feat(promachos): port persona home and bubble chats to v2

[lukemaj]

What: Promachos mode brings persona-home chats and bubbles to V2.
Why: The V1 launch hook and timeline filter depended on APIs and row types removed upstream.
So what: The #175-only successor passes affected proof, exact-head review and CI on the latest authorized base; the planner owns the explicitly deferred integrated UI/live-provider pass and merge/cutover.

Closes #175. Authorized by #166 and the planner’s final delivery instruction. Contribution to the Objective: Promachos chats in bubbles with his persona loaded from his home.

Home creation uses ProjectService and preserves existing persona files. Initial conversation sends use upstream launchThread and #169’s shared Prism service, selecting the configured model and launch-time D5′ kit once. Prism’s shared validator checks both authoritative registries before thread creation and falls through an unavailable candidate. Accepted receipt retries preserve the stored selection and message.

The view retains HTML/MCP-app outputs and provider-error/usage-limit notices, collapses technical work and reasoning, and keeps upstream queued-message controls. Paragraph bubbles use the real Markdown parser; inline question/approval cards retain composer handlers. Homes remain environment-scoped, native people/child lineage filtering is preserved, and switching back restores saved multiple-model choices.

Base: 4c2b38436fda0fef5bb2b101d52f90d7ed831df0 (#183, #172, #188 Wight, #190 ACP fix, #191 CI setup and #192 recovery history merged). Head: 73435bedda993ddc954347ce79072caad93ba1c9. Range-diff confirms only seven #175 commits remain (four port commits, metadata registration, module-local export corrections and the partial-launch retry fix); #172 append-only metadata was retained in full; mechanical rebase conflicts retained the complete merged feature-map/allowlist entries plus #175. No #169 predecessor implementation delta remains.

Focused proof on 73435bedda993ddc954347ce79072caad93ba1c9, merged base 4c2b38436f. Supported Node24.13.1, host-neutral environment, serial batches with immediate uptime1m<8 admission and #169 priority:

• 72 passing tests across seven focused files are reused from840 with unchanged relevant inputs, plus 5 fresh Promachos launch tests pass (47 unrelated cases skipped). Home/filesystem, authorization, Markdown/parser bubbles, people filtering, initial-only start/saved fanout, real provider-error/usage-limit projection and client mapping are covered. Launch proof uses real SQL/Prism/upstream typed receipts, including unavailable-first-candidate fallback before creation and accepted receipt retry.
• Fresh local server and contracts typechecks exit0 on4c. Current CI Typecheck passes and freshly covers web/client-runtime after the inherited optional run-schema addition; their older local receipts remain historical feedback, not claimed fresh.
• Fresh scoped lint on the two changed contract entry points exits0; previous scoped lint for unchanged Port Promachos mode #175 modules remains applicable. The successor changes only two fork modules for approved partial-launch recovery; their fresh scoped lint exits0. Commit-hook formatting only wraps lines, with no semantic change after proof. Affected server proof passes on734; unchanged scoped lint is reused, current CI Typecheck covers all packages.
• node scripts/fork-features.mjs check: 21 features pass, exit0; git diff --check: pass. Retained commands, proof identity and results are on Port Promachos mode #175; temporary logs have explicit exit codes.

UI evidence is explicitly deferred by the user to the planner’s integrated pass. No browser, desktop build, screenshot/video, live provider execution or live userdata mutation was performed. The receipt harness disables provider execution; focused checks do not claim repo-wide coverage. No version bump, main push, merge, install or deployment.

MODULAR audit: fork behavior, RPC/error mapping, model/fanout policy, scroll policy and launch cases live in Promachos modules. Upstream carries imports, optional fields, registrations and calls; no upstream implementation is copied. Feature-map primary ownership and allowlist retained.

Upstream-owned file	Added / removed lines against merged base
apps/server/src/auth/RpcAuthorization.test.ts	+11 / -0
apps/server/src/observability/RpcInstrumentation.ts	+7 / -1
apps/server/src/orchestration-v2/ThreadLaunchService.test.ts	+4 / -0
apps/server/src/ws.ts	+12 / -2
apps/web/src/components/AppSidebarLayout.tsx	+5 / -0
apps/web/src/components/ChatView.tsx	+35 / -8
apps/web/src/components/chat/ChatComposer.tsx	+8 / -2
apps/web/src/components/chat/MessagesTimeline.tsx	+61 / -15
apps/web/src/components/sidebar/SidebarChrome.tsx	+3 / -2
docs/README.md	+1 / -0
packages/client-runtime/src/operations/commands.test.ts	+2 / -0
packages/client-runtime/src/operations/commands.ts	+2 / -0
packages/contracts/src/clientRpcPermissions.ts	+2 / -0
packages/contracts/src/index.ts	+1 / -0
packages/contracts/src/orchestrationV2.ts	+1 / -0
packages/contracts/src/rpc.ts	+2 / -0

