface by construction** — it appears only at the non-prefix splice the #109 audit refuses; PRCR is independent evidence fak's **prefix-only-exact HIT + non-prefix-faults-to-recompute** structure is the safe one. **Adopt the rebinding operator only at fak's reserved corrective-path tier** (ON-DEMAND §6 Step 5, at #109 × the governed vision seam `internal/model/multimodal.go` #399, fail-closed `MultimodalModeQuarantine`) — **NOT in this increment** (a GPU/kernel epic + it needs a quality gate fak lacks). **One named invariant** (carried from the Kamera triage and tightened): a rebinding patch that promotes a RECOMPUTE fault to a served HIT must clear a **multi-hop** cross-chunk quality probe AND a **no-collapse** check — fak's bit-exact-last-logit-or-fault gate already enforces the no-collapse half for free (a within-rounding rebind keeps faulting), so the binding precondition for USING a rebind is the multi-hop probe fak still lacks. Not a threat (a performance capability on the same side). No change to `tools/idea_scout.py` — surfaced and scored correctly (topic `kv-prefix-cache-reuse`, score 47).
- [idea-scout triage: progress advantage — a free RL-post-training step reward for LLM agents (#1122) (2026-06-28)](docs/notes/RESEARCH-progress-advantage-rl-posttraining-triage-2026-06-28.md) — triage of arXiv:2606.26080 (Oh, Li, Park, Yeh, Mallick, Li, "Neglected Free Lunch from Post-training: Progress Advantage for LLM Agents"): process reward models give step-level LLM evaluation but are prohibitively hard to build for **agentic** settings (long-horizon, irreversible actions, stochastic feedback defeat annotation + Monte-Carlo at scale); the paper shows **RL post-training already contains the step-level signal** — under a general stochastic MDP the **log-prob ratio between the RL-trained policy and its reference policy exactly recovers the optimal advantage** (termed **progress advantage**: annotation-free, domain-agnostic, a free byproduct of the standard post-training pipeline), validated on test-time scaling / uncertainty quantification / failure attribution across 5 benchmarks + 4 model families, beating confidence baselines and **surpassing dedicated trained reward models**. Verdict: **prior art to cite — at the thesis level, with a sharp boundary** — the paper's "the existing pipeline already contains the step-level signal, so train no dedicated judge" is the **reward-modeling-side sibling** of fak's witness referee (`dos verify` / `dos commit-audit` grade a claim against the **diff git actually recorded** — a derived, annotation-free witness — not a trained reward model or the worker's self-report), and the empirical "free signal beats trained PRMs" is independent support for that **don't-build-the-judge** bet. **Sharp fence:** progress advantage is the policy's **own log-probability** (benchmarked against **confidence-based** baselines), a **model-internal self-report**; fak's recorded **detector-is-not-the-floor / witness-not-self-report** stance ([defensive-misdirection](docs/notes/RESEARCH-defensive-misdirection-triage-2026-06-23.md), [AUC-is-not-detection](docs/notes/RESEARCH-probe-auc-evaluation-protocol-triage-2026-06-23.md)) keeps a signal read off the model's own probabilities **above** the trust floor, never **on** it — the **policy-log-prob sibling** of the CoT-as-explanation demotion in the [#1008 CoT-training triage](docs/notes/RESEARCH-cot-training-gains-agents-triage-2026-06-27.md) and the attention-as-explanation demotion in [#861](https://github.com/anthony-chaudhary/fak/issues/861)/[#862](https://github.com/anthony-chaudhary/fak/issues/862) (a self-generated signal is a **proposal verified against an action-level witness**, never an accepted causal account). **Not adopted as a capability** — fak does not RL-post-train, and the "free lunch" needs paired RL-policy + reference-policy log-probs for the SAME served model that **fak's third-party/local fleet has no reference policy for**, so the signal is **not even computable** on fak's models; no kernel surface (same off-mission shape as #1008 / [#1098 privacy survey](docs/notes/RESEARCH-agent-privacy-data-centric-survey-triage-2026-06-27.md)). **Not a threat.** **One recorded residual, NOT adopted:** progress advantage as a **cheap proposal signal** for fak's trajectory graders (the paper's **failure-attribution** application maps onto fak's failure-to-witness need — fleet closure-honesty + the `fak dojo` predict→run→measure→eval→calibrate gym [#951](https://github.com/anthony-chaudhary/fak/issues/951)), gated behind a paired-policy availability fak lacks and fenced as **never-the-floor**. **Scout calibration:** surfaced under `agent-model-arch` (score 44) on genuine `training (title)` + freshness — correctly on-topic; the **third** recent training-time `agent-model-arch` hit fak cannot adopt as a capability (after #1008; cf. #861/#862), an on-topic-by-keyword/off-mission-by-content pattern worth watching but **not** a scoring bug (these still yield citable thesis-level prior art). No change to `tools/idea_scout.py`.
