personal-agent-os/memory-systems/agent-os/dream/insights.md

Insights — Dream Mode Consolidated Learnings

Living, de-duplicated knowledge base. Themes, not an append log. Newest evidence strengthens or replaces existing entries. Opened 2026-10-10 (first Dream Mode run).

🏛️ Standing Principles (epistemics & discipline)

• Pre-registration is load-bearing. For any falsification loop ("what died and why"), kill criteria + cost assumptions must be timestamped before the run. Post-hoc autopsies re-import survivorship bias through the writer. Schema must force the field.

• The critic must be a different engine than the proposer of the claim. Hard-wiring one model (even a strong one) as permanent critic creates correlated blind spots → sycophancy collapse. Rotate roles (planner proposes, reviewer critiques — separate profiles count).

• Optimize for honest falsification, not PnL. Success metric = cleanly-falsified claims per week at bounded cost. PnL is a rare lagging output; chasing it un-disciplines the only durable asset.

• Measurement integrity gates the experiment. If the instrument is broken (clock skew, unmeasured latency), the run is void — fix the instrument before running. Refuse to start a clock that would void every result.

• The durable asset is failures-with-autopsies, not strategies. Wins are published (survivorship bias + marketing); a fee-adjusted record of what died and why is scarce and never has to be re-learned.

• Honest-gap ledger. Every build report names what's wired, what's offline-only, what remains. Never claim live behavior that hasn't run.

• Name which cost/branch you're invoking before concluding. E.g. a taker fee says nothing about a maker edge's viability.

• Factual placeholders do not authorize synthetic testimony. A draft can require real values for brackets yet still invent a first-person customer journey or professional credential; do not generate or publish such claims without an actual authorized source.

• A known root cause with a cheap fix should not survive the day it was found — diagnose → propose → ask in the same turn; apply on approval.

• A defect in the instrument is not a death of the claim (strengthened 2026-10-11). When a claim fails because the spec/test was wrong, the honest record is withdrawal (never-tested) — never an autopsy with a cause of death. Filing a death for an unrun claim is the corpus's own survivorship-bias back door. The schema must carry a never-tested/withdrawn status so a documentation defect can't be written up as evidence of death.

• Durable-run integrity triad (2026-10-11). Any multi-day/unattended run must: (a) keep its progress counter in the durable store and replay it on startup (in-memory counted reset → the run can never reach its N, silently); (b) key liveness/stall detection on a quantity that changes when healthy (log file-size growth, never "last log line unchanged" — constant verdict lines make that a false stall); (c) make the recovery action idempotent and non-leaking ("confirm zero live before starting one" — a restart-on-stall cron that never reaps the prior process compounds the fault it exists to repair).

• A cron's own recovery action is a code path that needs testing. Treat every self-healing action as a first-class artifact: unit-check the idempotency guard and resource lifecycle on the restart path, not just the happy path. The recovery report must distinguish “PID found” from “process query failed/unavailable”; an ambiguous combined alert preserves safety but leaves no actionable next step.

• Read a gate at its registered N. When a statistical gate (e.g. a one-sided LB>0) prints a verdict before its sample is met, label it interim, not decisive until N=X — lead with that. A mean and its lower bound move at different speeds (2026-10-11: mean +0.019 while LB −0.099); an early negative LB is noise, not evidence.

• Literal compliance is a failure mode when intent is already on record (2026-10-12). A new instruction that contradicts a preference stated earlier in the same session must be surfaced before it is executed — especially when execution is expensive (a render, a delete, a spec change). "You asked for X twice; this says not-X — confirm?" costs one line and saves a cycle. A verification pass can pass its own spec and still fail the user: spec-compliance ≠ intent-compliance.

• Instrument the weakest link before the verdict, not after (2026-10-12). When a reviewer names the assumption most likely to flip the result, build its diagnostic while the sample is still small so the counterfactual is ready at N. Pre-built diagnostics beat post-hoc rationalizing.

• A MEDIA: send tag is a request, not a receipt (2026-10-15). Pushing a file with a MEDIA: path does not prove it reached the chat; verify on disk (path + size) and state honestly whether receipt can be confirmed before claiming "delivered." (The prop39 v2 "Sent where??" exchange was the cost of assuming.)

