gitpush.sh v4.36 hunk-gate resolves the lock holder from the repo's .agent-name instead of the pusher - refuses own locks, and silently passes real collisions in the inverse case

MSG-320 llmmsg-srv Done urgent

MSG-76: /setpm error feedback — DM sender when command fails (wrong arg count, unknown agent, not authorized)

MSG-76 llmmsg-srv Done urgent

wasteNot: behaviour-inference first (read recipient's next N msgs), opinion DM only as fallback; fold in unanswered-asks predicate

MSG-331 llmmsg-srv Done high ↳ MSG-326

wasteNot: llmmsg-wastenot.sh hourly haiku pass + timer

MSG-328 llmmsg-srv Done high ↳ MSG-326

ARO cleanup: retire 7 abandoned rooms

MSG-418 llmmsg-srv Done high

└─ Delete aro:infra-coders

MSG-419 llmmsg-srv Done high

Stop hub traffic for missing PMs and missing agents: kill successionNotify's promotion DM, strip dead idle-alert rule 28

MSG-417 llmmsg-srv Done high

OPS-23 CLOSED-OBSOLETE: hub.pensanta.com already repointed to 91.99.136.171 and has zero consumers on whey (no DNS change needed)

MSG-77 llmmsg-srv Done high

hub: stuck-agent alert re-fires at base 30min cadence on an unchanged subject+cause - back it off with a ceiling

MSG-397 llmmsg-srv Done high

wasteNot-adjacent: hub blackboard kind (independent-write brainstorm alternative)

MSG-332 llmmsg-srv Done high

└─ MSG-332c: batched notify + exactly-once completion notify to opener

MSG-335 llmmsg-srv Done high

└─ MSG-332b: hub routes open/write/read with read-time independence gate

MSG-334 llmmsg-srv Done high

└─ MSG-332a: blackboard schema (entries + responses, server-stamped write time)

MSG-333 llmmsg-srv Done high

└─ blackboard MCP tool trio on the shim

MSG-341 llmmsg-srv Done

└─ MSG-332d: 4min timeout, single straggler DM, then liveness check

MSG-336 llmmsg-srv Done

└─ Blackboard: drop wrong respawn line; restore bb_already_written for final respondent

MSG-344 llmmsg-srv Done

└─ Blackboard: already-written check must precede the status gate (MSG-344 was unreachable)

MSG-345 llmmsg-srv Done

└─ MSG-332e: control-first verification harness for the three design constraints

MSG-337 llmmsg-srv Done

└─ Blackboard invite copy points at blackboard_write tool, not curl

MSG-342 llmmsg-srv Done low

push-gate release DM is a race, not a queue - starves the largest-context waiter forever

MSG-398 llmmsg-srv Done high

blackboard_extend re-fires the straggler DM on the next sweep tick

MSG-386 llmmsg-srv Done high

chat-duo-web tablet-grade evolution (path A for unified browser client)

MSG-171 llmmsg-srv Done high

MSG-372: harden the 29 comparison-consumed env reads MSG-370 wrongly excluded as timers

MSG-372 llmmsg-srv Done high

MSG-376: envNumAbove accepts a finite window that overflows to Infinity in its consumed unit

MSG-376 llmmsg-srv Done high

MSG-375: envIntAtLeast accepts unsafe integers, defeating MSG-373's strict RED > YELLOW derivation

MSG-375 llmmsg-srv Done high

MSG-373: fleet-probe RED/YELLOW guard corrects an invalid pair into an equally-broken one

MSG-373 llmmsg-srv Done high

BB_EXPECTED_MAX and ARRAY_BLAST_MAX: a nonnumeric env value is NaN and silently disables the cap

MSG-369 llmmsg-srv Done high

stray-agent-check: flag daemon-hosted forks and claude procs missing the channels flag

MSG-347 llmmsg-srv Done high ↳ MSG-346

gitpush.sh: --only is per-FILE - a co-lane's dirty hunks in the same file ship with my commit; make the scope guard catch it or stage by hunk/stash others' changes

MSG-317 llmmsg-srv Done high ↳ MSG-309

gitpush.sh --review: review-ready marker that notifies audit-<project>-ca via hub /send after a successful push (one curl); plain pushes never notify

MSG-318 llmmsg-srv Done high ↳ MSG-309

Hub: lock primitive - POST /lock {resource,holder,ttl,aro} / /unlock, GET /locks, MCP tools lock/unlock/locks; one room line on acquire/release instead of N DMs

MSG-313 llmmsg-srv Done high ↳ MSG-309

Hub: v_lane_budget_24h view - per (sender,recipient) directed msg count + inert share + chars, role-tagged; feeds kpi-coach

MSG-310 llmmsg-srv Done high ↳ MSG-309

hub.mjs defaults PORT to 9703 and DB_PATH to the production sqlite

MSG-302 llmmsg-srv Done high

gitpush.sh strict-mode: detect staged deletions in ONLY_PATHS and commit them (git rm --cached silently dropped today)

MSG-109 llmmsg-srv Done high

ccs.sh:183 launcher gate fix: swap --dangerously-load-development-channels -> --channels server:KEY so team-launch needs no per-agent gate-accept + no manual rrll

MSG-14 llmmsg-srv Done high

Hub must not return a success that asserts more than it verified (ok:true vs delivered)

MSG-285 llmmsg-srv Done high

CronCreate /compact unreliable in never-idle loop: past-dated one-shots persist as zombies (363-day timer), monitor DM injection prevents REPL idle — path-B prose /compact is inert

MSG-89 llmmsg-srv Done high

to:[] multi-DM array path never inherits re= parent origin_aro

MSG-279 llmmsg-srv Done high

Drop hub cold-start announce fan-out (nothing consumes it, wakes every eng-aro member on each bounce)

MSG-268 llmmsg-srv Done high

Hub: brainstorm can leave an aro frozen for hours — add auto-close/expiry so a stale session can't block new work

MSG-260 llmmsg-srv Done high

Exempt rail/alert-sender identities from aros-prune

MSG-267 llmmsg-srv Done high

└─ pruneStale: two-tier TTL so 900s oneshot script senders are not pruned between their own check-ins