- [idea-scout triage: Tool Suppression under joint tool-call + JSON-schema constraints (#1121) (2026-06-28)](docs/notes/RESEARCH-tool-suppression-constraint-tax-triage-2026-06-28.md) — triage of arXiv:2606.25605 (Li, Zhang, Lv, "Constraint Tax in Open-Weight LLMs: An Empirical Study of Tool Calling Suppression Under Structured Output Constraints"): a **serving-side** result — when Tool Calling and a JSON-Schema output constraint are enabled **jointly**, multiple **open-weight** model families **stop invoking tools** while keeping **high schema compliance**, a phenomenon it names **Tool Suppression** (a **"Constraint Tax"** the structured-output constraint silently levies on the tool-calling capability), reproduced across model families/settings; each capability is functional **in isolation**. Verdict: **prior art to cite + empirical validation of fak's [#907](https://github.com/anthony-chaudhary/fak/issues/907) "one canonical internal shape" decision** — fak models tool-CALLING **as** the schema (`grammar.Grammar` → a `oneOf`-of-tools JSON Schema → the `response_format` carrier OR a native logit mask [#929]), so the **two-competing-constraints** configuration that produces Tool Suppression (an independent output `response_format` stacked on a tool-calling turn) is exactly the one fak's unified shape **avoids**; the paper strengthens #907/#929 rather than asking fak to build anything. **A self-inflicted failure mode fak can induce two ways:** the native guided-decode mask (`internal/model/constraint.go`, behind `FAK_NATIVE_GUIDED_DECODE=1`, which **defaults OFF** — a schema mask is never stacked on a tool-calling turn unless an operator opts in, an accidental protection), and the [#907 passthrough](docs/notes/RESEARCH-structured-output-decoding-2026-06-26.md) (`internal/gateway/http.go:464`) forwarding a client `response_format` to an upstream vLLM/SGLang alongside tools, where any suppression is the **upstream's** behavior — **OBSERVED/relayed, not a fak action** (the controlled-vs-observed conflation boundary). **The load-bearing trust-floor point (why it is labelled `trust-floor`):** a suppressed tool call is **invisible** to fak's default-deny adjudication floor — `internal/adjudicator/decide.go` `Adjudicate(ctx, *abi.ToolCall)` only ever receives a call that **was** emitted, so Tool Suppression is a capability **false-negative below the floor** (no call = nothing to deny = trivially "safe" to a deny-bad-calls gate) that an adjudicator **structurally cannot** catch by adjudicating calls; detection requires **observing the absence** (tool offered + joint schema active + zero calls + schema-valid prose), an **observability** ask fak does not measure today. **Not adopted** as a new mechanism (the right design ships as #907); **not** a classic threat (a constraint-interaction defect, no adversary). **One residual, FILED not built:** a gateway "tool-suppression-suspected" observability counter, gated behind a **served-open-weight reproduction this win32 dev box cannot run** (the "expected a tool call" half needs calibration — shipping it now would be an unwitnessed "expected" claim). No capability code change; no change to `tools/idea_scout.py` (surfaced + scored correctly under topic `tool-call-adjudication`, score 44, on-topic and close-to-mission).