• Bridge verification splits into transport and action (2026-10-16). "Acknowledge receipt in your log" is satisfiable with zero local tools; a Gitea post is not (webhook sessions are tool-restricted). Test them separately, and route action-requiring bridge messages to a full-tool session.

• patch refuses Hermes config files by design (2026-10-16); the documented path is hermes config set. One failed write + correct fallback is fine; re-attempting the same write is the recurring-defect pattern.

• Creative iteration is single-variable by default (2026-10-15). On "these all suck" + a named baseline, fix one thing, re-render one file, re-show. Match the loop to the feedback signal, not throughput. A durable working preference of Tony's: serial, one-at-a-time, one fix per pass, until a baseline is locked.

• One representation, derived not duplicated (2026-10-12). When a contract lives as schema + template + validator (or any >1 list), derive the others from one source or they drift. Hardening the validator to read its required set from the schema closed the exact drift class that had produced a prior gap.

• Evolving instrumentation must record its change-point (2026-10-12). Instrumentation may change mid-run (e.g. added per-exchange logging), but the autopsy's evidence_links must carry every relevant commit hash plus a one-line change-point note ("X logged from commit Y onward; earlier signals have only aggregate"). Honest about instrument evolution without invalidating the pre-registered test.

• A prescriptive tool error is an instruction, not an obstacle (2026-10-13). When a tool fails by naming its own fix ("content is required — use action='remove'", "read the file first"), change the argument on the next call. Re-issuing the identical call is the most-flagged recurring error in this agent's own traces (2026-10-13 trace-miner: the write_file pagination refusal alone hit 172 sessions; blocked-command patterns another ~50) — treat it as a standing behavioral defect, not an accident. Never retry unchanged.

• Dream-mode discovery must be exhaustive for the target date (2026-10-18, found in self-audit). The 2026-10-16 same-night run missed the day's 148-message main session (it post-dated that run's discovery window) and wrote a "light day" note with open questions the day's own logs had already answered. Rules: (a) enumerate sessions by date bound, not recent-browse; (b) reconcile every open question against the day's evidence before writing — a note that re-asks what the day settled is a hallucinated gap. Corrected in place with a corrigendum header.

• Artifact in the message, decision in the prompt (2026-10-13). Any approval-gated write must ship its exact diff/payload in the reply body; the approval prompt is a bare yes/no. If the reviewer has to open a prompt to see what they're approving, the 60-min window burns and the work stalls a day — that is exactly how the OpenCode+DeepSeek request died on 10-13 with zero writes.

• Name the absence of a gate instead of inventing a milestone (2026-10-13). "When do we go live?" for a paper-only research artifact is a design question, not a status question. The honest answer is the structural one ("no go-live gate exists by design; here are the missing pieces"), followed by an offer to write the gate — that preserves honesty and momentum.

• Third-party-agent text pasted into a session may be addressed to a different worker (2026-10-13). Check the addressee before acting on imperative phrasing; a relayed recommendation can look like a direct instruction to Hermes.

• Match the destructive action's scope to the promise, then prove it (2026-10-13). A "strip 2 only" request was honoured as exactly one entry replaced (7 → 7 entries, −18 chars), with the before/after shown. Scope discipline like this is enforced by showing the diff, not by asserting restraint.

