Lucface IOS, T0 audit, 2026-09-25
Join Protocol phase T0: doors closed, nothing pulled from the other builder yet. Same 12 dimensions, same prompt, reference field frozen at 2026-07-22. GHOST is ledger entry 001 (2026-07-22). Six parallel read-only sweeps plus lead re-verification of every score-moving receipt.
1. Scorecard, GHOST vs NOW, with receipts
Receipt. Live today: CLI; tap-server on the phone (258 action pages, checkboxes reach Claude); Overlap web scheduling live at meet.sandiegoaistudio.com; iPhone Shortcut over Tailscale SSH; OpenClaw gateway + Telegram bot + Discord bot running on lux (systemd, verified live). No voice loop into the OS, no wake word (zero hits outside research docs); Niero talks on the robot, not to the system. Twilio SMS blocked in A2P review since 09-03.
Up 1: more channels and a real mobile surface since July. Voice stays deferred by the 07-22 M6 decision (revisit after the SDAIS launch).
Receipt. 169 launchd plists (155 loaded, 4 non-zero exit), 30 Mac cron, lux 13 timers + 12 cron (ssh, live). Proof-of-work: 75 registered jobs, 76 ledgers, 34,316 rows, zero rows outside did_work/no_work/could_not; last 7 days 3,420 / 8,847 / 773 across 72 jobs. Night-shift catch-up (pow-catchup), 98 heartbeats, qdrant watchdog pages Telegram, digest separates a failed pipeline from a quiet night. Not self-healing by design (watchdog is read-only).
Holds. Open: 29 heartbeats older than 48h, night-invariants count fell from ~1,000 to ~430 on 09-20 with a gap 09-08 to 09-20, unexplained; mac-lux-backup could_not today while b2-backup and git-bundle-offsite did_work.
Receipt. Spine pattern across 8+ lanes, every sampled row carries source_refs (session UUID + locator), created_by, session_id, timestamps: levers 393, intents 1,438, opportunities 1,166, org 61, legwork 4,145 receipts in 8 kinds bound to session and cwd. 3,969 session traces, 4.6 GB. No sha or hash field in any current row of eval-ledger, proof-of-work, legwork, levers, dispatch-evals or capability-evals results. Append-only is a convention in ~19 scripts, not an enforced guard. No RFC-3161, no Merkle.
Down 1, stated: July's receipt was sha-bound eval ledger rows; no sha field exists in the current ledgers. The 8-band (append-only + source IDs) is exactly what is on disk. Smallest close: spine_core writes content_hash and prev_hash on every append (S).
Receipt. 76 Qdrant collections local (hybrid dense+sparse variants present). Weekly bench (Monday 06:35, plist verified): 25 goldens, 12 runs since 07-22; hit@5 by run 0.76 x4 (07-22), 0.60, 0.60, 0.80, 0.80, 0.80, 0.64, 0.76, 0.60 (09-21). Latest 0.60, 12-run median 0.76. The 0.90 vs 0.80 win over a live G-Brain install was a one-time bakeoff on 07-22, never repeated. Nothing watches the bench's own trend.
Down 1, stated: still measured weekly (cap does not apply) but the current number is the worst in the series and no alarm exists on the series. Co-lead with G-Brain is lost. Smallest close: bench pages when two consecutive runs fall below the rolling median (S); repeat the bakeoff (M).
Receipt. 229 skills with SKILL.md on disk (INVENTORY.md says 247, an 18-item drift), 137 commands, 22 active + 17 dormant agents, 6 enabled plugins. Trust: skill-trust ledger 1,261 entries (860 GO / 395 REVIEW / 6 MANUAL) enforced by a PreToolUse gate that denies BLOCKED and auto-rescans on content drift; definition-gate fails a write-capable capability with no fixture and no written exemption; dormant agents surfaced by keyword hook; Jev interviewed 24 times (5 hire / 11 pass / 8 defer).
Holds. Open: reconcile the 247 vs 229 count; 395 skills sit in REVIEW.
Receipt. Librarian nightly, 56 ledger rows, propose-only (refuses to write input paths, verified in code). capability-pulse daily writes the nudge map. idea-garden self-applies SHELVE, refuses KILL in code. Proposal-to-decision ratios: levers 338 proposed / 30 confirmed / 25 retired; eval ledger 131 proposed / 0 promoted; org proposals 10 / 0 decided. No autonomous skill curator, by doctrine.
Down 1, stated: the propose side scaled since July and the decide side did not, so the loop is open at the human step. Gating stays CHOSEN (Hermes-style autonomy is the surface behind its memory-poisoning finding); the pileup is EARNED. Smallest close: a weekly decide-queue in the digest with one-tap verdicts through tap-server (M).