- [idea-scout triage: EpiKV — KV eviction by the epiphany score, no attention matrix (#1123) (2026-06-28)](docs/notes/RESEARCH-epikv-attention-free-eviction-triage-2026-06-28.md) — triage of arXiv:2606.26472 (Kolawole, Smith, "Epiphany-Aware KV Cache Eviction Without the Attention Matrix" / EpiKV): a **serving-side** eviction **policy** — existing methods rank tokens by **attention weight**, which the paper argues is a noisy importance proxy in long reasoning traces AND **prohibits fused kernels** by forcing the model to materialize the attention matrix; EpiKV instead scores tokens by the **epiphany score** (the change in the model's internal representation, read from the forward pass with no attention matrix), training-free and custom-kernel-free. Verdict: **prior art to cite + validation of fak's attention-as-explanation demotion ([#861](https://github.com/anthony-chaudhary/fak/issues/861)/[#862](https://github.com/anthony-chaudhary/fak/issues/862)) in the EVICTION-POLICY domain + a candidate fused-kernel-friendly importance POLICY for fak's policy-agnostic exact-eviction MECHANISM**. fak's value-add is the bit-exact mid-run evictor (`internal/model/kvcache.go` `Evict`, the paged twin `internal/model/paged_evict.go` `PagedKV.Evict` [#33], the `internal/kvmmu/` governance evictor) — it evicts a span handed to it and leaves the cache byte-for-byte `== never-saw-it` (`max|Δ|=0`), so the importance scorer is a **swappable input**; fak already shipped ONE policy — [#856](https://github.com/anthony-chaudhary/fak/issues/856) "attention-informed exact eviction — evict coldest-by-attention via the existing bit-exact evictor" (CLOSED, kvmmu lane), fed by the post-softmax attention mass `internal/model/attn_observer.go` emits. **The load-bearing fak-specific point:** #856's attention mass is materialized for free on fak's CPU softmax seam, but a **fused GPU attention kernel** (FlashAttention/FlashInfer — fak's production decode direction) does NOT materialize the attention matrix, so carrying coldest-by-attention onto the fused path forces materializing it — the exact tax EpiKV names — whereas the epiphany score (a hidden-state delta) is forward-pass-readable without it; EpiKV is the fused-kernel-compatible importance signal for the gap #856 leaves on fak's fused path. **NOT adopted as a mechanism:** fak has an attention-mass observer but NO hidden-state-delta observer (the epiphany score's carrier), and proving any lossy eviction policy preserves answer quality on long reasoning traces needs a **served long-CoT eviction-quality benchmark this win32 dev box cannot run** (host-gated, [AVOID-TESTING-ON-THIS-MACHINE](docs/notes/AVOID-TESTING-ON-THIS-MACHINE-2026-06-25.md)). **Not a threat** (a performance capability, no adversary). **One residual, FILED not built:** a forward-pass hidden-state-delta observer feeding the kvmmu exact evictor (the representation-delta twin of `attn_observer`→#856), gated on that served witness. The one concrete artifact: a §B2 catalog row in [`docs/awesome-token-efficiency.md`](docs/awesome-token-efficiency.md). No capability code change; no change to `tools/idea_scout.py` (surfaced + scored correctly under topic `kv-prefix-cache-reuse`, score 44, on-topic and close-to-mission).
- [idea-scout triage: Pipelock / agent egress firewall with signed action receipts (#1267) (2026-06-29)](docs/notes/RESEARCH-pipelock-agent-egress-receipts-triage-2026-06-29.md) — triage of GitHub repo `luckyPipewrench/pipelock`: a Go agent-egress firewall that mediates HTTP/WebSocket/CONNECT/MCP/A2A traffic, scans for secret exfiltration / SSRF / prompt injection, and emits mediator-signed action receipts. Verdict: **prior art to cite + same-side sibling control** — it independently validates fak's mediator-outside-the-agent boundary and witness-not-self-report stance, especially external evidence from the mediator; scanner/proxy mechanisms are **not adopted** because fak's load-bearing floor remains structured tool-call adjudication, IFC sink gating, and result admission, with detectors deliberately additive. **Named residual:** fak's audit journal is hash-chained and tamper-evident, but not a pinned-signer action-receipt format; signed receipt export is a future audit-evidence follow-on, not shipped here. No change to `tools/idea_scout.py`.