Hunks over approximately 15 lines occur only in MessagesTimeline:

• ConversationTimeline near line897: +10/-0 (16 lines with context) calls the owned scroll and disclosure hooks. Their policy lives in Promachos modules; upstream still derives and renders rows.
• Timeline footer near line1164: +5/-2 (16 lines with context) passes the optional inline host field and its dependency, preserving the existing footer.
• Assistant row near line2815: +9/-7 (22 lines with context) wraps existing changed-files JSX and gates existing metadata. The renderer stays upstream; there is no duplicated implementation.

All other upstream hunks are at most15 lines including context. Whole-file counts accumulate distributed hooks. The launch test registration is four lines; all new behavior assertions live in the fork module.

Requirements and who asked: User, #175/#166 and planner approvals require persona home, V2 bubbles/rows, upstream launchThread, shared Prism validator, preserved visible results/notices/queue controls, and one PR into fork/v2.
Deleted: Obsolete V1 start API and technical/reasoning presentation; no dependency repair, duplicate model eligibility code or persisted routing state added.
Bottleneck: Planner-owned integrated UI/live-provider proof remains explicitly deferred; no source, dependency or CI blocker remains.
Checked myself: Inspected the complete port and real V2 error projection/renderers, verified merged refs and #175-only range, ran focused receipt/parser/home tests and scoped checks.

Website impact: none, this port changes the application and its user guide without marketing routes or public website content. Upstream search found no Promachos implementation in upstream/main or matching Issues/PRs; the prior search record is on #175.

Model/harness: GPT-6.1-Sol through Codex in T3 Code; independent reviewer routed by Prism through the visible T3 reviewer role. Durable task record: #175 (comment).

Latest authorized base maintenance: #192 recovery history is merged at4c. Inspection confirms normal Promachos initial-message commands have neither forkPrismRetryOfRunId nor usageLimitContinuationOfRunId, so the new continuation source/admission hooks return empty/null; ProjectionStore preserves a recorded source only if present. Prism.resolve, shared validator and upstream launch API are unchanged. Rebase retains all seven #175 commits with no conflicts; only feature-map and orchestrationV2 whole-file blobs incorporate merged-base changes, other36 PR blobs are identical. No #192 repair is composed. Five launch cases and server/contracts typechecks freshly pass against changed common runtime/schema inputs; unchanged scoped lint and independent source proof are reused. Exact734 independent review PASS, findings #187 (comment); newest review/independent is success by lukemaj on734, linked to these PR findings. Current-head CI SUCCESS, including aggregate Check, all six server shards, web tests, Lint, Typecheck, Build, release smoke and Fork Stack Model. Configured EAS/preview/mobile jobs are skipped; no failed check is waived.

Approved consequential decision A, implemented: when creation has an accepted receipt but the initial message does not, call existing Prism.resolve with the stored model as explicit selection to rebuild the current launch-time kit. No validation, fallback, reroute, model change or new durable state. Accepted initial-message retries remain receipt-only. The planner expressly accepts settings as of the first submitted/accepted message; immutable first-preparation kit storage (B) was not selected.

The real SQL/receipt regression was red before recovery (persisted Hello without persona), then green after it. It commits real creation, verifies accepted create/absent message receipt, changes kit and model preferences, asserts current kit with the unchanged stored model, then changes kit again and verifies accepted replay retains exactly one message/run. All five launch cases pass. An exact-optional test fixture type error was corrected by omitting the absent field, without weakening the oracle. The original independent finding is recorded at #187 (comment); the source-identical5315 PASS resolves the finding; prior927 metadata/base review passed; current734 review also passes.

The prior Test Server4 failure was a worker PID collision in inherited ACP fixture logic, repaired separately by merged #190. No ACP source or tests are included in the #175 diff. Six original #175 patches are preserved, with one owned retry-fix commit added; rebase conflicts only retained both additive Wight/Promachos exports and complete append-only feature-map/allowlist groups. No dependency repair was composed.

Historical #175 CI corrections: register the existing authorization test under its primary feature owner/allowlist, and remove three unused module-local exports without changing bodies/callers. No policy or behavior change.

Required Agent Observer report republished for this successor, exit0: #187 (comment). Publication succeeded; native usage attribution is incomplete and estimated cost remains unknown, not zero.