Receipt. Dispatch evals weekly (Monday 06:20, plist verified): 70 fixtures, rate 0.914 on all 9 runs, orphan_count 140 to 153 and rising. Capability evals: 16 fixtures, 53 cases, 37 grounded in a real failure (0.70), 282 of 293 write-capable capabilities have no fixture. Proof-of-work is rung 7 at scale. Mutation suite for capability evals (~12 mutants); mutation_gate.py exists, unscheduled. Judge rubric exists (Jun 20); no scheduled LLM judge anywhere; --llm routing judge still spec, as in July. eval-ledger 131 @EVAL captures, none promoted.
Holds at 7 with much more under it (three rungs built since July). The rubric's 8 requires a semantic judge and that is the one thing still missing. Smallest close: the --llm routing judge over the same 70 fixtures, weekly beside the substrate run (M).
Receipt. Council (5 debaters, blind Fable adjudicator), fuse, architect-lanes with three typing lanes and --race in isolated worktrees, a Workflow script (12 parallel readers, forced schema), three quarantine tiers with tool restrictions verified in frontmatter, three report-only department heads, pp3p cross-model loop capped at 3, agent-supervisor. This audit itself ran as six parallel read-only sweeps.
Holds. Open: council and fuse advertise cost telemetry but persist no ledger; lane decisions are not logged to a spine.
Receipt. 83 hooks over 14 events; 13 PreToolUse deny-class gates (block-destructive, email gate, egress guard, skill-trust, mcp-trust, readonly-scope, release, config-protection, diff-sentry, pre-commit quality, circuit breaker). Quarantine agents + deterministic sanitizer. 1Password (op 2.32.1), ~/.secrets 700, zero loose .env, FileVault on, 5-min lock, YubiKey PIV, panic.sh from the phone. Gaps: about 5 canary systems and 8 hook tests for 66 hook scripts; egress denial log last written 08-05; research-proxy states in its own prompt that the network sandbox is not built; PROMPT-INJECTION-DEFENSE.md last edited 06-09; the email gate lives in two files and drifted for two days this month.
Down 1, stated: the architecture is the same but its test coverage is thin and one enforcement log looks dead. Smallest close: run_hook_tests.sh at pre-commit plus one two-sided canary per deny-class hook (S). This is the first item on the adoption list.
Receipt. Mac: 8 Ollama models, 6 MLX models, mlx-whisper. lux: RTX 5070 Ti 16 GB, 28 Ollama models, OpenClaw gateway, local Qdrant, /mnt/annex 1.8 TB (83% used). Frontier reasoning spread over Anthropic, OpenAI, xAI and Cursor lanes, no single vendor can switch it off. Backups: restic to lux, B2 nightly (did_work today), nightly git bundles (did_work today); restic check 09-10 37/37 clean.
Holds. Open: lux whisper service inactive at check time (CUDA flakiness known); mac-lux-backup could_not today.
Receipt. Org model + generated roster + THE BOARD; legal entity current (good standing, next SI 2027-04-30); tax desk with tickler; TwentyFive CRM active (last commit 09-21); Struvo active (09-12); J Dixon packet; syndicate approval-gated publishing with tests and a mutation file, content-fanout fail-closed; review gate on push. Finance: the controller agent and the eight finance modules exist and have produced enterprise-snapshot.json for 2026-07 and 2026-08 in the private data dir outside every repo (house rule: bank rows never enter a repo), but the August snapshot is marked NOT FINAL with 54 of 55 rows still needs_review, the run is manual (last 09-02, no scheduled job), and September awaits an export. Twilio A2P blocked since 09-03; Stripe live enabled, never charged.
Down 1, stated, receipt corrected after the sweep: the first receipt said the snapshot had never been produced; that was a filtered zero (the sweep searched only the repo, the file lives outside it by rule). The 9 stands on the corrected receipt: an unreviewed tail of 54 rows and a manual cadence are not a working finance rail. Smallest close: a review page with one-tap confirms for the tail, and a monthly proof-of-work job (S).
Receipt. n=1 confirmed by git shortlog across four repos (every other author is a bot or an agent). 37 public repos across three orgs, top star count 7. The audit repo: 0 stars, 0 forks, 0 issues. New since July: one outside builder holds a tailnet-scoped SSH key to this Mac (09-25), and the harness club is forming around this protocol.
Holds by design. The join itself is the T1 lever for this dimension.
2. Comparison against the frozen field
| Dimension | Lucface 07-22 | Lucface T0 | G-Brain | OpenClaw | Hermes | Position |
|---|---|---|---|---|---|---|
| D1 Ingress + voice | 5 | 6 | N/A | 10 | 9 | trail |
| D2 Autonomy + scheduling | 9 | 9 | 8 | 8 | 7 | lead |
| D3 Memory truth + provenance | 9 | 8 | 7 | 4 | 3 | lead |
| D4 Retrieval, measured | 9 | 8 | 9 | 6 | 5 | trail |
| D5 Skill library quality x breadth | 9 | 9 | 6 | 8 | 9 | co-lead |
| D6 Self-improvement loop | 8 | 7 | 8 | 8 | 9 | trail |
| D7 Evals + dispatch measurement | 7 | 7 | 9 | 3 | 4 | trail |
| D8 Multi-agent orchestration | 9 | 9 | 6 | 8 | 8 | lead |
| D9 Security architecture | 9 | 8 | 6 | 3 | 5 | lead |
| D10 Compute sovereignty | 9 | 9 | 2 | 8 | 8 | lead |
| D11 Institution + business integration | 10 | 9 | 3 | 4 | 5 | lead |
| D12 Ecosystem + momentum | 2 | 2 | 7 | 10 | 9 | trail |
Rival rows are as sourced 2026-07-22 and are not re-verified here on purpose (Join Protocol rule 1). N/A is excluded from lead counts.