MSG-431 llmmsg-srv Done

claude-md-trim.sh + trim-cwd-claude-md skill: LLM-driven compression wrapper (git-checkpoint before rewrite)

MSG-162 llmmsg-srv Done high ↳ MSG-160

llmmsg-srv team restructure: PM + support agent + on-demand coders; rename llmmsg-srv-cc->hub-llmmsg-srv-cc, retire llmmsg-srv-ca (spec+plan in docs/superpowers/)

MSG-130 llmmsg-srv Done high

Hub to=pm:X resolver: treat PM seat as vacant + run election when recorded pm_agent is not an active roster member of the ARO

MSG-131 llmmsg-srv Done high

PM seat lost on compact: pruneStale strips recorded-PM ARO membership

MSG-219 llmmsg-srv Done high

chat-duo: remove Directory window/panel from sidebar (Elazar 2026-05-22-23:07)

MSG-134 llmmsg-srv Done high

Shim auto-register on startup from .agent-name; relaunch system-prompt covers -c continue (not just /clear/compact) - prevents post-relaunch poll-loop silence

MSG-135 llmmsg-srv Done high

Host-status rooms + hub catch-all routing: zero untagged DMs to Elazar (4b hub-route)

MSG-222 llmmsg-srv Done high

Post-/compact re-register unreliable for some cc agents (intermittent) - bootstrap silent-exit on hub blip + shim path + .agent-name fallback

MSG-223 llmmsg-srv Done high

.llmmsg-aros -> .aro consolidation: one per-agent ARO file (move aros[] into .aro, delete .llmmsg-aros, repoint resolve-aros.sh + bootstrap)

MSG-220 llmmsg-srv Done high

└─ ccs.sh: stop writing now-dead .llmmsg-aros + fix stale 'canonical' source comment (#631 phase-4; must precede phase-3 delete or files regenerate on launch)

MSG-224 llmmsg-srv Done

lezama hub tunnel stale-bind restart thrash (llmmsg-lezama-tunnel.service, counter 3124)

MSG-193 llmmsg-srv Done high

cc-context-monitor: forced auto-/compact via bootstrap hook (over-budget agents ignore nudges)

MSG-195 llmmsg-srv Done high

TRANSPORT.md SSOT: per-host transport, fallback, watchdogs, runbook

MSG-150 llmmsg-srv Done high ↳ MSG-149

llmmsg-doctor CLI: one command, transport+latency+last-good+units

MSG-151 llmmsg-srv Done high ↳ MSG-149

host_probes table + bootstrap-probe (every session start posts transport snapshot)

MSG-152 llmmsg-srv Done high ↳ MSG-149

aro_leave-on-idle rule: llmmsg-protocol.md ARO-Membership canonical + per-agent CLAUDE.md one-liner (self-leave non-essential AROs when last task done, stay registered, rejoin on assignment)

MSG-212 llmmsg-srv Done high ↳ MSG-210

Hub prune-on-write deletes roster row -> cursor reset to 0 -> full-history message redelivery on reconnect

MSG-197 llmmsg-srv Done high

Lezama agent auto-bootstrap: cold-start agent online + AROs joined + hub-reachable with zero prompt-paste

MSG-159 llmmsg-srv Done high ↳ MSG-149

memlint-runner CLI (sh.git): scan/trim CLAUDE.md+MEMORY.md with token counts, banned-phrase rules

MSG-161 llmmsg-srv Done high ↳ MSG-160

channel-rule audit+install scripts (fleet rollout)

MSG-169 llmmsg-srv Done high ↳ MSG-149

lezama: add systemd restart guard for hub + fix autossh SIGTERM regression

MSG-114 llmmsg-srv Done high

lezama watchdog: email notify-elazar.sh when zombie-fix fails

MSG-115 llmmsg-srv Done high

venus: whey-side watchdog for zombie detection (parallel to lezama watchdog)

MSG-116 llmmsg-srv Done high

tunnel down fallback alert: SSH + notify-elazar.sh when llmmsg unreachable

MSG-117 llmmsg-srv Done high

hub restart strands shim SSE: roster sweeper prunes agents that didn't auto-reconnect

MSG-119 llmmsg-srv Done high

Phase 2: hub aro_join validation + PM-election fallback + aro_list role surface

MSG-175 llmmsg-srv Done high ↳ MSG-174

Phase 3: launcher .aro v2 parser (ccs.sh/ccs-tmux.sh/bootstrap)

MSG-176 llmmsg-srv Done high ↳ MSG-174

send-keys /compact watchdog in cc-context-monitor.sh: fire tmux send-keys -l /compact + C-m on cost-cap cross; pane=session_name==agent; skip mid-gitdeploy

MSG-211 llmmsg-srv Done high ↳ MSG-210

Repoint chat-duo Elazar Pending panel to v2 eq source

MSG-123 llmmsg-srv Done high

Hub bug: status sender-map hijacks targeted scrp-* DMs. scrp-memsweep-venus matches STATUS_EMITTER_RE (hub.mjs:1815) so a deliberate kind=dm to a specific agent (nw-venus-cc) gets origin_aro stamped aro:hosts-status (1878) + recipients overwritten to the room's 3 nw members (hybrid block 1964-1967). Fix: skip the smap stamp+hybrid overwrite when the send is a deliberate DM to a single explicitly-addressed registered agent (else-branch recipients=[to] at 1937-1940). Keep smap routing for to=all/aro:hosts-status/Elazar-catchall paths (fire-and-forget telemetry). Verify: memsweep DM to nw-venus-cc delivers to ONLY nw-venus-cc; a hostmon-style to=all status still lanes to hosts-status. Bounce coordinated via me (pm).

MSG-254 llmmsg-srv Done high

Hub SIGTERM shutdown stalls to SIGKILL with long-poll feature (regression from MSG-251). drainLongpolls() resolves held polls but server.close() callback only fires once ALL sockets end incl idle keep-alives, so 08:43 bounce hit systemd stop-sigterm timeout -> 4 procs force-killed (07:05 pre-251 bounce was SIGTERM->Stopped same second). Fix ready uncommitted: 1s fallback timer -> server.closeAllConnections() (Node 18.2+, ok on v24) forces shutdown ~1s regardless of open conns. Verify: next bounce journalctl shows clean SIGTERM->Stopped, no 'stop-sigterm timed out. Killing.'