[lukemaj]

What: Independent review passed on the exact PR head.
Why: The reviewer checked the cumulative port and proof without authoring changes.
So what: The planner can review this #175-only PR; integrated UI proof remains explicitly deferred.

Reviewer verdict relayed unchanged:

Verdict: PASS for exact head c6975bed4b7a36388f1c0b8ff0991870255c3491 on base 7963bda523bbec5e5366c44e4a6ea34a5b10039e. I found no actionable source issues; the shared Prism validation, receipt retry, timeline error visibility, disclosure, parser, and stale-thread card-host paths match the approved scope. The PR draft’s three larger MessagesTimeline hunk justifications match the current diff.

The recorded focused tests, launch tests, four typechecks, lint, inventory, and diff check all pass; I reviewed their logs without rerunning them. Integrated UI and live-provider proof remain deferred to the planner as agreed.

Elon record

• Requirements and who asked: User and approved Port Promachos mode #175/Absorb upstream main through 8d11fe1261 #166 scope require Promachos home, V2 chat presentation, launchThread with shared Prism validation, and timeline A.
• Deleted: No added product requirements or duplicated provider-eligibility logic.
• Bottleneck: Exact-head review is complete; the integrated UI pass remains with the planner.
• Checked myself: Verified the clean exact head and base ancestry, reviewed the cumulative diff and relevant callers, and inspected the final proof logs.

[lukemaj]

Agent work on this PR

Estimated cost unknown · 0 responses · 50 sessions · 8.4 h wall time

Model	Responses	Tokens	Estimated cost

Flags: 4 human corrections · 96 large tool outputs · 118 repeated commands · 11 repeated failures · 120 repeated reads · 17 repeated skill loads · 49 sessions with usage bound to no task · 1 session without usage records

Details: snapshot, prices, coverage, counters

• Task toolboxmd/chromeria#175: outcome unknown (recorded acceptance only; a finished process never implies it).
• Proof: Port Promachos mode #175
• Snapshot 52672864d37fc2ab5e5c88a3de04d30f72f121df186464eb1d8f2eff2371fd2e, records up to 2026-10-08 22:04 UTC.
• 50 sessions on claude, codex; AgentsMD 14.6.0.
• Not counted: 6,994 responses (at least $164.69) in sessions shared with other PRs that worked in no single PR's checkout.
• 5,268 responses in these sessions worked on other PRs and are counted there.
• Totals reconcile with the measured sessions: yes. Evidence complete: no.
• Prices: list-price estimate from T3 local rate table (path withheld) as of 2026-09-28, schedule 696aae45933d0a684a015d3f08cfb6f1aa2fef02e7d272b4689e3a692ea04fff. Unknown prices stay unknown, never zero.
  • T3 LiteLLM rate table when present; bundled schedule covers the rest.
• Native session usage or worker ownership is unavailable.
• Harness-reported cost: none reported.
• Usage totals are not billing. Subscription spending is separate and is never posted as spend.
• Crashed runs are counted separately: 0.

Token counters by model (native counter semantics; never added across semantics):

Selected rates (USD per million tokens). These rates value the report at the selected schedule date; they do not establish historical prices or subscription spending.

Model	Input tier	Input	Cache read	Cache write	Other output	Reasoning

Other output and reasoning are priced without double counting inclusive native output. Missing rates remain unknown.

_{Local measurement from native records; usage totals are not billing. Updated in place by agent-observer publish.}

[lukemaj]

What: Independent review passed on the metadata-only successor head.
Why: The authorization proof lacked its required primary owner and allowlist registration.
So what: PR187 retains its source proof; CI checks the correction, and the planner owns the deferred integrated UI pass.

Reviewer verdict relayed unchanged:

PASS for exact head b837d5d681f817c1526c2e23f3dee2f489f1fe44 on base 7963bda523bbec5e5366c44e4a6ea34a5b10039e; no actionable findings.

The c6975bed..b837d5d delta is exactly two metadata files, docs/fork-features.md and scripts/fork-upstream-edits.txt (+2/-1). RpcAuthorization.test.ts now appears once as an upstream-owned file in promachos-mode and once in the #175 allowlist. The worktree is clean and the remote branch matches this head, so the prior source verdict and proof remain applicable; I did not rerun checks.

