The ledger

Declarative workflow-skills with triggers (timer/call/context-pattern); step = deterministic tool/sub-skill or guarded sub-agent-spawn. Unifies hands + sub-agents; loadable as packs.

D3 (2026-07-09, docs/design/capabilities-on-framework-2026-07-09.md) — the deferred PR 2.6 Constitutional Critic gate reintegration, as an ASYNC CriticGateStage in the turn's StagePipeline (right after DeliberationStage). Reuses the pure build_review_prompt/parse_verdict logic from agents-safety (widened pub(crate) → pub) but calls the LLM via ctx.llm.complete(...), never the blocking review_sync (whose thread::scope + join would starve a tokio worker). On Veto: publishes a response-draft-soft-veto observer event + injects a [CRITIC HINT: ...] nudge + RetryPasses, capped at 1 (ctx.critic_retry_count); a second veto is log-only (sent as-is). Fail-open (Approve-equivalent) on every LLM/parse error. Default OFF — caps.critic.gate_reintegration / OPENALICE_CRITIC_GATE_REINTEGRATION. Speaker-mismatch pre-check lens (2026-07-10, ports the dormant Q5 derive_speaker_context/build_critic_speaker_hint pair off the deleted api-handlers::chat_tools::agentic_loop::critic — see its old TODO Phase D Step 5c): the SAME single LLM call renders a SPEAKER CHECK block when the trailing user-run has ≥2 distinct speakers; a speaker_mismatch-shaped veto (is_speaker_mismatch_veto) gets the speaker-specific hint instead of the generic one, sharing this SAME retry budget — one combined spend, not a second counter.

E4b — the agentic loop's phases (turn-start, pre-LLM, LLM-call; response/gate/all-failed phases share the same staged fns unconditionally) run through core::ecs::StagePipeline. DEFAULT-ON 2026-07-06 (lab canary probe_alice 3/3 both ways, byte-identical parity harness); the legacy inline path + its OPENALICE_STAGE_PIPELINE kill-switch were RETIRED 2026-07-08 after 3 green gates + a live-prod bake with zero errors — the staged expression IS the loop's base now.

Phase M3b (2026-07-02, resurrected + re-hooked 2026-07-09 per docs/design/capabilities-on-framework-2026-07-09.md D1/D2) — OPT-IN tool-result self-verification. When a turn ran a successful mutating tool (any is_artifact_write_tool: workspace write/edit/patch/delete, send_file, git_add/commit/push), `DeliberationStage` injects one [VERIFY] reflection to re-read + confirm the change before finalizing (fixing it if wrong), then RetryPasses. SOTA verify-your-edits pattern; catches silently-wrong edits a tool-ok status misses. Capped at TOOL_VERIFY_CAP=1; only fires when a mutation actually ran. Default OFF — caps.deliberation.tool_verify / OPENALICE_TOOL_VERIFY.

THE agentic loop — the whole turn as a core::ecs::StagePipeline with declarative StageControl::RetryPass re-entry: every legacy `continue` (overflow recovery, durable resume, force-execute nudge, anti-fallback retry, next tool round) is a RetryPass and MAX_TOOL_ITERATIONS is the run_with_retries pass budget. Stages are thin adapters over the staged phase fns (single source of truth). ENDGAME COMPLETE 2026-07-08: inline monolith retired (morning), E4c default-ON, then the E4b sequencer driver + kill-switch retired (midday) — ONE loop. Every hand-over was pinned byte-identical by the parity harnesses (now loop_golden_pins.rs); the flip gate ran the full 9436-test suite through the pipeline.

Phase M2b (2026-07-02, resurrected + re-hooked 2026-07-09 per docs/design/capabilities-on-framework-2026-07-09.md D1/D2) — OPT-IN live turn-start planner. For a non-trivial request, `run_turn_pipeline` makes one cheap LLM call (turn-start only, never re-run on RetryPass) to decompose the ask into ordered subgoals and injects them as a [PLAN] block into the system message, additive on top of the existing static planning reminder. Fail-open (plan error / trivial request → no plan → normal loop). Default OFF — caps.deliberation.plan / OPENALICE_TURN_PLAN.

Phase M2 (2026-07-02, resurrected + re-hooked 2026-07-09 per docs/design/capabilities-on-framework-2026-07-09.md D1/D2) — OPT-IN live turn-completion verifier. `DeliberationStage` (between LlmCallStage and ResponseStage in the turn's StagePipeline) asks a cheap LLM judge whether the user's request is fully accomplished before the candidate draft is returned; a NO verdict injects a [SELF-CHECK] reflection naming the gap and RetryPasses the turn (capped at TURN_VERIFY_REFLECT_CAP=2). Upgrades termination from 'LLM stopped / cap' to goal-verification. Fail-open (judge error → treat as complete → never blocks a reply). Default OFF — caps.deliberation.verify / OPENALICE_TURN_VERIFY.

Phase 8XXX M4 — runtime ANSWER_COMPLETENESS scorer. Hybrid two-phase design: a cheap deterministic heuristic gate (question detection + key-term overlap, RU+EN aware) handles the common all-addressed case with zero LLM cost; an LLM verification phase (gpt-5.4-mini, ~300 input + 50 output tokens) adjudicates ambiguous bundles. Per-bundle retry cap (1) prevents follow-up loops. Conservative: parse failures and scorer errors return `Clear` so a bad scorer never blocks a reply. Consumed by reply.rs to transition the lane to FollowupNeeded when one or more questions in a coalesced bundle were silently skipped.