- [idea-scout triage: FuzzingLabs/mcp-security-hub — offensive-security MCP tooling (#1265) (2026-06-29)](docs/notes/RESEARCH-mcp-security-hub-offensive-tooling-triage-2026-06-29.md) — triage of GitHub repo `FuzzingLabs/mcp-security-hub` (595 stars, MIT): a catalog of **38 Dockerized MCP servers across 14 security domains** that expose offensive-security tools to AI assistants — recon (Nmap, Masscan, Shodan), web exploitation (Nuclei, SQLMap, Nikto, Ffuf, Burp), binary RE (Radare2, Ghidra, IDA Pro), credential cracking (Hashcat), AD pathing (BloodHound), exploit lookup (Searchsploit), each wired in through `claude_desktop_config.json`. Verdict: **a concrete dual-use THREAT-SURFACE EXEMPLAR + prior art to cite; mechanism NOT adopted** — it is the first idea-scout candidate that is a real, popular, attach-in-minutes inventory of high-capability offensive tools rather than a paper, i.e. exactly the tool inventory fak's **default-deny capability floor** exists to govern. Each tool reaches fak as a structured tool call; none matches the guard default policy's allowlist or its read-only allow-prefixes (`read_`/`get_`/`search_`/`list_`/`lookup_`/`find_`), so each stays **`DEFAULT_DENY`** at the kernel (`cmd/fak/attest.go:237`) until an operator authorizes it — the **enforced** form of the repo's own README process (obtain written authorization, define scope, maintain audit logs), turned from prose into a capability policy + a hash-chained decision journal, with offensive calls further mapping onto fak's IFC sink classes (Exec/Egress/Destructive). **Honest fence:** fak denies these because they are not allow-listed, **not** because it "knows" Nmap is offensive ([detector-is-not-the-floor](docs/notes/RESEARCH-defensive-misdirection-triage-2026-06-23.md)) — so fak ships **no** curated offensive-tooling starter policy and **no** adjudicator test corpus drawn from this catalog; the smallest honest follow-on is that fixture/corpus, **FILED not built**. **Adopt?** No — fak is the governor, not the offensive toolbox. **Defend against?** Indirectly — the threat is an agent with these tools attached and invoked without authorization/scope; the default-deny floor + journal + sink-gating is the containment. **Cite as prior art?** Yes, as a dual-use threat-surface catalog, never as a fak mechanism — the offensive-MCP sibling of the defensive-MCP triages [#552](docs/notes/RESEARCH-mcp-privacy-leakage-triage-2026-06-23.md) / [#911](docs/notes/RESEARCH-sharelock-multitool-threshold-poisoning-triage-2026-06-26.md) / [#1267](docs/notes/RESEARCH-pipelock-agent-egress-receipts-triage-2026-06-29.md). No change to `tools/idea_scout.py` (surfaced + scored correctly, topic `mcp-security`, score 40).
- [Ultra-long-context: levels, levers, naming (2026-06-22)](docs/notes/RESEARCH-ultra-long-context-levels-and-naming-2026-06-22.md)
- [Scaling laws of agents (2026-06-19)](docs/notes/SCALING-LAWS-OF-AGENTS-2026-06-19.md)
- [Throughput parity and the trust/L3 moat share one spine (2026-06-24)](docs/notes/THROUGHPUT-TRUST-SHARED-SPINE-2026-06-24.md) — connecting tissue between the throughput (dual-track serving) and trust/L3-disaggregation tracks: the bottom half of both roadmaps is the same code (lifecycle seam, KV-span byte form + mover, paged KV, continuous-batching scheduler). The one load-bearing tension — bit-exact `Evict` needs owned `Kraw` rows so it dies on a ridden engine but survives over a fak-governed L3 tier — and a worst-regret-minimizing sequence that front-loads the shared spine then forks hardware-ungated (trust) from hardware-gated (throughput). Every load-bearing claim adversarially verified; epic #637 + seam #638.