Coordinator Elon record:
Requirements and who asked: User and #175/#166 require allowlist and one-owner feature mapping for every carried upstream edit.
Deleted: No new product requirement or behavior change.
Bottleneck: CI confirms the ownership correction; deferred UI pass remains with planner.
Checked myself: Exact two-file delta, all16 edited upstream files' ownership and live head verified; inventory18 passes and implementation bytes unchanged.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.9 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: 73435be · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[lukemaj]

What: Independent source review passed for the exact current #175 head.
Why: The reviewer verified the merged-base port and the three module-local export corrections without authoring changes.
So what: Source review is complete; the inherited ACP CI failure and deferred integrated UI proof remain separate merge blockers.

Reviewer findings and verdict, relayed unchanged from the visible T3 reviewer:

Confirmed. PASS for exact head ce3aede9155d1cf7d2b7bfef53e55b1c5add6cb1 on base 36d5c0169fc042930aa36e41248c1292cec781d0, with no actionable findings. The only delta from 1c9b37f removes the three unused module exports; implementations and callers are unchanged.

I inspected the final receipts: three-file lint and web/server typechecks exit 0, four home tests pass, and the launch suite passed on identical launch code and runtime inputs. Inventory, clean worktree, diff check, and base ancestry are confirmed; the integrated UI and live-provider proof remain deferred as agreed.

Review identity: visible T3 thread sub.sub.sub.thread-9c8e27a973f0.dispatcher-c1e9a4151064.dispatcher-1f9eb305fe57.reviewer-3ddbf2b39baf, Prism-routed GPT-6-Luna through Codex, read-only. Coordinator publishes the verdict because the reviewer was instructed to make no GitHub mutations.

Requirements and who asked: User requires independent exact-head source review on the merged #183/#172 base.
Deleted: No additional proof runs, authoring or dependency repair by the reviewer.
Bottleneck: Inherited ACP Test Server 4 CI failure and planner-owned integrated UI proof prevent a merge-ready claim.
Checked myself: Matched this unchanged verdict to the clean, pushed current SHA and live PR187 base/head; inspected the failing CI log separately.

[lukemaj]

What: Independent exact-head review requests changes on8407456 for missing kit on partial launch retry.
Why: Thread creation and initial-message acceptance have separate receipts; the current retry branch only protects fully accepted launches.
So what: Planner approved recoveryA; this dispatcher is fixing it on the same PR and will obtain new exact-head review/CI.

Reviewer findings relayed unchanged:

Request changes: 8407456eb368e52e4b36cbef2f95a02a110ce5fb on base c87ee8c84eb901f5c8abbd24b54a6a7becdecea7

Blocker: a same-command retry can dispatch the initial message without the Prism kit. ThreadLaunchService commits the thread.create receipt first, then separately checks for and dispatches ${commandId}:initial-message (ThreadLaunchService.ts, message dispatch). If creation is accepted but dispatch is not, retrying the same command reaches the accepted-create branch in PromachosLaunch.prepare, which returns the original unprefixed message without resolving the kit again (PromachosLaunch.ts). The real-receipt regression is red: expected persona plus Hello, received Hello (/tmp/175-port/partial-launch-red.txt).

A fresh UI command ID is a different path: while still in the bootstrap flow, the existing shell is rejected as initial-only; if the thread has become persisted, a new send is an ordinary follow-up. Neither is the same-command retry that silently loses the initial kit.

The repair choice is still consequential and pending: recover the current kit from the stored model before message acceptance, or persist the original kit for retry. I’m not choosing between them. No other material finding from this review; the approved UI and live-provider deferral remains. The exact source head is unchanged; the regression test is an uncommitted user-owned change.

Coordinator update: reviewer’s pending-choice wording above is historical. Planner expressly approvedA: unaccepted initial message reads current kit through Prism.resolve explicit stored model, no validation/fallback/reroute/model change/durable state; accepted message receipt-only. The test is this dispatcher’s authorized #175 work, not unrelated user-owned changes. Green successor proof/review pending.

Requirements and who asked: User requires launch-time kit, preserved model, accepted-message dedupe and independent exact-head review.
Deleted: No unrelated repair or durable routing state.
Bottleneck: Owned partial-launch retry fix and successor review/CI.
Checked myself: Inspected two committed receipt boundaries and real SQL red regression; approvalA verified before source change.

[lukemaj]

What: Independent exact-head review passes the approved partial-launch retry fix.
Why: The successor preserves the stored model, rebuilds kit only before message acceptance, and retains accepted-message replay.
So what: Source review is complete on5315; CI must finish, with integrated UI/live-provider proof deferred to the planner.

Reviewer verdict and findings relayed unchanged:

PASS: 5315c2a7a96d42183fbbacf9c04a40b0277df706 on base c87ee8c84eb901f5c8abbd24b54a6a7becdecea7

The two-file successor fixes the partial-receipt gap: after an accepted create with no accepted initial-message receipt, it resolves the current kit using the stored model; once the message receipt is accepted, replay does not reload the kit or change the model. The real-receipt regression covers both paths and passes (5 tests); the server typecheck and focused lint also pass. The earlier red receipt reproduces the missing-kit failure.

