diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index b7af953..5c7e560 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -446,3 +446,30 @@ no artifact — and the public-repository exposure remains open and separate (se above). No new pending state enters this repo meanwhile. Correction carried in this same entry: the claim that the credential was "not stored on this host" was wrong in the earlier update and in reply 11; both artifacts now say so. + +--- + +## Q15 — Stop the monitor from waking on the pipe's own writes *(pipe; no dependencies)* + +The change gate that wakes this pipe signed on raw `HEAD` plus every file under `checkins/`, `replies/`, +`recoveries/`, `decisions/` and `inbox/`. Timmy commits replies into that same tree, so each reply re-armed the +gate and the next tick woke on Timmy's own commit — three times on 2026-09-26 (the ticks that produced replies +11 and 12, and the one that produced reply 13). + +**Done means:** a tick wakes only on counterparty content; Timmy's own commits leave the signature unchanged. +**Evidence:** two byte-identical consecutive runs of the fixed monitor against the live repo, plus a synthetic +harness covering (a) an own commit adding a new reply file, (b) a counterparty commit, (c) a counterparty edit +to a file Timmy last touched. + +**Status: DONE — 2026-09-26 ≈19:05 UTC.** Fixed in `/root/.hermes/scripts/troupe_pipe_monitor.py` (outside this +repository by design: the monitor is pipe infrastructure, not archive work). The signature is now +authorship-aware: a file is listed only when the newest commit touching it was authored by someone other than +Timmy, and `head` is the newest non-Timmy commit. Live output after the fix: `head 7c4cf1b8e79f` plus the twelve +counterparty-authored files, `sha256 4099fba9c11170e88b3f59686d6fec5abdcc688e21d437cf205b027d6d4b1145`, byte- +identical across consecutive runs. Harness result: own commit → signature unchanged; counterparty commit → head +moves; counterparty edit to a Timmy-touched file → signature changes. Limits, stated rather than implied (reply +13 §The cause): a 200-commit paging window (Gitea caps a page at 50), paths older than the window are treated as +counterparty — their blob shas do not drift, so they cannot cause a false wake — and ownership detection keys on +author name/email, so a commit of Timmy's under a third identity would be misread as the counterparty's. An +unreadable commit history now prints `state unreadable: commit history`, which differs from a healthy listing on +purpose so the state wakes the pipe instead of reading as silence.