a-prompt-reaches-the-work-it-serves — A captured prompt is matched to its existing intent and recorded on the task that follows, joined to its outcome and evidence, shown on /ui and the Cockpit, read only on its own machine and never published

✕BLOCKED 0 of 9 issues done

ready

0

blocked

9

active

0

verify

0

done

0

cancelled

0

Problem

Provider hooks archive prompts and draw episode boundaries, but they reconcile nothing. A prompt is matched to no existing intent: intents.propose refuses only an existing id (apps/majordomus-cli/src/capability/builtin/intents.rs:585-591), and the primary checkout holds untracked intents whose ids are slugs of pasted prompts. Dedup checks the bare prompt id over today's files only, with no lock (lib/capture.sh:563-570). No task records the prompt it followed (lib/start.sh:158-160), and no Rust code reads the archive. Every read is served to a caller beyond loopback (capability/model.rs:708-710, ADR 0126). The snapshots reach gh-pages after the privacy gates have run (.github/workflows/pages.yml:479-481 before the snapshot steps).

Outcome

The first vertical slice of the pack, with the privacy gates landed before the first reader of the prompt archive: UserPromptSubmit, then capture with a namespaced idempotency key, a deterministic match against existing intents, the task that records the prompt it followed (the validated state change, through the task lifecycle that owns it), that task's outcome and verify command, the evidence state of the criterion it serves, and the matched intent's knowledge on /ui/idd and the Cockpit, pushed on the live channel.

Current state

Capture is verified: .claude/settings.json wires UserPromptSubmit, and lib/capture.sh redacts before any write. devcontext/select.rs scores term share with named terms. The I2789 standing panel on /ui/idd shows each unmet criterion with its evidence state and serving issues (landed, ui/idd.rs). I3251 plans the brief and I3254 the duplicate refusal at proposal. I3220 plans frames for writes made through capabilities. None of the issues below has landed.

Desired state

I3406, I3434, I3432, I3408, I3411, I3433, I3435, I3409 and I3430 have landed, each as one pull request, each reusing the capture archive, the ledger, the task lifecycle, devcontext, intents.binding, the entity relations, ADR 0126's remote refusal and the snapshot exporter.

Scope

• lib/capture.sh
• lib/start.sh
• share/events.yaml
• test/cases/29_prompt_capture.sh
• test/cases/280_capture_status_states_its_denominator.sh
• test/cases/960_a_task_starts_bound_to_what_it_serves.sh
• test/cases/181_local_is_never_published.sh
• .github/workflows/pages.yml
• scripts/site-deploy
• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/tests/remote_callers.rs
• apps/majordomus-cli/src/web/report/snapshot.rs
• apps/majordomus-cli/src/capability/readings.rs
• apps/majordomus-cli/src/ui/source.rs
• apps/majordomus-cli/src/ui/view.rs
• apps/majordomus-cli/src/cockpit/pages.rs
• apps/majordomus-cli/src/devcontext
• apps/majordomus-cli/src/devcontext/mod.rs
• apps/majordomus-cli/src/capability/builtin/intents.rs
• apps/majordomus-cli/src/ui/intent.rs
• apps/majordomus-cli/src/ui/idd.rs
• apps/majordomus-cli/src/cockpit/intents.rs
• apps/majordomus-cli/tests/intent.rs
• docs/MAJORDOMUS_UI.md
• docs/CAPABILITIES.md

Out of scope

• Any model call in a hook or in the matcher
• Proposing, amending or promoting an intent (I3254, milestone an-outcome-becomes-a-reviewed-plan)
• Hook latency budgets (I3304)
• Codex prompt capture (I3410 under a-provider-carries-the-contract-natively)
• Monitor or mesh publication of matches
• A stored match record (the match and the slice are derived on read)
• Authenticating remote callers

Acceptance criteria

• The criteria a-replayed-event-is-one-change, a-private-read-stays-on-this-machine, a-prompt-meets-the-existing-intent, a-task-names-the-prompt-it-followed, the-slice-is-one-identity, the-intent-shows-what-it-knows and nothing-private-is-published are rewritten to evidence: test naming the proof each issue wrote
• majordomus intent validate and majordomus plan validate report no finding for these records
• No issue of this milestone adds a store, an event bus, an intent table or a peer identity

Validation

• majordomus plan validate

Risks

• I3408 and I3409 add the first reader of the private prompt archive; I3434, I3432 and I3433 land before I3408 and I3409 so that neither a remote caller nor a snapshot can carry a match
• I3408 waits on I3251, I3409 on I3431 (which waits on I3220), and I3430 on I3412 and I3431; I3406, I3434 and I3432 are wave 0 and need nothing
• lib/capture.sh is edited by I3406, I3411, I3410, I3143, I3303 and I3304; land in depends_on order and merge master between them; if I3304 moves the write path out of lib/capture.sh first, I3406's scope is re-recorded before it starts
• The cause of shared prompt ids (redelivery versus an id a provider reuses on resume) is uncertain; I3406 never deletes a record and writes a known key with different text as a counted collision
• Term matching answers unmatched for a prompt in a language no record uses, which is correct and may read as a miss
• When I3273 lands, its reconciliation of this campaign must classify the segments these records came from as existing; the campaign references in sources are what it reads

Issues

Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.

The graph

flowchart LR
    I3406["I3406<br/>A prompt delivered again, concurrently, on the next day or after a resumed session is still one record, and capture status counts every identity that more than one record holds"]:::blocked
    I3408["I3408<br/>A captured prompt is answered, on this machine only, with the existing intents and issues it matches or with no match, and the answer carries identities and never the prompt's text"]:::blocked
    I3409["I3409<br/>An episode answers, for each prompt it captured, the intent it matched, the task that recorded it, that task's outcome and the evidence of the criterion it serves, with the same identities on every surface and after any replay"]:::blocked
    I3411["I3411<br/>A task records the captured prompt it followed, so the join from prompt to task is a recorded fact rather than a time adjacency"]:::blocked
    I3430["I3430<br/>The IDD standing panel and the Cockpit intent page show, under each criterion, the knowledge that bears on it, each with how it is known"]:::blocked
    I3432["I3432<br/>The UI and Cockpit snapshots pass both privacy gates after they are placed and before anything is published, on CI and from a terminal"]:::blocked
    I3433["I3433<br/>A UI snapshot page renders only the readings its subject declares publishable, and a page that reads any other reading, or a capability that refuses remote callers, is withheld with a link to the live page"]:::blocked
    I3434["I3434<br/>A capability declared as reading checkout-private records answers only this machine: a caller beyond loopback is refused on HTTP and MCP, and the refusal logs no input value"]:::blocked
    I3435["I3435<br/>A Cockpit snapshot withholds every page that reads a capability refusing remote callers, not only the continuity page it names"]:::blocked
    I3406 --> I3408
    I3406 --> I3411
    I3408 --> I3409
    I3411 --> I3409
    I3432 --> I3408
    I3432 --> I3433
    I3433 --> I3409
    I3433 --> I3435
    I3434 --> I3408
    I3434 --> I3433
    classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
    classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px

Canonical record: .ai/repo/project/milestones/a-prompt-reaches-the-work-it-serves.yaml. Read it back with majordomus plan show a-prompt-reaches-the-work-it-serves.