🛠️ Technical Notes

• Kalshi fees (verified 2026-10-10): taker = round_up(0.07·C·P·(1−P)), charged only when you take. Maker fee = 0 on ~12,500 of 12,699 series (only ~129 series tax resting orders, quarter rate; cancelling free; 14 niche series fee-free). Polymarket US is a separate, thinner, full-KYC venue with contested CA status; Kalshi CA is clean (CFTC DCM).
• Headless (-q/--oneshot) approval gate: profiles with approvals.mode unset default to manual → no user → dangerous-pattern commands (python -c, execute_code, rm -r, kill -9, heredocs) time out to BLOCKED. The execute_code fallback is gated too → retry loop that burns context. Fix: approvals.mode: smart (+ command_allowlist for scoped safe patterns) + tool-loop guardrails (hard_stop_after: 5). Cron-safe only after allowlist/config applied.
• Cron/unattended tool limits: python -c, execute_code, and heredoc script execution are blocked in unattended (-q) runs unless allowlisted; write_file refuses overwrite without a prior read (pagination paradox); terminal foreground cap 600s (else promoted to tracked background).
• Agent-loop roles: planner=Proposer, reviewer=Critic, builder=Executor, jimmy=Recorder. Independent engines per role; a critic that proposed the claim shares its blind spots.
• brag / MiArc video pipeline — verified gotchas (2026-10-12). Hyperframes' stacked config: data-automation volume lane supersedes data-volume — setting the "obvious" one silently does nothing (cause of the music-drowns-VO bug). Animated film grain is a bitrate trap: static grain took the file 101 MB → 14.7 MB with no visible loss. SVG scaleX scales about user-space origin → the arc collapsed to the left; fix with svgOrigin. Local voice = Kokoro venv at C:/Users/fight/.venvs/kokoro (am_michael male / af_heart female); narration must be per-line loudness-normalized (loudnorm under-corrects short clips). System Chrome is broken on this box → use Hyperframes' managed headless shell. Verify pacing (static-hold), mix separation, voice presence (cross-correlation r), and encode size on the delivered file.
• Prop 39 political explainer video (2026-10-15, in progress). Project C:\video\prop39 (Remotion, from video-stack\template). Single source of truth = C:\video\STACK.md (= Video Stack/Full Stack Spec.md in vault) — it wins over any older doc. 9-scene / 97.3s build, music beds A/B/C × landscape + vertical. Voice = Qwen3-TTS "Prop 38 Voice B" (consented human ref C:\tts\voices\user_announcer_ref.wav). Music = ACE-Step 1.5 (C:\Users\fight\Projects\ACE-Step-1.5, isolated py3.12, CUDA 12.8, gradio :7860), 93s instrumental beds time-stretched (atempo) to the voice tail. Loudness spec bar = −16 LUFS ±1, TP ≤ −1.5 dBTP, AAC 192k 48kHz; drafts were mixed ≈ −18.6 LUFS (~2 LU under — reconcile before final master). QA stack: ffprobe + ebur128 + Whisper ASR diff + contact-sheet vision. One open item blocking final = exact "Paid for by" committee name (placeholder "SPONSOR DISCLOSURE PENDING · DRAFT ONLY"). Workflow = serial: baseline Bed A landscape, one fix per pass. Two pending Tony calls: stop 2nd model LFM2.5-2.6B on :1920 (shares 3060 12GB w/ Qwen)? fix local C:\llama\restore_llama_servers.bat to start Qwen only?
• Grok↔Leonard bridge — LIVE (2026-10-16). Repo Tony_tech/hermes-grokbot-bridge. Webhook platform on TonyB gateway bound 100.64.0.1:8644 (tailnet, plain HTTP — diagrams say HTTPS, correct for tailnet scope only), multiplex_profiles:true; subscription grokbot → profile leonard; URL http://100.64.0.1:8644/p/leonard/webhooks/grokbot; per-route secret out-of-band only (Grok's config, never repo/git/chat). github_comment deliver is GitHub-only (shells gh pr comment) — Leonard posts replies via Gitea Issues API as leonard/tonyjbala, never Ty. Companion doc: hermes-grokbot-manual (file-loop). Grok box = grokbot-box 100.64.0.11 (HS_ty); offline when his Tailscale stops (route fine, peer down). Tony confirmed end-to-end 10-16. Open: Gitea reply-post path untested in practice.
• Provider fallback incident (2026-10-12): deepseek/deepseek-v4-flash-0731 (routeapi) went unavailable on billing/quota; role profiles silently failed over to Qwen on the brother-5090 rig for ~18 min. Check the profiles' actual model on health checks.
• OpenCode on this box (2026-10-13): opencode models exposes 51 models — 39 google/* + 12 opencode/*, all free tier; zero DeepSeek (opencode/deepseek-v4-flash|v4.1-flash|v4-pro all return UnknownError despite appearing in opencode.jsonc — no entitlement; a free model ran OC_SMOKE_OK, so the CLI is fine). The only working route to OpenCode+DeepSeek is OpenRouter: append OPENROUTER_API_KEY to ~/.config/opencode/.env (shell append to that file is blocklisted — use file I/O), add an openrouter provider block + "model" to ~/.config/opencode/opencode.jsonc, back both up first. Auth/config live at ~/.config/opencode/; auth DB ~/.local/share/opencode/auth.json is CLI-read-only. Held pending Tony's approval (clarify expired 10-13 20:18).