MSG-255 llmmsg-srv Done high

ccs.sh: persisted LLMMSG_AGENT in shared per-cwd .llmmsg-env overrides .agent-name — cross-agent launch from same cwd poisons resident agent identity

MSG-84 llmmsg-srv Done high

applog-listen hub-eviction recovery: auto re-registration (periodic 5min + 400-triggered immediate). Hub restart evicts listener from roster, re-enqueue loops on 400 until manual bounce. Fix once, redeploy venus/mars/pluto. Proof: hub restart then error delivers real-time w/o manual restart

MSG-82 llmmsg-srv Done high

MCP shim identity-resolution hardening (surfaced by ayudarg pm split: session sent as pmmain-ayudarg-cc despite LLMMSG_AGENT=pm-ayudarg-cc). Two defects in llmmsg-srv-mcp.mjs autoRegister/findAgentNameIni (line ~400): (1) VAR MISMATCH - shim reads process.env.LLMMSG_AGENT_NAME, but ccs.sh exports LLMMSG_AGENT; so the env the agent correctly sets is ignored and the shim falls through to findAgentNameIni. Fix: read LLMMSG_AGENT (align with ccs.sh) as the primary source, same as the MCP register tool honors. (2) UP-WALK FOOTGUN - findAgentNameIni walks up the dir tree and silently adopts a PARENT dir's .agent-name that names a DIFFERENT agent (ayudarg-com-ar/.agent-name cc=pmmain-ayudarg-cc) when the agent's own local .agent-name is absent/quarantined. Fix: stop the walk at the agent-folder boundary, or refuse a parent .agent-name whose name doesn't match the cwd's expected agent, or at minimum log the adoption. Net: env-honored identity must win over an ancestor file. Verify: a session with LLMMSG_AGENT set + no local .agent-name registers+sends under LLMMSG_AGENT, never an ancestor name.

MSG-256 llmmsg-srv Done high

Whey host-plane DM-leg gaps: clamav EnvironmentFile+ORIGIN_ARO, context-monitor ORIGIN_ARO+script rename, db-size-monitor ORIGIN_ARO

MSG-81 llmmsg-srv Done high

Hub: block_agent_names authoritative across poll path (MSG-16 re-insert now honors block)

MSG-257 llmmsg-srv Done high

Add ARO-context tag on DM sends so multi-ARO senders route correctly

MSG-111 llmmsg-srv Done high

Hub auto-kick silent agents from ARO

MSG-99 llmmsg-srv Done high

Hub /ignore command: prefix-pattern message suppression

MSG-98 llmmsg-srv Done high

MSG-75: kind=raise_hand / kind=lower_hand hub primitives for brainstorm multi-turn

MSG-75 llmmsg-srv Done high

Brainstorm + fan-out-disabled ARO: turns not counted + kind=decision doesn't close session when fan-out is off (messages go as DMs, hub never sees them as ARO brainstorm messages). Fix: brainstorm turn/close should work regardless of fan-out state

MSG-95 llmmsg-srv Done high

MSG-74: hub nudge PM to skip unresponsive brainstorm agents after timeout

MSG-74 llmmsg-srv Done high

MSG-73: settled brainstorm mode (kind=settled, mode=settled, bs_settled_by)

MSG-70 llmmsg-srv Done high

MSG-71: bare-DM gate for Elazar (reject_bare_dm flag)

MSG-68 llmmsg-srv Done high

MSG-67: brainstorm protocol fixes — enforce opener/PM-only close + skip post-close coaching

MSG-67 llmmsg-srv Done high

MSG-66: blocked_agent_names table — hard-reject register/send/join for blocked names with redirect message

MSG-66 llmmsg-srv Done high

MSG-65: allow kind=brainstorm fan-out in non-whitelisted AROs

MSG-65 llmmsg-srv Done high

MSG-64: /setpm admin form — /setpm <aro> <agent> lets elazar set any ARO member as PM

MSG-64 llmmsg-srv Done high

MSG-63: brainstorm pass/abstain after stuck-watchdog exhausts nudges

MSG-63 llmmsg-srv Done high

ccs.sh: write LLMMSG_AGENT=$LABEL to .llmmsg-env on launch so UserPromptSubmit hook always registers with suffix-correct identity (fleet-wide phantom-seat fix)

MSG-56 llmmsg-srv Done high

hub MSG-59: stuck watchdog must skip only offline/dormant agents — exclude registered+online agents from auto-skip (compaction != absent)

MSG-62 llmmsg-srv Done high

hub: brainstorm busy-nudge exclusion + threshold bumps — exclude kind=brainstorm from BUSY_NUDGE; BUSY_NUDGE_HUMAN_S 5→300, BUSY_NUDGE_AGENT_S 30→600, REPLY_NUDGE_AGE_S 180→900

MSG-61 llmmsg-srv Done high

hub: close-quorum soft warn — kind=decision with pending expected turns warns PM (force:true to override), does not hard-block

MSG-60 llmmsg-srv Done high

hub /send + MCP shim: multi-destination send (to as string|array, N rows one call, recipients[] in response)

MSG-58 llmmsg-srv Done high

cc-context-monitor: remove drain poke, fix zombie alerts (route+cooldown+threshold+allowlist)

MSG-55 llmmsg-srv Done high

cc-context-monitor hub-aware unregistered-check: whey-only roster read false-flags every VENUSINF-migrated agent (off-host .llmmsg-env) as 'genuine registration failure' + auto-heal-then-reflag loop. Fix: check agent against the hub its launch-cwd .llmmsg-env names (or exclude off-host-.llmmsg-env agents from the whey-scoped check). Blocks broad pluto/venus/whey cutovers (noise flood + auto-heal race); mars (5 agents) tolerable. Owner bin-whey-cc (monitor script).

MSG-39 llmmsg-srv Done high

Bug: brainstorm_close_forbidden fires when sender=opener=pm_agent

MSG-72 llmmsg-srv Done high

cdw periodic flicker: loadAgentStyles 60s poll triggers repaintStyles()->loadHistory() (feed.innerHTML='' + refetch = full feed teardown) on ANY agent_styles change. /agent_styles is derived from the whole fleet roster, so any agent registering/respawning anywhere mutates the map -> feed wiped ~every minute. Fix: repaintStyles must recolor names in-place, not reload the feed.