- [Capability floor, a security note (2026-06-18)](docs/notes/SECURITY-capability-floor-2026-06-18.md)
- [Security review — multimodal image-handling & DoS surface (#399) (2026-06-26)](docs/notes/MULTIMODAL-IMAGE-HANDLING-SECURITY-REVIEW-2026-06-26.md) — evidence-backed review of the governed vision/multimodal seam (`internal/model/multimodal.go`): each image-handling and DoS threat (pixel-bomb overflow, byte/image/embedding-token flooding, type confusion, width/vocab OOB, source mutation) mapped to its kernel-level mitigation and the test that witnesses it, plus the honest residual fences (upstream-encoder trust, manual rollout gate). Satisfies #399's *Blocked By: security review of image handling* and the Phase 4 security-review DoD item.
- [Session control state as a first-class value (2026-06-24)](docs/notes/SESSION-CONTROL-STATE-AS-FIRST-CLASS-2026-06-24.md) — make a served session's DRIVE state (run-state, planner budget, priority, pace) a TraceID-keyed value read each turn and written live, instead of re-derived from git commits + a 0-byte-log scan. Generalizes the existing `ifc.Ledger` + `/v1/fak/trace` seam, which already proves the live-mutable per-session pattern for one bit (taint), from a bit to a small struct. Design + honest fences; nothing shipped.
- [Portable session images + a uniform dump/restore seam (2026-06-24)](docs/notes/PORTABLE-SESSION-IMAGE-AND-SNAPSHOT-2026-06-24.md) — make a session — and any primitive on the loops ladder (turn, tool, session, fleet, RSI) — a first-class value you can dump, archive, offload, and RESUME across hosts, users, instances, VMs, and a model change. `session.Table.Restore` (durable drive re-attach) + `internal/sessionimage` (a model-agnostic, sha256-integrity bundle + `.faksession` tar that keeps the recall quarantine moat across the offload boundary) + `internal/snapshot` (the uniform envelope over any primitive). SHIPPED; closes the SESSION-CONTROL §5 persistence fence.
- [Sound restore against semantic rollback replay (2026-06-25)](docs/notes/ACRFENCE-SOUND-RESTORE-2026-06-25.md) — runnable fixture: a restored session consults a `VerifiedDone` witness and does not re-fire an already completed irreversible effect, while an ungated ACRFence-style semantic-rollback control fires the regenerated effect twice. Honest scope: fixture, not a transactional effects store.
- [The account switcher's single-source problem, and why gem8 "disappeared" (2026-06-25)](docs/notes/ACCOUNT-SWITCHER-SINGLE-SOURCE-2026-06-25.md) — diagnosis + consolidation path: `claude-accounts observe` (the `job` repo) reads a different roster than `dos accounts` and `fak accounts`, so gem8 reads "tombstoned" in one and "active" in another; and a config dir has TWO credentials (interactive login vs setup `.oauth-token`) that can name different accounts, so one rate-limit bucket shows as several "serving" seats. Shipped: `internal/accounts` now fingerprints the setup token (one-way), reconciles same-account seats to one canonical, flags token-twins, and de-noises `NameLie` — `fak accounts list` collapses 13 host seats to 8 real accounts.
- [Account-lifecycle runbook — enroll, serve, retire, purge (2026-06-26)](docs/notes/ACCOUNT-LIFECYCLE-RUNBOOK-2026-06-26.md) — the durable, super-easy procedure for adding/retiring a Claude config-home seat plus a keep-updating lessons log: registry is the single source, the dos + job (`u`) rosters are generated views. Add is one command (`fak accounts add <name>`); retire is one command (`fak accounts remove --name <seat> --archive` — tombstone + `.DELETED-<date>` dir-rename + registry repoint + resync, refusing the live `CLAUDE_CONFIG_DIR` seat). Records the 2026-06-26 four-seat retirement and its traps (a stale `fak.exe` fails silently on a new verb; you cannot retire your own seat; check `~/.claude-account-backups` before a hard delete; `remove` synced only the dos view until `FAK_JOB_ROSTER` was exported), and the shipped versioning surface (`fak accounts version` + a `list` provenance header) that makes a stale binary visible.
