[ARADR] Elisp crews, roles, OpenCode subagents and Git-preserved Prolog workspace #224

New issue

Open

opened 2026-09-20 01:27:19 +00:00 by nsaspy · 1 comment

nsaspy commented

2026-09-20 01:27:19 +00:00

Owner

Operator request — 2026-09-19

Implement an OpenCode orchestrator in the Emacs system, not a Qtile notification patch. Agents must communicate through emacsclient and share inspectable chat/files/KB/agents views. Consortium must be able to use OpenCode. The fleet is cross-repository; no permanent repo lanes.

Analyze / reuse

Use the existing lisp/llm/ integration and the private-file/data-only emacsclient pattern in scripts/opencode-tmux.org. Keep tmux launch/pick unchanged. Consortium owns ADARD orchestration; Prolog-RLM owns expert/tool authority. Emacs owns editor buffers and a bounded local actor mailbox, not another durable task database.

Design decision

Build a vanilla-Emacs-compatible, opt-in library with async make-process OpenCode workers, stable worker IDs, per-worker project/session/status, bounded inboxes and cancellation fencing. Add *chat*, *files*, *kb*, *agents-list* projections. Peer messages cross a fixed data-only JSON bridge; never concatenate message text into Lisp or a shell command. Treat emacsclient as trusted same-user access, not a sandbox/security boundary. Do not start a daemon without operator action.

First vertical slice

Canonical Org source + generated Lisp and Python emacsclient bridge, with parity tests.
Start/register a worker, send a prompt, consume bounded JSON events asynchronously, show errors truthfully and cancel owned work.
Send a peer message to a registered worker; queue while busy, reject full mailboxes, bound total turns; do not auto-ping-pong every reply.
Show explicit selected file references; never auto-upload every visited buffer.
Show loaded experts only from a runtime report callback; distinguish unavailable/unknown from an empty loaded set.
Workspace/project IDs and generation checks prevent stale callbacks updating a replacement worker.
Document commands, installation/load hook, provenance and limitations; keep old chat systems working.

Adversarial review / gates

Tests must cover split/invalid/oversized JSON, process death, cancellation races, queue overflow, unknown/spoofed peers, private-file mode/ownership checks, malicious quotes/newlines, and no shell/Lisp interpolation. A bridge success receipt is not proof of an OpenCode run completing. ERT + Python + literate parity; exact-head CI. Live OpenCode/auth and interactive Emacs smoke remain separate required evidence, not mock-green.

Ownership

Implementation starts here. Follow-up slices own Consortium interop and packaging/live integration. No merge, deployment, model spend or autonomous background fleet start is authorized by issue creation.

## Operator request — 2026-09-19 Implement an OpenCode orchestrator in the Emacs system, not a Qtile notification patch. Agents must communicate through emacsclient and share inspectable chat/files/KB/agents views. Consortium must be able to use OpenCode. The fleet is cross-repository; no permanent repo lanes. ## Analyze / reuse Use the existing `lisp/llm/` integration and the private-file/data-only emacsclient pattern in `scripts/opencode-tmux.org`. Keep tmux launch/pick unchanged. Consortium owns ADARD orchestration; Prolog-RLM owns expert/tool authority. Emacs owns editor buffers and a bounded local actor mailbox, not another durable task database. ## Design decision Build a vanilla-Emacs-compatible, opt-in library with async `make-process` OpenCode workers, stable worker IDs, per-worker project/session/status, bounded inboxes and cancellation fencing. Add `*chat*`, `*files*`, `*kb*`, `*agents-list*` projections. Peer messages cross a fixed data-only JSON bridge; never concatenate message text into Lisp or a shell command. Treat emacsclient as trusted same-user access, not a sandbox/security boundary. Do not start a daemon without operator action. ## First vertical slice - [ ] Canonical Org source + generated Lisp and Python emacsclient bridge, with parity tests. - [ ] Start/register a worker, send a prompt, consume bounded JSON events asynchronously, show errors truthfully and cancel owned work. - [ ] Send a peer message to a registered worker; queue while busy, reject full mailboxes, bound total turns; do not auto-ping-pong every reply. - [ ] Show explicit selected file references; never auto-upload every visited buffer. - [ ] Show loaded experts only from a runtime report callback; distinguish unavailable/unknown from an empty loaded set. - [ ] Workspace/project IDs and generation checks prevent stale callbacks updating a replacement worker. - [ ] Document commands, installation/load hook, provenance and limitations; keep old chat systems working. ## Adversarial review / gates Tests must cover split/invalid/oversized JSON, process death, cancellation races, queue overflow, unknown/spoofed peers, private-file mode/ownership checks, malicious quotes/newlines, and no shell/Lisp interpolation. A bridge success receipt is not proof of an OpenCode run completing. ERT + Python + literate parity; exact-head CI. Live OpenCode/auth and interactive Emacs smoke remain separate required evidence, not mock-green. ## Ownership Implementation starts here. Follow-up slices own Consortium interop and packaging/live integration. No merge, deployment, model spend or autonomous background fleet start is authorized by issue creation.