MSG-37 llmmsg-srv Done high

MSG-72: hub DM to PM when all brainstorm turns complete

MSG-69 llmmsg-srv Done high

hub: brainstorm-stuck-alert — setInterval watchdog DMs ARO PM when pending turns > 5min idle, auto-skips pending agents after 2 DMs with no movement (drops from expected_json, unblocks brainstorm)

MSG-59 llmmsg-srv Done high

Strip eq / 'Elazar Pending' feature fleet-wide (Elazar directive 2026-06-14): hub routes, MCP eq_* tools, cdw web + chat-duo GTK panes, DB table, all docs/CLAUDE.md/memory. Replacement rule everywhere: ask Elazar via llmmsg-srv DM. Stale eq_add call -> hard 'eq retired' error.

MSG-36 llmmsg-srv Done high

SECURITY: rotate leaked LLMMSG_EDGE_BEARER (venus edge-bearer) - committed to PUBLIC GitHub (pluto feat/tenant-isolation commit 5ab8c34), history-purged+force-pushed but exposure window real = treat compromised. Fleet-wide blast: venus hub LLMMSG_EDGE_BEARER env + EVERY migrated agent .llmmsg-env (LLMMSG_HUB_BEARER, ~26) + cdw service env + possibly Caddy edge config. Method: dual-bearer grace (zero-outage) preferred over coordinated bounce. Owner pm-llmmsgsrv-cc coordinating; hub-llmmsgsrv hub-code, nw-whey .llmmsg-env sweep, nw-venus venus-host exec, coder-chatduo cdw.

MSG-40 llmmsg-srv Done high

VENUSINF cutover-prereq: add LLMMSG_HUB_BEARER Authorization header to llmmsg-bootstrap-session.sh (/register + /aro/join curls 401 against bearer-gated venus hub; no-op when unset = additively safe)

MSG-34 llmmsg-srv Done high

memory-lint.sh: refuse implicit host-wide scan as push gate (require explicit scope; only cron sweeps host-wide)

MSG-31 llmmsg-srv Done high

VENUSINF: venus infrastructure migration coordination (Phase 0-3)

MSG-30 llmmsg-srv Done high

Hub control-verb /setpm <aro> <agent>: Elazar self-service PM reassignment from cdw chat (gated sender==elazar, roster-validated)

MSG-44 llmmsg-srv Done high

Elazar DM-guard (reject-v1): send-time reject of untagged DMs to Elazar + silent dm_guard_rejects counter + KPI line + kill-switch; bundle cursor-lag shim fix same deploy. Spec: docs/superpowers/specs/2026-06-12-elazar-dm-guard-design.md

MSG-28 llmmsg-srv Done high

cc-context-monitor.sh: redirect send target OFF elazar-the-user-human-llmmsg-srv to the host nw relay (nw-<host>-cc). ~2650 untagged DMs to Elazar = his #1 inbox clutter; DM-guard MSG-28 will drop them once enforced. Fix canonical script send-call (host-parameterized); nw-venus-cc + nw-lezama-cc pull to their host copies. Elazar approved 2026-06-12.

MSG-29 llmmsg-srv Done high

VENUSINF-5: public cdw URL (cdw-t.pensanta.com) - native venus cdw deploy + Caddy edge w/ human-auth, replacing Tailscale-only :9704

MSG-41 llmmsg-srv Done high

Schema drift: persist messages.expects_reply + roster.role; self-healing view-migration on hub startup

MSG-27 llmmsg-srv Done high

Human/spectator client silently stripped from AROs by pruneStale on presence lapse - no rejoin path, PM ARO replies stop reaching Elazar

MSG-20 llmmsg-srv Done high

ARO fan-out default-deny: allowlist gate at /send aro-expansion (Elazar-managed)

MSG-17 llmmsg-srv Done high

Shim/hub: auto re-register on reconnect after tunnel blip (roster-drop-until-manual-rrll)

MSG-16 llmmsg-srv Done high

CC idle/launch auto-drain: unread-gated send-keys poke + bootstrap unread-reminder hook (CC-only, Codex auto-excluded via cmd!=claude guard)

MSG-15 llmmsg-srv Done high

Bug: PM kind=brainstorm in active ARO opens sibling session instead of being rejected

MSG-71 llmmsg-srv Done high

agentteamlaunch.sh do_shutdown(): replace fire-and-forget send-keys 'ss' with wire-DM ACK-gated save

MSG-6 llmmsg-srv Done high

Post-/compact idle-agent wake: shim re-emit + cursor-on-drain (fix A+B)

MSG-4 llmmsg-srv Done high

Post-VENUSINF systemd-client bearer sweep: applog-pull/listen + errscan inject LLMMSG_HUB_BEARER (hubPost hardcoded bearerless, applog-pull.ts:121) + per-instance bearer env across hosts - restores fleet alerting (applog-pull@pluto unauthorized live)

MSG-42 llmmsg-srv Done high

EPIC: cdw+hub seam optimization (Elazar 2026-07-02 via coder-chatduo-cc, 4-agent: coder-chatduo, coder-llmmsgsrv, pm-llmmsgsrv, nw-venus) - collapse cdw->hub loopback chatter + delivery latency, from MSG-237 audit

MSG-248 llmmsg-srv Done high

└─ cdw adopt /aro/snapshot: getAroSnapshot switches to new endpoint, per-ARO fan-out deleted (blocked on hub endpoint live)

MSG-250 llmmsg-srv Done high

└─ cdw adopt hub long-poll /unread (replace 2s interval; blocked on hub half)

MSG-252 llmmsg-srv Done high

└─ hub GET /aro/snapshot: one response with members+roles+pm+sort_order+emoji for ALL AROs (replaces /aro/list + per-ARO fan-out = 23 loopback calls/10s in cdw); decide with #3 whether active_sessions folds into same payload

MSG-249 llmmsg-srv Done high

└─ hub /unread long-poll (?wait=25, early return on new message) - cuts cdw 2s poll (30 req/min/tablet) to ~2-3 req/min + kills 2s delivery latency. Loopback-only per nw-venus-cc (tablet leg already SSE, no Caddy change); if MCP-shim/https-edge variant ever ships, nw-venus-cc verifies Caddyfile first

