feat: reframe the conductor as an assistant whose fleet is one capability

[saucam]

Docs-only. Locks in a reframe of conductor-design.md, plus the minimum consistency edits to conductor-build-plan.md so the two docs stop contradicting each other.

What changed, and why

1. The conductor is an assistant; the fleet is one capability.
The doc treated fleet supervision as the conductor's whole contract — CONDUCTOR_SYSTEM_PROMPT_APPEND even lives in fleet.ts with a comment saying the fleet tools "define the conductor's whole contract". The conductor is the owner's always-on assistant: it converses, answers questions about the owner's work and machine, fetches information, runs unattended routines, and commands coding sessions as one capability among several.

§5 is now a capability surface — fleet, memory, notes/scratch, web, routines, mounted MCP servers — with per-capability status. Three consequences are architectural, not cosmetic:

• The system prompt must be composed per mounted capability, and absent when unmounted. Not tidiness: a model told about tools it lacks hallucinates calls to them, and a small open-weight backend (the reason config.conductor.provider exists) does so far more readily than a frontier model.
• Read-only classification must be registry-driven. isSafeTool hardcodes per-server prefix lists; every new capability means editing the one file where an over-broad match is a prompt bypass.
• Web reads must auto-approve. An assistant that prompts on every WebFetch is not an assistant.

2. Read-only-by-construction is retired (R6). It was never implemented, for three reasons in the code:

Claim	Reality
ZeroID scopes keep the conductor read-only	#createConductor builds a plain session with no capability role and no disallowedTools; allowedTools is a pre-approval list. Full default toolset behind canUseTool only.
write: false would close it	WRITE_TOOLS excludes Bash by design — tool-safety.ts says so: >, tee, sed -i, git apply remain until a real sandbox exists.
Nothing it delegates can mutate a target	WORKER_SCOPE_PROFILES.ship carries tools:write; shape: role.write ? "ship" : "scout".

The identity model's actual guarantee is preserved and stated precisely: the conductor cannot mint mutation authority by delegation, because ZeroID intersects scopes on every RFC 8693 hop — which is exactly why a ship worker's token is a root grant sanctioned by owner approval rather than a conductor delegation. "Cannot mint" is true. "Read-only subtree" is not.

3. Scope replaces capability. The two arguments that survive scrutiny are context economics (and notably Read threatens O(active threads) more than Edit does — it is in SAFE_TOOLS and auto-approves) and multi-writer correctness against live worktrees. Both are satisfied by a path scope:

Where	Posture
~/.codeoid-conductor	write auto-approved
Outside a repo	write approval-gated
Inside a repo	never auto-approved; hard-denied where a live session holds the worktree
Bash in a repo	denied — it defeats every path scope above

Delegation becomes a cost decision, not a trust one: delegate when the overhead exceeds the context cost of acting inline. Send-class egress (§8) stays delegated, and that one is about trust — the conductor ingests untrusted text from web fetches, <fleet_events>, and mounted servers.

Housekeeping in the same pass

• §9 gains an honest enforced-versus-prompted inventory. A dogfood story that overstates its own boundary is worse than none.
• §11 defers all sequencing to the build plan rather than carrying a second, drifted phase list.
• §12 retires five settled questions and adds the six the reframe opens (where path scope is enforced, whether the worktree check belongs in a deliberately pure module, who owns the read-only declaration, per-backend prompt trimming, the cost-ceiling number, and whether "conductor" is still the right name).
• Status notes now say plainly that the front doors are designed but unbuilt, that "always on" is not yet true (the conductor is created lazily, no boot ensure, no heartbeat), and that routines need tools, not only a scheduler.
• New gap recorded: the conductor cannot start a collaborative session — fleet_spawn makes a single worker.

Ordering effects

Recorded in both docs: a tool-surface slice lands first, P5 front doors and mountable fleet MCP (#245) move up — #245 is the keystone of the reframe, since a mounted fleet is what makes it one capability rather than the contract — and P4.5 routines gain the spend ceiling as a hard prerequisite (amended R5: unattended autonomy needs its cost cap at the same time as its autonomy, not in the Shield era).

Verification

Docs-only; no code touched. biome lint covers src/ and packages/ only. Section numbers referenced by conductor-session-resolution.md, collaborative-session-design.md, and sdlc-pipeline.md (§2, §5, §6) are unchanged — §5 keeps its number and gains a §5.1. Anchor links verified against the actual headings.

🤖 Generated with Claude Code

---

Second commit — two-fence sandbox split, mount contract, retrieval positioning

Folded in after reviewing the reframe against the current market (OpenClaw, GitHub Agent HQ, Zep/Graphiti, Agent-Kanban).

• §9 — two fences. Sandboxing is a wrapper (highflame-forge starts codeoid inside the sandbox), which is the right split: it keeps the daemon free of if (sandboxed) branches the way local mode keeps the auth path free of if (localMode). But it closes the outer threat model only. Every R6 hazard happens inside that fence — sed -i works as well sandboxed as not, and a kernel fence cannot tell the conductor's write from the write of the session that owns that worktree. The inner fence needs no kernel help: the worktree check is deterministic because the daemon knows who owns which worktree, which makes it an invariant only a session-owning control plane can enforce rather than sandbox catch-up. Records the open topology decision — codeoid inside a sandbox is one fence per daemon, so shape: "scout" is still a scope claim.
• §12 Q8/Q9 resolved by one layering rule: tool-safety.ts stays a pure classifier answerable from a tool name; the session's canUseTool gate makes the contextual path decision. The module's dependency-free purity survives, which was the objection.
• §5 — the mount contract as an exchange, not paperwork: declare read and side-effecting verbs, receive identity attribution, audit, approval classification, episodic capture. Mandatory both ways. That exchange is what peers' plugin systems cannot offer — the registry is not the moat, it is how the moat reaches third-party code.
• §6 — honest retrieval positioning. Bi-temporal validity, hybrid dense/sparse/graph, RRF and cross-encoder rerank are shipped and benchmarked elsewhere; claiming them invites a comparison we lose. What is differentiated is downstream of the native-protocol layer: the corpus (tool-call-granular episodes with file paths, which a text-ingesting memory cannot produce) and the task (fuzzy reference → session across workspaces, which nobody benchmarks).

Follow-up work filed

Issue
#276	Enforce the R6 scoping table — path-scoped write, auto-approved reads, Bash denied in repos
#277	Decide sandbox granularity (Forge topology) — blocking for unattended routines
#278	Compose the system prompt per mounted capability + the mount contract
#279	Conductor front doors — web pane + Telegram routing (P5)
#280	Always-on — create at boot + heartbeat wake source
#281	fleet_spawn cannot start a collaborative session
#282	Retrieval strategy — build corpus-derived signals, evaluate a library for the ranker

Updated with reframe context: #245 (mountable fleet MCP is the keystone), #251 (external callers must join the delegation chain, not hold bearer tokens), #54 (routines need tools, plus two hard prerequisites), #52 (budgets promoted from Shield-era to a prerequisite of unattended autonomy).

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.