Caps-migration (2026-07-09, tail-close wave) — `install_default_scorer_from_env` is config-first: when a live unified-config handle is installed, `caps.answer_all.scorer` ("off"|"heuristic"|"hybrid", any other value falls back to "hybrid") selects the scorer; uninstalled processes keep the legacy `OPENALICE_LANE_SCORER` env read verbatim, including its "hybrid" default when unset. Schema default is "hybrid" — a deliberate deviation from the all-caps-off convention, matching today's de-facto default (prod already ships hybrid).

HITL approval queue — hierarchical routing (MEMBER → LEAD → admin), deadline-aware, notification-backed pending list for dangerous tool invocations.

Case fingerprint — SHA-256 over (agent, tool, canonical args) so that standing approvals, JIT grants, and safety audits key off a stable identifier.

GroupRegistry — CRUD, role-based membership, hierarchical tool resolution, group XP tracking, per-group MCP server discovery.

Just-in-time, time-bounded, task-scoped permission grants that auto-expire — lets agents temporarily reach tools they don't normally have with a TTL safety net.

Autonomous goal execution — CRUD missions, LLM planner that decomposes goals into task DAGs, reporter that delivers results to the configured channel. Scratchpad + mission.json per mission.

Agent Rank System — 4 metrics (Accuracy / Honesty / Execution / Discipline), hidden MMR (0-3200+), visible Bronze→Apex tiers with five divisions each. Honest failure scored above dishonest success.

Phase 8MMMM-PPPP follow-up — Reflexion B-hybrid scheduler scaffold. Fast-path triggers when a chat accumulates N completed turns since the last Reflexion (default N=10, env OPENALICE_REFLEXION_TURN_THRESHOLD). 24h daily floor covers chats with no fast-path activity. Activity counter REUSES openalice_coalesce::lane_state turn counts — no parallel counter. Scaffold only: trait + unit tests, NOT wired into the alice runtime yet.

Phase 8MMMM-PPPP POC — Reflexion heuristic synthesizer. Detects user follow-ups that match a misunderstanding regex (RU «не…/ты не…/имел в виду…» + EN «no/i meant») within 2 minutes of the prior assistant reply. Emits an overlay YAML proposal to prompts/proposals/ for NAO to manually merge. NEVER auto-applies. No LLM call — heuristic only. The LLM-backed impl is a follow-up wave. Per memory `feedback-alice-free-to-evolve-no-personality-optimization-2026-05-21` this is a SUGGESTION channel, not a tuning loop.

Phase 8MMMM-PPPP follow-up — Reflexion proposal archive sweep. Moves `prompts/proposals/*.rejected` older than 30 days into `_archive/YYYY-MM/`. Idempotent. NEVER deletes (per `feedback-memory-archive-not-delete-2026-05-02`). Designed for daily cron co-scheduling with the B-hybrid scheduler. Active (un-suffixed) proposals are not touched.

Steer mailbox — keyed by (agent_id, conv_id), accepts mid-run user course-corrections that the agentic loop drains at the next safe injection point (between tool calls / before the next LLM call). Bounded at 50 entries per pair; overflow drops the oldest with WARN.

Wave J #1 — regex-only intent classifier. Extracts action vs question vs chat, deliverable kind (file/skill/memory/none), and target_path from the user message. The Task Contract section (Wave J #3) renders only when target_path is present.

Wave J #3 — '# Task Contract (this turn)' section. Renders the expected deliverable kind, target path, merge constraint, and success criteria so the model has a load-bearing per-turn contract. Lights up only when the Wave J #1 intent classifier pinned a target_path on the user message. Full mode only.

Pre-approved permissions for specific tool-invocation patterns — exact, pattern, and scope match with TTL + use counting; bypass the HITL gate for known-safe fingerprints.

Wave R2 BACKGROUND_NOTE renderer — folds a different-speaker mid-stream event into the next turn's prompt as a stable literal `[BACKGROUND_NOTE from speaker @X: "..."]` prefix. Independent of Wave R3's `<speaker>` tag rendering so it survives across rendering changes.

Wave R2 cancel mailbox — keyed by (agent_id, conv_id), carries a one-shot signal that tells the agentic loop to abort the current LLM call cleanly at the next safe boundary. Used by the CoalesceRestart / CancelRestart strategies and by `alice-cli steer cancel`.

Wave R2 mid-stream steering facade — speaker classifier, intent heuristic, strategy selector, cancel mailbox, pending_after queue, metrics constants. Consumed by the connector bridge's `steer_routing` stage and by the agentic loop's cancel-poll site.

Wave R2 heuristic intent classifier (same-speaker case) — redirect vs follow-up vs additional info. RU + EN markers; pure str-match, no LLM, <5ms guaranteed.

Wave R2 Prometheus constants — `oa_steer_total{strategy=...}` counter and `oa_steer_decision_latency_ms` histogram. Dashboards / alert rules reference these strings; renaming is a breaking change. Master plan §12.1 R2 row.

Wave R2 pending_after_current FIFO — same-speaker follow-up events that arrived during an in-flight turn and must be processed AFTER the turn ends. The connector bridge drains this on in-flight guard drop and re-enters the pipeline with the queued event.

Wave R2 speaker-continuity classifier — same-speaker vs different-speaker comparison of the in-flight event vs the incoming event. Falls back to a (chat_id, user_id) surrogate when R3's speaker_id is not yet populated on Event.

Wave R2 strategy selector — maps (speaker_continuity, intent) to one of {CoalesceRestart, CancelRestart, QueueAfter, ContextInjectForNext}. Pure heuristic, no LLM. Measured by the `oa_steer_decision_latency_ms` histogram.