No other material findings in the reviewed scope. Previous unchanged proof is reused; CI for this head is still rerunning, and UI/live-provider verification remains deferred.

Reviewer: visible Prism-routed GPT-6-Luna/Codex READ-ONLY T3 thread sub.sub.sub.thread-9c8e27a973f0.dispatcher-c1e9a4151064.dispatcher-1f9eb305fe57.reviewer-3ddbf2b39baf, no authoring or test reruns. Coordinator publishes unchanged verdict because reviewer writes were forbidden.

Requirements and who asked: User and explicit plannerA require current kit on partial retry, stored model preserved, accepted-message dedupe and exact-head independence.
Deleted: No validation/fallback/reroute/new durable state in approved recovery.
Bottleneck: Current-head CI completion; planner-owned UI/live-provider proof remains deferred.
Checked myself: Verified pushed exact5315/basec87, two-file owned fix, real SQL red/green receipts and current scoped type/lint results; matched this unchanged reviewer verdict.

[lukemaj]

What: Independent exact-head review passes the CI-only base successor927.
Why: All #175 source blobs and patches are identical to the reviewed/proved kit-recovery candidate.
So what: Source review is complete on the live base; automatic successor CI is running, with integrated UI/live-provider proof deferred.

Reviewer verdict and findings relayed unchanged:

PASS for 927c797727d5358d682e2525c84cf4c5f4edf70a on base d1107646b522926e9e32d127aacf1b9fea1ae9fd.

The worktree is clean and local and remote heads match. The base adds only the two workflow lines; all 38 PR file blobs match reviewed head 5315c2a, and all seven patches are unchanged in the range-diff. No new findings. I reused the prior source verdict and proof; CI for this head is rerunning.

READ-ONLY independent reviewer: visible Prism-routed GPT-6-Luna/Codex T3 thread sub.sub.sub.thread-9c8e27a973f0.dispatcher-c1e9a4151064.dispatcher-1f9eb305fe57.reviewer-3ddbf2b39baf, no authoring or proof reruns. Coordinator relays because reviewer GitHub writes were forbidden.

Requirements and who asked: Root requires samePR187 routine base maintenance, exact blob/range-diff reuse and exact-current-head independent status.
Deleted: No redundant local heavy checks or source changes for CI-only base.
Bottleneck: Automatic current-head CI completion; planner UI/live-provider proof remains deferred.
Checked myself: Verified live927/d110, clean worktree,38 identical blobs/seven identical patches and unchanged77-case scoped proof; matched unchanged reviewer verdict.

[lukemaj]

What: Independent exact-head review passes the merged recovery-history base successor734.
Why: Promachos initial dispatch does not supply continuation identities; affected receipt and type proof passes on the current base.
So what: Source review is complete; automatic current-head CI is finishing, with integrated UI/live-provider proof explicitly deferred.

Reviewer verdict and findings relayed unchanged:

PASS for 73435bedda993ddc954347ce79072caad93ba1c9 on base 4c2b38436fda0fef5bb2b101d52f90d7ed831df0. The worktree is clean, local and remote heads match, and all seven rebased patches compare equal; the fresh launch and server/contracts typechecks pass.

The new continuation marker is inert for Promachos’s ordinary initial dispatch: it supplies neither source ID, so the run fields are empty and recovery admission returns null. Projection storage preserves the marker only when a run already has one; Prism and ThreadLaunch APIs are unchanged across the base update. No new findings; CI is still running, and the approved UI/live-provider deferral remains.

READ-ONLY reviewer: visible Prism-routed GPT-6-Luna/Codex T3 thread sub.sub.sub.thread-9c8e27a973f0.dispatcher-c1e9a4151064.dispatcher-1f9eb305fe57.reviewer-3ddbf2b39baf, no authoring or proof reruns. Coordinator publishes unchanged verdict because reviewer GitHub writes were forbidden.

Requirements and who asked: Root requires current734/base4c rebase, affected proof and exact-head independent review on samePR187.
Deleted: No #192 repair or duplicated recovery/model eligibility logic.
Bottleneck: Automatic current-head CI completion; planner UI/live-provider proof remains deferred.
Checked myself: Verified live734/base4c, clean seven-patch #175-only diff, continuation/ProjectionStore input impact, fresh5launch/server/contracts receipts and unchanged reviewer verdict.