MSG-251 llmmsg-srv Done high

└─ fold active_sessions into cdw /api/bootstrap (needs hub all-AROs active_sessions variant or /aro/snapshot field - decide with snapshot WI)

MSG-253 llmmsg-srv Done

hub: enforce ARO membership on lane-tag (1a) + fan-out (2a)

MSG-258 llmmsg-srv Done high

EFFAUDIT: 2026-07-02 fleet efficiency audit (Elazar brainstorm bs-mr334l5yybu) - dead tunnels/ZT/whey-pointers/keep-alives purge + hub/CDW micro-optimizations

MSG-232 llmmsg-srv Done high

└─ whey+lezama: retire lezama-tun L3 tunnel both sides (whey initiator + lezama /etc/systemd/system/lezama-tun.service; coordinate with nw-lezama-cc) per Elazar decision

MSG-246 llmmsg-srv Done high

└─ whey: delete dead reverse-tunnel units llmmsg-lezama-tunnel.service + llmmsg-venus-hub-localfwd.service (disabled/inactive, superseded by direct HTTPS) + orphaned llmmsg-lezama-zombie-sweep.sh if unreferenced

MSG-233 llmmsg-srv Done high

└─ DECISION(Elazar): retire whey<->lezama L3 tunnel (lezama-tun.service) + whey-vpn-keepalive? Elazar stated nothing whey<->lezama is needed; keepalive also heals GCABA VPN

MSG-244 llmmsg-srv Done high

└─ lezama: tear down dead llmmsg-hub-tunnel.service (ssh -L 9703 to venus; direct HTTPS is live path)

MSG-243 llmmsg-srv Done high

└─ whey: remove dead lezama-watchdog trio (llmmsg-lezama-watchdog svc+timer, supervisor svc+timer, alert svc) + backing scripts lezama-watchdog.sh/lezama-zombie-fix.sh - PM authorizes (llmmsg lane), execution delegated

MSG-234 llmmsg-srv Done high

└─ whey: constrain whey-vpn-keepalive.timer to business hours (Mon-Fri daytime) per Elazar - convenience reconnect only

MSG-247 llmmsg-srv Done

└─ venus: purge zerotier-one package (unit disabled but package installed; ZT retired fleet-wide)

MSG-242 llmmsg-srv Done

└─ hub.mjs: fix HOST_GUESS map (pm/coder-llmmsgsrv + coder-chatduo now on venus) + drop legacy whey aro_config seed tiers

MSG-238 llmmsg-srv Done

└─ whey: retire stale llmmsg-srv.service unit (hub moved to venus) + purge dangling llmmsg-zombie-ca-detector.timer

MSG-235 llmmsg-srv Done

└─ sh.git: ZT dead-code sweep - llmmsg-doctor.sh zerotier-cli + 172.27.* branch, whey/lezama daemon-probe ZT branches, ccs.sh ZT-fallback hint + stale autossh-watchdog comment

MSG-236 llmmsg-srv Done

└─ whey: retire llmmsg-whey-daemon-probe wholesale - service+timer+/etc registry (nw-whey) + remove llmmsg-whey-daemon-probe.sh from sh.git (bin-whey); entire watch-set is dead, timer already inactive - PM approved

MSG-245 llmmsg-srv Done

└─ CDW: consolidate 4x60s client intervals into one 60s /api/bootstrap tick + strip dead bearerless-whey-hub fallback in server.mjs (coder-llmmsgsrv-cc adds hub-side snapshot endpoint if needed)

MSG-237 llmmsg-srv Done

└─ venus: retire claude-backup.timer (redundant vs venus-state-backup-daily)

MSG-240 llmmsg-srv Done

└─ docs: mark zt_* status-probe fields deprecated (keep columns for history)

MSG-239 llmmsg-srv Done low

└─ venus: stretch llmmsg-reconcile.timer 10min->30min (safety-net only) - approved by PM

MSG-241 llmmsg-srv Done low

Hub command /audit_cli: Elazar-only, sends channel-discipline self-audit prompt to last-messaged agent in the ARO

MSG-229 llmmsg-srv Done high

gitmerge.sh newest-wins: discarded merge rc (:311) lets a non-merge commit the staged index and report 'Merge complete'

MSG-216 llmmsg-srv Done

Remove the deleted chat launcher's name from the advertised MCP surface

MSG-434 llmmsg-srv Done

Shim server instructions: lead with MCP-only, drop the transport wording, shorten 14 tool descriptions

MSG-433 llmmsg-srv Done

one agent-identity resolver across launchers, bootstrap, shim, nudge

MSG-426 llmmsg-srv Done ↳ MSG-422

└─ Shim register tool: refuse a name that is not this cwd's bound identity (identity_not_this_cwd)

MSG-430 llmmsg-srv Done

roster projection is indistinguishable from a full listing; /online known-set is not roster-backed

MSG-420 llmmsg-srv Done

└─ shim: aro_list_all scoped by default (names+counts), match/full params

MSG-429 llmmsg-srv Done

└─ hub: cursor GC (orphan cursors, 30d) + roster stale TTL 1800s -> 600s

MSG-428 llmmsg-srv Done

shim pushes to Codex via codex queue; retire the tmux nudge script

MSG-427 llmmsg-srv Done ↳ MSG-422

MCP rule (3) demands a silent CLI turn that Claude Code rejects

MSG-416 llmmsg-srv Done

Claude push-then-mark-read: feature-gated at-most-once delivery, measure the missed-message rate

MSG-413 llmmsg-srv Done

Remove idle/unreachable agent hunting from the hub

MSG-414 llmmsg-srv Done

Blackboard: hard 480s auto-close ceiling (default, max, extend)

MSG-411 llmmsg-srv Done

Notify endpoints on mailbox-forward lifecycle changes

MSG-405 llmmsg-srv Done

chat-duo-web tablet residuals: touch-target coverage + on-screen-keyboard overlap (MSG-171 #2/#3)

MSG-388 llmmsg-srv Done

send shim schema says to:[] takes 20, hub rejects above 4 - the client validates what the server refuses

MSG-394 llmmsg-srv Done

MSG-380 grace timer drops MSG-298's crash-loop guarantee for dirty boots, and the :226 comment still promises it

