§19. Open questions (owner decides)

planarian @ a924e09 · Spec v4.6 · snapshot main · all versions

• GA threshold 60%; NixOS 26.05; MPL-2.0.
• All of Future Work v0.2 §1 accepted into v4.4; schema-affecting items land in Phase A (Oct 28).
• Invisibility budget targets: idle CPU < 0.5% of one core; resident memory < 50 MB excluding any model; no statistically significant frame-time or input-latency difference with Planarian running vs. stopped. Reference workload: one GPU-heavy game under Proton; the agent proposes the title and a scripted benchmark for owner sign-off.
• Probe kinds: typed kinds by default; administrator-authored Exec probes allowed, flagged.
• Hash-chained journal is a Phase A requirement.
• Unattributed-stop residue: accepted with an undo under Relaxed/Standard; ask window under Guarded/Sealed.
• Multi-user system-scope overrides: AskFirst for non-administrators when another uid’s session is online.
• Sandbox pass required for Tested where KVM exists, floored to AskFirst where not; Firecracker gym target non-gating from A.
• Installer selects the posture; boot-ready timeout configurable (60 s default, 15–600 s).
• Phase B grants to non-human principals: catalog and model-catalog authority only; merge authority requires two distinct approvers.
• Learned Diagnostic edges are never admitted without a passing gym case.
• Spec vulnerability review (Oct 29) merged as v4.5: a launcher for agents; the floor from the whole closure; no request field decides authority; trust accounting in three parts; I2, I14, I16, I18 qualified; the bypass register as a gate.
• Repairs run while an admitted boot-only change awaits its confirmation; a canonical repair in that window means it is not confirmed (Oct 31; I6, §10).
• Guarantees site: generated per commit and per tag, organized around invariants, published to GitHub Pages; never hand-edited (Oct 31; §17c).
• Rollbacks in activation scheduling: user-requested runs at once; diagnoser rollback after failed repair is a repair, floors and quiet mode still apply (Oct 31; §12f).
• Agents act with their user’s permissions, attributed per instance (Oct 30; §11, I24). GC stays Runtime with retainAllGenerations (Oct 30; I21, §12b).
• Close-out review (Oct 30) merged as v4.6. Decided: boot-only fallback is the publishing (running) generation, never known_good automatically (§12 step 7); parking in Built is bounded at 24 h, AwaitingBoot is unbounded and reported as waiting (§12f, I12); an external dependency needs a traversable edge, and the module rejects weaker ones (§10); approval tokens die with the daemon (§12 step 4, §12h). Taken as defaults, overturnable here: boot confirmation has two milestones, admission and the 10-minute confirmation (§10); only seated sessions carry a graphical expectation (§10); §6 describes the repository as it is.
• assets/identity/source/prompts.md records that the raster master was generated with an image model. Keep the provenance note in the public repository, or remove it? And is the identity kit under the repository’s MPL-2.0 or reserved? (Not a spec matter; recorded here so it is decided.)
• Rule 5 (TODO(owner) markers) has never been used: no marker exists in the tree. Either every default below was resolved (then say so in AGENTS.md and retire the rule) or the convention should start being followed.
• Provisional, revisit at each review: inferStops (§11) stands in for a unit-importance property. Revisit if importance should also affect daemon-proposed stops, quiet-mode deferral, diagnoser ordering, or the console. If it should, add importance as its own field, not a Sensitivity: sensitivity is the risk of changing a unit, importance the harm of its absence.
• Catalog coverage threshold for the personal-profile gate: set after the first catalog survey.
• Choice of the reference game and benchmark sequence for the invisibility budget.
• Phase B threshold Y.
• Six observed states plus Unknown/Transitioning — revisit after the A catalog.
• Phase C snapshot backend: btrfs only, or btrfs + ZFS?
• Nix vs Nickel for the Phase D evaluator.
• Boot model family/size (default ~4B, 4-bit, CPU, 8 GB floor).
• Reference laptop (E). Fork Asterinas NixOS or parallel distribution (E).
• Should Diagnostic edges be learnable from incident history in C, or stay manifest-only?