@mrciphersmith/keryx 0.3.67 → 0.3.73

package/README.md

@@ -709,16 +709,23 @@ Grouped by what you are trying to do, not by internal module layout.
   order, your choice, the time you took and, after a deviation, an optional
   reason (asked once, and the tool result waits for it; an empty answer releases
   the wait; add or change it later with `/decisions reason`).
-  One question in three is asked blind (no "recommended" mark, random order,
-  revealed after the answer, changeable with `/decisions change`), never for
+  A question with a recommendation is asked in one of four ways: ordinary (arm A, the
+  recommended option preselected), the mark with nothing preselected (B), shuffled with the
+  mark (C), or blind (D: no "recommended" mark in the flag or the words, random order,
+  revealed after the answer, changeable with `/decisions change`). The arm is a seeded
+  function of a per-repository salt; the weights are 0.4, 0.2, 0.2, 0.2. Never blind for
   release, ship, publish, deploy, delete or push, nor for merge, drop, remove or
   force next to main, production, a branch or a table, or with no real object
   ("merge it"); agents set `--action` (or `irreversible: true` in `ask_user`) for
   the irreversible ones, and the report counts how often blind was refused.
-  `keryx decisions report` prints the match share by mode and stage and the
-  deviations, with no model; `keryx decisions open|answer|reason` lets any agent
+  `keryx decisions report` prints the match share by mode, arm, channel and stage and
+  the deviations, with no model (the pre-arm records are shown apart as legacy);
+  `keryx decisions rate` records whether a recommendation was good (yours, or a
+  model's self-assessment in a clean context) and `keryx decisions export` writes
+  the structure of each decision with no question or option text;
+  `keryx decisions open|answer|reason` lets any agent
   or chat bridge drive it. In the TUI, `/decisions` and a sidebar row show the
-  same report. See the
+  same report. The guide says what the journal does not measure. See the
   [Recommendation journal guide](docs/docs/guides/recommendation-journal.md).
 - **security** — deterministic secrets / PII / prompt-injection / egress
   scanning, redaction, and a policy gate at agent write seams, with a committed
@@ -742,7 +749,11 @@ Grouped by what you are trying to do, not by internal module layout.
   a working session keeps, plus an external hand onto it: the `slate.open` /
   `slate.writeSeed` / `slate.close` MCP tools let any MCP-connected harness open
   one scoped to its own session id and close it into the same review pipeline.
-  Local stdio only; there is no CLI verb. See the
+  Local stdio only; there is no CLI verb. In keryx's own sessions the slate is
+  also the model's working memory: a harness-written Trail of every tool call,
+  model-written Notes (`slate_note`), and read-only recall (`slate_trail`,
+  `recall_step`, `history_search`) replace re-sending old rounds; `/trail` and
+  `/notes` show you the same Trail and Notes in the shell. See the
   [Slate guide](docs/docs/guides/slate.md).
 
 **Run agents inside boundaries**
@@ -1040,19 +1051,36 @@ queued lines will not run. From the topic you can also run a fixed list of slash
 commands (`/status`, `/model` and `/connect` as buttons, `/new`, `/clear`, `/resume`
 in the same topic); `/mode trust`, `/plan off`, `/delegate` and `/external*` run only
 after a Yes press, and commands such as `/mcp`, `/guard`, `/route`, `/provider`,
-`/schedule`, `/rewind`, `/conform` and `/ci` stay local. Each message shows its state as a reaction and the topic shows typing
+`/schedule`, `/rewind`, `/conform` and `/ci` stay local. A topic is deleted when the
+shell exits, so `/history [N]` (1 to 20, 10 by default) posts the session's last messages
+back into the topic, yours and the agent's final answers, one message each; a resumed
+session whose topic was just created gets the last 10 by itself, once (the first time remote control is turned on in that shell); a turn that looks like it holds a secret is replaced by a placeholder. Each message shows its state as a reaction and the topic shows typing
 while a turn runs; see
 [commands from the topic](docs/docs/guides/drive-keryx-remotely.md#commands-from-the-topic).
 Without a connection `serve` starts as before, with remote control off, and only
 offers the local `/channels` routes. Replies are rendered in one of four modes,
 `remote.rendering` = `auto` (the default), `rich`, `html` or `plain`, set from the
 `/settings` row **Telegram rendering**: a table goes out as a native Telegram rich
-message in `auto` and `rich` (an aligned `<pre>` block in HTML), ordered and nested
+message in `auto` and `rich`, as wide as its content and scrolling sideways with no
+cell shortened (an aligned `<pre>` block in HTML; more than 20 columns stays ordinary
+text), ordered and nested
 lists, task items and rules keep their shape, and a refused rich message falls back
 once to HTML and once to plain text, so a reply is never dropped. `keryx remote
 format-sample` prints the sample in every mode with no network, and `/channels`
 shows the mode and the last fallback; see
 [how replies look in Telegram](docs/docs/guides/drive-keryx-remotely.md#how-replies-look-in-telegram).
+A turn started from Telegram runs under `trust` by default, like a shell `trust`
+turn: ordinary commands in the project run without a question and are recorded with
+the Telegram user id, while destructive commands, privilege escalation, downloaders,
+agent credential files, publish leases, untrusted content and MCP tools still ask;
+`spawn_subagent` is auto-approved under `trust`, as in the shell.
+The question carries an `Always` button that saves a pattern (list and remove them
+with `keryx permissions` or `/permissions`), waits 15 minutes by default, and there
+is no run limit unless `runTimeoutMs` sets one; `/stop` in the topic ends a run.
+`/remote-policy` and the **Telegram** group of `/settings` change the defaults. To
+get the old behaviour back set `permissionMode: "ask"`, `runTimeoutMs: 1800000` and
+`approvalTimeoutMs: 300000` in `remote/config.json`; see
+[permissions in a topic](docs/docs/guides/drive-keryx-remotely.md#permissions-in-a-topic).
 An approval question is confirmed by the shell: after you press Allow or Deny,
 `serve` waits five seconds for the shell to say it applied the answer to the question
 it was waiting on, then edits the message to "Allowed by ... at ..." or "Denied by ... at ...".