MSG-393 llmmsg-srv Done

blackboard costs 4 turns where 2 would do - the 300-char question truncation forces a read, and blackboard_write should return the others

MSG-391 llmmsg-srv Done

stuck-agent detector counts emitter-only unread as stuck - exemption tests the recipient, never the sender

MSG-390 llmmsg-srv Done

[source-integrity] DMs the PM after every deploy for a condition that is true by construction and self-resolves

MSG-380 llmmsg-srv Done

chat-duo timestamp display drops date - stale msgs read as today

MSG-147 llmmsg-srv Done

envIntAtLeast/envNumAbove: whitespace-only env value is coerced to 0, not rejected

MSG-377 llmmsg-srv Done

blackboard_add_respondent bypasses the MSG-367 respondent cap

MSG-368 llmmsg-srv Done

blackboard_open has a respondent floor but no ceiling; multi-DM caps at 4

MSG-367 llmmsg-srv Done

lock(): return the resource's median hold time on the 409 and in the free-notification DM

MSG-363 llmmsg-srv Done

mailbox forward to a non-roster target makes a live agent unreachable

MSG-361 llmmsg-srv Done

blackboard: add-respondent op, newcomer joins the withheld gate

MSG-353 llmmsg-srv Done

Hub: alert when an agent polls but never drains (unread>0, cursor stuck, N min)

MSG-348 llmmsg-srv Done ↳ MSG-346

Hub: wi-cli refused by cross-cwd identity guard - a shared CLI has no session and cwd is not its identity

MSG-321 llmmsg-srv Done

Hub: guide full-text re-push on version bump -> one-line changelog + GET /guide pull (524 msgs/4.9MB per 11d, 69% of hub bytes)

MSG-305 llmmsg-srv Done

Hub: attach resolved pm_agent per ARO to /register and /unread responses (kills the 'who is PM' DM class)

MSG-319 llmmsg-srv Done

Hub DB views v_phatic_messages / v_ack_only_messages: false-positive WHERE clauses

MSG-307 llmmsg-srv Done

Hub: aro fan-out allowlist reseeded on restart, undoing /aro_allow remove

MSG-296 llmmsg-srv Done

Decide whether -ca (Codex) agents should be wakeable

MSG-301 llmmsg-srv Done

Hub: client-outdated backstop skips senders with no reader

MSG-297 llmmsg-srv Done

Hub: source-integrity transient-unknown alerts once per DB then goes silent forever

MSG-303 llmmsg-srv Done

Shim: llmmsg-srv-mcp.mjs must honour LLMMSG_SKIP_REGISTER

MSG-299 llmmsg-srv Done

Hub: boot-time source-integrity self-check

MSG-298 llmmsg-srv Done

Hub: quiesce /elazar_contact writes into an unread surface

MSG-295 llmmsg-srv Done

Hub: reject DM to Elazar when humanincdw=false (elazar_unreachable gate)

MSG-294 llmmsg-srv Done

cdw PWA: make chat-duo-web installable (manifest+icons+service worker, Add-to-Home-Screen)

MSG-46 llmmsg-srv Done

Post-migration team restructure: PM=single always-on front door + retire support + rename hub-llmmsgsrv-cc to coder-llmmsgsrv-cc (ARO-less on-demand)

MSG-52 llmmsg-srv Done

Add PM marker to ARO member list in chat-duo Directory pane

MSG-113 llmmsg-srv Done

Harden aro retire path to cascade-delete aro_config (no orphan dormancy ghosts)

MSG-266 llmmsg-srv Done

ccnewnohistory.sh + ccs-tmux.sh banner: replace hardcoded STACK_DESCR cosmetic literals with actual resolved values (same fix as ccs.sh BWI #520 — _resolve_hub_url, LLMMSG_MCP_KEY var, hostname)

MSG-143 llmmsg-srv Done

cc-context-monitor: fix stale over_cap_alert fallback DM (~L668) - stop instructing dead ScheduleWakeup /compact; send-keys is primary, fallback should inform/escalate not hand a dead path. Fold into next bump (with WI#614). Align messaging with hub #621.

MSG-215 llmmsg-srv Done ↳ MSG-210

Fleet Health false-green: /fleet_health reports host green while host-dark (hub.mjs:868-878 probe-age tripwires too lax + agents:[] reads as healthy)

MSG-203 llmmsg-srv Done ↳ MSG-149

Consolidate agent-ops/context-hygiene ARO: 10-nightwatch canonical (add nw-lezama+support), agent-maintainer = tooling/ownership; no new aro:agent-hygiene

MSG-198 llmmsg-srv Done

Phase 5: chat-duo + chat-duo-web tier-aware UI

MSG-177 llmmsg-srv Done ↳ MSG-174

fleet_health: inferHostFromAgent emits bogus host='w' from -cc-w suffixed agents

MSG-172 llmmsg-srv Done ↳ MSG-149

Lezama-side daemon probe: llmmsg-lezama-daemon-probe.sh + systemd timer (mirror of whey #536)

MSG-168 llmmsg-srv Done ↳ MSG-149

memlint-sweep daily timer (lezama-side): same as #whey, scoped to lezama agents

MSG-165 llmmsg-srv Done ↳ MSG-160

memlint-sweep daily timer (venus-side): same as #whey, scoped to venus agents

MSG-164 llmmsg-srv Done ↳ MSG-160

memlint-sweep daily timer (whey-side): scans all agent CLAUDE.md, DMs Elazar+owner if bloated

MSG-163 llmmsg-srv Done ↳ MSG-160

/fleet_health endpoint + transport-registry table

MSG-156 llmmsg-srv Done ↳ MSG-149

chat-duo v1.19.0 Fleet Health pane (depends on /fleet_health endpoint)

MSG-155 llmmsg-srv Done ↳ MSG-149

Whey-side silence detector implementation (claimed by nw-whey-cc)

MSG-154 llmmsg-srv Done ↳ MSG-149

harden llmmsg-lezama-watchdog: self-heal + failure alert

MSG-148 llmmsg-srv Done

hub /protocol + /protocol_version endpoints: serve docs/llmmsg-protocol.md as canonical (sha256[0..8] version)

MSG-144 llmmsg-srv Done

ccs.sh banner: replace hardcoded 'hub http://127.0.0.1:9703' display string with actual $LLMMSG_HUB_URL value (resolved via same precedence as shim: env > legacy SRV_HOST/_PORT > default). Show what's really being used so misconfig is visible at launch.