🧰 Skills / Tooling Notes

• Skill-review telemetry (2026-10-15): 196 total skills; 0 eligible for idle archive, 0 archived, 0 stale-watchlist. The same five merge candidates remain; description review confirms the duplicate-name test-driven-development pair shares the same TDD purpose but has complementary coverage (strict iron law vs repository discovery/browser verification), so merge only with approval. The 2026-10-14 curator report records 6 auto-archives + 3 reactivations among 47 checked; LLM consolidation was disabled and run.json lists no archive names.
• Recurring-defect reality check (updated 2026-10-16 trace miner): 498 sessions / 32,391 messages → 25 findings, ranking stable day-over-day. The same behavioral error dominates: paginated write_file refusal in 235 sessions; terminal script-execution blocks in 96 (cron) + 35 (-q); execute_code blocks in 25. Change the call after a prescriptive error; this is one behavioral fix, not an instrumentation shortage. The miner also logged 15 self-corrections across 4 sessions (new pattern S4).
• brag skill split (2026-10-12, done by hand on approval): official hub skill brag installed as authority (hermes skills install official/creative/brag); local skill renamed brag-launch-video → brag-local-addendum and slimmed 34.1 KB → 15.9 KB (box-specific deltas only). Lint: a frontmatter-only rename is invalid — skill name must match its directory.

🧵 Open Threads

• Trace-fix APPLIED 2026-10-17 (builder + reviewer): approvals.single_query_mode: approve is what actually unblocks -q — mode: smart alone was proven insufficient; plus hard_stop_enabled: true and terminal.timeout: 300. Verified live on both profiles. Configs backed up as config.yaml.bak-20261017. See ../04_projects/trace-review-bot/2026-10-10-trace-analysis-and-fix §6.
• Dream Mode live as of 2026-10-10 (skill + skill_review.py + 2 AM cron + dream/). Note for 10-12 = third run.
• OpenCode + DeepSeek — PENDING Tony (opened 2026-10-13 19:16). Needs: (a) which DeepSeek as default — v4.1-flash (matches Hermes default), v4-pro, r1, or all three with none set; (b) go / key-only / show-diff-first. Exact diff is recorded under 🛠️ Technical Notes. No writes made.
• Search OS authenticity gap — FIXED (2026-10-17). search_os.py now runs every draft through apply_authenticity_gate: first-party personas (business_owner, brand) are publishable; third-party personas (local_resident, industry_expert) are blocked unless a real person is recorded in search_os/search_os_authorizations.json. Blocked drafts render with ⛔ + reason, and the publishing queue reports the state per draft. Verified: 2/4 publishable on the example.com fixture, and an authorization record flips a blocked draft to publishable. (Same lesson as the crowd-sourced review problem: a first-person claim needs a person.)
• Sorter cron gap — FIXED (2026-10-17). The {{meta}} role token in Meta/vault-map.md pointed at 00_system, but every crew file the agents read (user-profile.md, vault-structure.md, tag-taxonomy.md, states/, health-reports/) lives in Meta/. Repointed the token to Meta; verified with a live Sorter run (TOKEN=Meta, NAME=Tony).
• Duplicate skill: test-driven-development exists twice at similarity 1.00 (software-development/ and software-development/agent-skills/). Proposed for consolidation; not merged unattended.
• Webhook sessions are tool-restricted (2026-10-16): no terminal, no file I/O, no private-network web access. Inbound bridge messages that require local action (Gitea post, file read, shell) will fail in a webhook context. Transport verification (receipt) works; action verification does not. Fix: route action-requiring messages to a full-tool session.
• AgentOS git mailbox (C:\Users\fight\AgentOS\agent-comms): 8 stale outbox messages (0001–0008, research-loop era) remain status: pending. Grok Bot bridge test (2026-10-16) confirmed receipt path works; Gitea comment post was never completed (tool gap, not transport failure). Superseded by the live webhook bridge — mailbox route is legacy; close out the 8 pendings and the seq-0015 handshake proposal.