§3. Feature overview
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
| Feature | What the user sees | Status at v1 (NixOS service) |
|---|---|---|
| Fault detection | “audio: Failed (probe tone-playback)” within seconds; “Unknown” when evidence is stale | Yes |
| Deterministic repair | Restart-and-rebind faults fixed with no model, logged with reason | Yes |
| Incident discipline | No restart loops: cooldowns, backoff, flap detection, cooperation with systemd’s own restarts | Yes |
| Respecting intent | A service the user stopped stays stopped; conditional desired state (after login, when device present) | Yes |
| Durable transactions | A config change survives Planarian being killed mid-activation; the watchdog commits or reverts | Yes |
| Automatic revert | Failed probes after activation revert without the user | Yes |
| Model-assisted repair | Harder faults diagnosed by a local 4B model; proposals previewed | Phase B |
| Natural-language operation | “reconnect wifi”, “make text bigger” → matched action or cataloged change with preview | Yes |
| Risk tiers and approval | Security, external, user-data changes wait; approval re-validated at execution | Yes (CLI approval in A, root at a terminal; broker in C) |
| Disruption awareness | Actions that would drop your session or connection are classed and surfaced as such | Yes |
| Snapshots | Snapshot before every switch; restore on request; space-budgeted | If btrfs or ZFS present |
| Boot-confirmed generations | A kernel change is not “good” until it has rebooted | Yes |
| Visual console | Live graph of desired vs observed vs health, timeline, generations, incidents | Yes (read-only in A) |
| Degraded mode | Everything but model-assisted repair and fuzzy requests works with no model | Yes |
| Attributed actions | Every deliberate stop, disable, or disconnect is recorded with who did it, before it happens; nothing deliberate is undone | Yes |
| Security floor | Automatic revert never goes back below a generation that fixed a security problem | Yes |
| Failure posture | If Planarian itself fails or the system shows signs of tampering, the machine responds as declared: alarm, agents off, restricted access, or halt | Yes (Standard posture in A; all postures in C) |
| Quiet mode | Nothing non-urgent runs while a game or fullscreen app is in the foreground; updates wait for idle | Yes |
| Sandbox tier | Proposed changes tested first in a disposable Firecracker microVM | Phase B |