MSG-142 llmmsg-srv Done

bootstrap.sh default URL alignment + fleet distribution: change HUB_URL default in /opt/llmmsg-srv/scripts/llmmsg-bootstrap-session.sh:8 from 127.0.0.1:9703 to llmmsg-hub.pensanta.com:9703 (match shim default), bump version, then rsync to venus + lezama. Elazar approved all 2026-05-23-01:13.

MSG-141 llmmsg-srv Done

Venus per-agent memory sweep: grep ~/.claude/projects/*/memory/*.md for retired names llmmsg-srv-ca and llmmsg-srv-cc (WI 471 cleanup gap); update refs to hub-llmmsgsrv-cc or remove. Caused coder-mars-cc to suggest 'ask llmmsg-srv-ca' as recovery path 2026-05-23. Lezama same sweep if accessible.

MSG-140 llmmsg-srv Done

Roll v2.5.4+ shim to venus+lezama: git pull on /opt/llmmsg-srv on each host so new hardcoded LLMMSG_HUB_URL default (llmmsg-hub.pensanta.com:9703 per commit 8e1faa5) is live; agents pick up on next relaunch

MSG-138 llmmsg-srv Done

bootstrap.sh: LOUD recovery-hint on ECONNREFUSED — print paste-able LLMMSG_HUB_URL guidance to stderr above CC prompt when /register fails to connect

MSG-137 llmmsg-srv Done

ccs.sh:113 cleanup: drop post-/compact 're-register + re-join AROs' instruction from --append-system-prompt; both layers now redundant (hook + shim auto-register from BWI 513). Distribute to lezama+venus after.

MSG-136 llmmsg-srv Done

Move /opt/llmmsg-srv/scripts/lib/{resolve-agent-name,resolve-aros}.sh into ~/.local/bin/ (sh.git) so launcher libs sync with consumers across whey/lezama/venus

MSG-133 llmmsg-srv Done

Retired agent names keep re-registering: stale llmmsg-srv-cc still online + ARO member after WI 471 rename to hub-llmmsgsrv-cc; bootstrap hook re-registers it every prompt

MSG-132 llmmsg-srv Done

chat-duo a) drop agent name from window subtitle + version text 1pt larger b) re-join saved AROs on launch (bootstrap aro discovery broken: /online no longer returns aros)

MSG-129 llmmsg-srv Done

chat-duo side of always-a-PM (brainstorm items 1+7): drop client-side PM resolution + aro_config write, send to=pm:X, render resolved_pm in bubble, queued=true inline confirmation

MSG-126 llmmsg-srv Done ↳ OPS-54

chat-duo UX batch (brainstorm items 3/5/6): ARO member expander in Rooms list, remove leave-ARO trash icon (gui.py:562), toast->inline system message

MSG-125 llmmsg-srv Done

MCP shim: add aro_list_all tool (fleet-wide ARO discovery)

MSG-173 llmmsg-srv Done

Hub-side silence detector: alert when host goes dark > threshold

MSG-153 llmmsg-srv Done ↳ MSG-149

hub nudge to drive eq adoption: when an agent DMs Elazar a prose blocking-question and hasn't filed a matching eq, hub nudges sender to use eq_add (sibling to reply-nudger/idle-alert; conservative heuristic; env-disable flag)

MSG-192 llmmsg-srv Done

hub STALE_TTL_S=600s < monitor timer interval 15min: peer watchdog probe_ts never updates, false DOWN alerts

MSG-231 llmmsg-srv Done

sh.git pollution: gitmerge.sh auto-commits untracked pip bins (f2py, numpy-config); gitignore + root guard

MSG-227 llmmsg-srv Done

hub /send + MCP shim: improve aro_fanout_denied error message (explain reason, redirect to DM or multi-dest)

MSG-57 llmmsg-srv Done

Delete aro:kpi-n-optimization — hard-delete from aros + tombstone in retired_aros

MSG-88 llmmsg-srv Done

hub.mjs:1606 cold-start announce stops fanning to Elazar's inbox (team-internal event noise); hub keeps its own fixed sender llmmsg-srv-hub (exempt from scrp- per convention). Part of scrp- sender-naming rollout (agent-conventions.md, Elazar 2026-06-10)

MSG-21 llmmsg-srv Done

hub.mjs:574 isValidAgentName widen ^[a-z0-9][a-z0-9_-]{1,63}$ to allow _ in scrp- sender ids (OPS-13 word-joiner grammar); rides MSG-20/21 batch+restart; verified no _-sensitive hub routing (nw-whey). Blocks bin-whey errscan rename until live.

MSG-22 llmmsg-srv Done

retired_aros tombstone gate: stop deleted AROs resurrecting via stale .aro bootstrap rejoins. Table retired_aros(aro PK, retired_at, retired_by); gate in /aro/join returns aro_retired before INSERT; POST /aro_retire + GET /aro_retire_ls (Elazar-only auth, mirrors /aro_allow); CLI aro-retire.sh; schema in init-db.sh + hub.mjs migration. Migration seeds the 7 dead -core/-small names. Un-retire via action=remove (reversible). Rides next restart. Durable fix for MSG-24 resurrection whack-a-mole.

MSG-25 llmmsg-srv Done

eq stale-removal: one-click dismiss/stale in chat-duo Pending pane + auto-stale sweep (auto-dismiss when ref_bwi closes / N-day age)

MSG-19 llmmsg-srv Done

Retire -core/-small AROs fleet-wide (Elazar 2026-06-10): DELETED all 7 (llmmsg-srv-engineering-core, mars-core, venus-core/-small, pluto-core/-small, mba-l-small) from aros (19 rows) + aro_config (8, incl orphan mars-small). Unanimous PM consent, zero deps. Already inert via MSG-17 default-deny (token win banked); deletion=hygiene. OPEN: (1) per-project .aro scrubs to prevent bootstrap resurrection - our .aro done, mars/venus/pluto/mba-l notified (pluto acked); (2) chat-duo-web 2-tier collapse (Ctrl+Enter -core lane dead) - pending Elazar yes, owner coder-chatduo-cc ~20min.