- [Avoid testing/serving on this dev box for now (2026-06-25)](docs/notes/AVOID-TESTING-ON-THIS-MACHINE-2026-06-25.md) — operational note: native `go test` is OS-blocked on this Windows box (use WSL `./test.ps1` or CI), and long-lived local `fak serve` leftovers pile up memory on a shared multi-session tree (a stray Vulkan serve held 4.3 GB idle). Use the GPU/cloud nodes for a real serve; kill local serves when done.
- [GLM-5.2 on a CPU-only box (CPU server): the llama.cpp pure-CPU baseline + the fak-native RAM wall (2026-06-29)](docs/notes/GLM52-CPU-LLAMACPP-BASELINE-2026-06-29.md) — witnessed pp512=16.1 / tg64=1.47 tok/s for the real 753B GLM-5.2 q4 on a CPU-only EPYC 7742 (AVX2) via llama.cpp mmap; the sequential-prewarm + plain-mmap levers that made it measurable (cold random mmap-faults at 0.09 GB/s vs warm); and the dmesg-witnessed reason fak-native is still RAM-gated here (q4 all-resident → FitTooBig; q3/IQ3_XXS dequants to f32 → OOM-kill at ~464 GB anon).
- [Turn-state demos audit (2026-06-21)](docs/notes/TURN-STATE-DEMOS-AUDIT-AND-DOGFOOD-2026-06-21.md)
- [Benchmarking visuals status (2026-06-18)](docs/notes/VISUALS-benchmarking-status-2026-06-18.md)
- [Permission-systems visuals (2026-06-18)](docs/notes/VISUALS-permission-systems-2026-06-18.md)
- [releasestatus ship rebind — #1448 (2026-06-29)](docs/notes/RELEASESTATUS-SHIP-REBIND-1448-2026-06-29.md) — a shared-trunk commit race crossed the ship-stamps of the releasestatus (#1448) and codexmemory (#1432) ports; this note rebinds the `(fak releasestatus)` leaf to the real `internal/releasestatus` diff so `dos verify` can confirm #1448 shipped.
- [codexmemory ship rebind — #1432 (2026-06-29)](docs/notes/CODEXMEMORY-SHIP-REBIND-1432-2026-06-29.md) — the same race crossed the codexmemory stamp; this note rebinds the `(fak codexmemory)` leaf to the real `internal/codexmemory` doctor diff so `dos verify` can confirm #1432 shipped.
- [release significance-floor ship rebind — #1389 (2026-06-29)](docs/notes/RELEASE-SIGNIFICANCE-FLOOR-REBIND-1389-2026-06-29.md) — an index.lock race swept the significance-floor work into a milestone-tick commit; this note rebinds the `(fak release)` leaf to the real `tools/release_decide.py` BELOW_FLOOR gate so `dos verify` can confirm #1389 shipped.
- [Roadmap: the 6 live-but-not-quite-there workstreams (2026-06-29)](docs/notes/ROADMAP-6-WORKSTREAMS-2026-06-29.md) — reconciles the operator's six cross-cutting workstreams (datacenter-GPU pure kernel · Mac Qwen-3.6 · dogfooded e2e value api/pure/half-fak · RSI · Slack · agentic dev) against the 11 GitHub milestones, with a **witnessed `not yet`** (evidence + missing witness + next checkable step) per theme. The clearing pass routed all **38 floating issues** onto owning milestones (mapping table included), leaving **0** unmilestoned open issues.
- [Next-step scoping and issue-creation guard plan (2026-06-30)](docs/notes/NEXT-STEP-SCOPING-GUARDS-2026-06-30.md) — hardens the path from "a task finished" to "the right next issue exists and can be dispatched": a small, enforceable contract for the contexts where fak or DOS create or sync GitHub issues by default, building on `internal/taskmgr.ReviewHandoff`'s completion-handoff refusal.