nsaspy changed title from ~~[RAGE 1/3] Emacs OpenCode actor workspace: peer chat, files, loaded KB and agents list~~ to [ARADR] Elisp crews, roles, OpenCode subagents and Git-preserved Prolog workspace

2026-09-20 02:34:21 +00:00

nsaspy commented

2026-09-20 02:41:01 +00:00

Author

Owner

Newest operator contract — ARADR crews

Supersedes the generic buffer names and single-worker framing above. Implementation is in existing PR #280 at f2f618d4c66d742a8e9d2f81b5861bb936db168e.

Names: *crew:chat*, *crew:files*, *crew:kb*, *crew:agents-list*, *crew:roles*; entry M-x +crew/workspace.
Elisp defcrew-role / defcrew; many instances per role, bounded concurrent workers, host-managed parent/subagent trees, narrowed authority and inherited/pinned skill contracts.
Typed ZARA-CREW/1 protocol is committed at contracts/zara-crew-v1/contract.md; actual local Prolog admission/phase rules are indexed from .prolog/kb/index.pl.
Every child receives the mandatory crew-expert skill and selected custom role skills. Real required expert inventory is not replaced with model prose.
ARADR is explicit; existing Consortium ADARD is not silently reinterpreted.
Preserve past Prolog and keep durable KB committed. Existing bytes/paths stay; append/new versioned knowledge only. CI rejects deletion, rename-away, rewriting, symlinks, uncommitted state and untracked/ignored KB files.

New generated source was actually tangled with Emacs and passed 16 Python + 12 SWI-Prolog + 13 ERT tests, including 40 instances of one role. Current exact-head read-only CI additionally checks the old KB index and DotfilesExpert re-export. Live OpenCode tool discovery, full external expert/Consortium integration and admitted write/test execution remain explicit open gates; no merge, live model calls or deployment.

## Newest operator contract — ARADR crews Supersedes the generic buffer names and single-worker framing above. Implementation is in existing PR #280 at `f2f618d4c66d742a8e9d2f81b5861bb936db168e`. - Names: `*crew:chat*`, `*crew:files*`, `*crew:kb*`, `*crew:agents-list*`, `*crew:roles*`; entry `M-x +crew/workspace`. - Elisp `defcrew-role` / `defcrew`; many instances per role, bounded concurrent workers, host-managed parent/subagent trees, narrowed authority and inherited/pinned skill contracts. - Typed `ZARA-CREW/1` protocol is committed at `contracts/zara-crew-v1/contract.md`; actual local Prolog admission/phase rules are indexed from `.prolog/kb/index.pl`. - Every child receives the mandatory crew-expert skill and selected custom role skills. Real required expert inventory is not replaced with model prose. - **ARADR** is explicit; existing Consortium ADARD is not silently reinterpreted. - **Preserve past Prolog and keep durable KB committed.** Existing bytes/paths stay; append/new versioned knowledge only. CI rejects deletion, rename-away, rewriting, symlinks, uncommitted state and untracked/ignored KB files. New generated source was actually tangled with Emacs and passed 16 Python + 12 SWI-Prolog + 13 ERT tests, including 40 instances of one role. Current exact-head read-only CI additionally checks the old KB index and DotfilesExpert re-export. Live OpenCode tool discovery, full external expert/Consortium integration and admitted write/test execution remain explicit open gates; no merge, live model calls or deployment.