MSG-24 llmmsg-srv Done

Delete aro:mba2-l — hard-delete from aros + tombstone in retired_aros (same pattern as MSG-86)

MSG-87 llmmsg-srv Done

Hub WI#635 catch-all: unrouted private DM-to-Elazar gets recipients-replaced with aro:whey-status members (hub.mjs L700-703) = latent leak if any non-Elazar watcher joins whey-status; decouple unrouted-catch-all from smap fan-out (unrouted stays direct+lane-tagged, only status-emitters fan)

MSG-7 llmmsg-srv Done

ARO display-metadata: sort_order + emoji on aro_config (/sort + /emoji, web sidebar)

MSG-8 llmmsg-srv Done

Bake llmmsg-srv MCP into canonical host setup — remote hosts need global ~/.claude.json mcpServers.llmmsg-srv (LLMMSG_HUB_URL=https://llmmsg-hub.pensanta.com) at provisioning; audit lezama + add to nw-* onboarding / agentteamlaunch.sh

MSG-85 llmmsg-srv Done

PM-mediated brainstorm: CDW sends full context to PM only; PM summarizes and opens ARO brainstorm with lean opener (~300 chars)

MSG-103 llmmsg-srv Done

Hub: ARO with all members offline should show last PM as 'AgentName (disconnected)' instead of blank/missing PM — reflects reality for succession-failed AROs

MSG-94 llmmsg-srv Done

Hub command parser false-positives: any message starting with / (e.g. /home/rob/...) triggers 'wrong command'. Fix: only parse as command if token after / matches a known verb (setpm|makepm|close|skip|ignore|unignore|aro_allow|breaker|help).

MSG-108 llmmsg-srv Done

Hub: DM agent when auto-elected PM of an ARO ('you are now PM of aro:X') — currently no notification, agents only discover via aro_list or succession announce

MSG-96 llmmsg-srv Done

Hub /close confirmation should be sent to the ARO (not just DM to sender) so all members see the brainstorm is closed

MSG-97 llmmsg-srv Done

reconcile.sh: health probe treats 401 as unreachable — fix to accept 401 as hub-up signal

MSG-105 llmmsg-srv Done

Consolidate /opt/llmmsg-srv into /opt/llmmsg-srv-venus: move scripts/bridge/agents/chat-duo subdirs, repoint 11 fleet-wide refs (hooks, ccs.sh, services), delete old tree. Supersedes WI-596.

MSG-106 llmmsg-srv Done

CDW main window: make message separator more prominent (hard to tell where one message ends and next begins)

MSG-101 llmmsg-srv Done

Hub host-status routing still points at retired per-host aros — repoint STATUS_EMITTER_RE stamp + STATUS_DEFAULT_SINK to aro:hosts-status

MSG-86 llmmsg-srv Done

Hub coaching: detect duplicate sends and suggest multi-recipient syntax

MSG-100 llmmsg-srv Done

MSG-80: /close force:true returns close_quorum when pending turns remain — MCP shim not honoring force flag; force should bypass quorum

MSG-80 llmmsg-srv Done

chat-duo-web: auto-expire/hide eq entries when no longer relevant (stale Elazar questions clutter the Pending panel — e.g. the lezama cert/kernel eq Elazar just flagged 'this is old'). Hook to wi doctor's >7d Elazar-Q drift + an age TTL or resolve-on-supersede.

MSG-18 llmmsg-srv Done

KPI report script double-delivers to pm-llmmsgsrv-cc: fan-out to aro:llmmsg-srv-engineering + direct DM — drop the direct DM, ARO fan-out is sufficient

MSG-90 llmmsg-srv Done

Hub idle-reaper false-positives on DM-only lanes: reaper credits only ARO fanout as activity; agents on no-fanout AROs (aro:mars pattern) get reaped despite active DM work. Fix: count outbound DMs to same-ARO members as activity, or add per-ARO exemption flag.

MSG-107 llmmsg-srv Done

/setpm regex: tolerate optional space after slash ('/ setpm') - human typo-forgiveness on the cdw-facing command

MSG-45 llmmsg-srv Done

Agent color+emoji recognition (cdw + hub): role-color taxonomy + override store

MSG-33 llmmsg-srv Done

Brainstorm sessions follow speaking-order protocol end-to-end (cdw+hub) + coach violators + terse AI-shorthand brainstorm protocol in llmmsg-protocol.md

MSG-48 llmmsg-srv Done

Hub brainstorm auto-close: when all turn-order members have taken their turn, hub should auto-close the brainstorm (or DM opener/ARO-PM to close) rather than leaving it open indefinitely

MSG-91 llmmsg-srv Done

chat-duo-web timestamp has no year - messages a year apart render identically

MSG-387 llmmsg-srv Done low

Verify Lezama composer guard and fail-open diagnostics

MSG-324 llmmsg-srv Done low

Decide disposition of 1097 pre-existing /elazar_contact rows

MSG-300 llmmsg-srv Done low

/agent_hygiene endpoint: aggregate token-size telemetry from per-host sweeps

MSG-166 llmmsg-srv Done low ↳ MSG-160

Shim env compat: read LLMMSG_SRV_HOST/_PORT as fallback for LLMMSG_HUB_URL — self-heals .mcp.json files using the SRV_* naming convention

MSG-139 llmmsg-srv Done low

chat-duo: rebuild Elazar Pending sidebar pane properly (removed v1.19.3)

MSG-170 llmmsg-srv Done low

Hub-side script-rename impact confirm: nothing keys off old cc-context-monitor-<host> sender name (roster.host backfill, /fleet_health, routing) after rename to script-ctxmonitor-<host>

MSG-53 llmmsg-srv Done low

gitpush.sh --only rejects staged deletions (git rm); blocks tracked-file removal

MSG-226 llmmsg-srv Done low

context-monitor: skip peer-DOWN alert if probe_ts predates watcher's own last-run interval (false alarm after watcher idle gap)

MSG-230 llmmsg-srv Done low

Timer-consumed env reads: NaN and int32 overflow both become 1ms hot loops (10 sites)

MSG-374 llmmsg-srv Done someday