3. Verdict
The system is wider and more measured than in July, and five scores went down anyway, because this re-grade allowed drops and looked at the ledgers instead of the architecture. The drops are all receipts that decayed or were never produced: no hash in any spine row, a retrieval bench nobody watches, proposal queues nobody decides, hooks nobody tests, a finance pipeline that has never emitted a snapshot. Leads fell from 8 to 7 of 12, and every trailing dimension is now classified, so the merge window starts from a baseline that cannot be narrated upward.
4. Trailing dimensions, classified
- D1 CHOSEN. Voice deferred by the 07-22 M6 decision; channels grew anyway (5 to 6).
- D4 EARNED. Measured weekly, but the series has no alarm and the current run is the low of the series.
- D6 EARNED (pileup) + CHOSEN (gating). Propose-only is doctrine; 338/30 and 131/0 are a queue that stopped draining.
- D7 EARNED. The semantic judge is the one rubric item missing, same as July, with three more rungs underneath now.
- D12 CHOSEN. n=1 by design; the join is the lever.
Leading dimensions that dropped a point (D3, D9, D11) are EARNED gaps within a lead, each with its smallest closing artifact named in the receipt.
5. Ranked moves (own work, not part of the join)
- D11 (S): a review page with one-tap confirms for the 54 unreviewed August rows, and a monthly proof-of-work job that imports the export and writes the snapshot.
- D4 (S): retrieval-bench pages Telegram when two consecutive runs fall below the rolling median; repeat the G-Brain bakeoff (M).
- D3 (S): spine_core appends content_hash and prev_hash on every write; a nightly verifier walks each lane.
- D9 (S): run_hook_tests.sh at pre-commit and two-sided canaries for the deny-class hooks. This one is also adoption #2 from the other builder and is the only predicted join delta.
- D6 (M): weekly decide-queue in the digest with one-tap verdicts through tap-server, so proposals stop piling up.
- D7 (M): the --llm routing judge over the same 70 fixtures, weekly beside the substrate run.
6. Pre-registration for T1 (Join Protocol phase P)
Predicted T1 scores after adopting the other builder's five patterns (claim lease, hook canaries with ask-with-override, injected routing table, PreCompact tripwire, runbook freshness contract). Written before any adoption landed. Moves outside this list at T1 are own work or unpredicted transfer, and get labelled that way.
| Dim | Predicted | Artifact that would move it |
|---|---|---|
| D9 | 8 -> 9 | two-sided canaries for every deny-class hook plus run_hook_tests.sh at pre-commit; ask-with-override in block-destructive |
| D2 | 9 -> 9 | claim lease is coordination between sessions, not scheduling; expect no rubric movement |
| D8 | 9 -> 9 | claim lease and SessionStart board injection improve coordination; already at the top of the band |
| D3 | 8 -> 8 | PreCompact tripwire and the verified/claimed split are hygiene, not provenance; no hash lineage in the adoption list |
| D5 | 9 -> 9 | injected routing table shrinks the prefix; library quality unchanged |
| D7 | 7 -> 7 | hook canaries are rung 1 and 2; the missing semantic judge is not on the adoption list |
| D1, D4, D6, D10, D11, D12 | unchanged | nothing in the five adoptions touches these; any move here in T1 is own work, not the join |
Honest reading: the five adoptions are predicted to move exactly one dimension by one point. Most of what transfers lives below the rubric's resolution (coordination, prefix size, compaction hygiene, doc rot). If T1 shows more than that, the protocol asks what was unpredicted, not whether joining worked.
7. Method notes for this re-run
- Drops were allowed and each is stated (Join Protocol rule 2). Five dimensions fell, one rose, six held.
- Receipts re-verified by the lead after the sweeps: retrieval series (12 runs), absence of hash fields in six ledgers, the Telegram and Discord bots and OpenClaw gateway running on lux, proof-of-work 7-day tally, backup outcomes today, skill-trust verdict counts.
- Correction 2026-09-25 16:40 PT: the D11 receipt originally claimed the finance snapshot had never been produced; it exists for two months outside the repo. Score unchanged, reason replaced. Recorded as a correction line under the ledger row and a comment on the issue.
- Unverified and scored as absent: Find My state; council and fuse run telemetry; whether the 29 stale heartbeats are dead jobs or slow cadences; the range-infra host counts.