ADR-046 companion — confirmed violations to remove

Authority: ADR-046 Snapshot: 2026-08-05
Purpose: executable remediation ledger, not an exception or compatibility allowlist. Every item below must be removed or brought into the exact ADR-046 shape. Finding an additional violation adds it to this list; omission from this snapshot does not make a conflicting implementation permissible.

Confirmed violations

• Single durable attachment authority. Managed conversation attachments are committed directly to cloud AgentFS before dispatch and are read from that same object only on an explicit authorized download/display. The managed outbound R2 materializer was deleted. Unrelated KB and device run-artifact products may retain their own object storage; they are not Hermes session files. Current managed path: inbound-artifact-materializer.service.ts and org-agentfs.writer.ts.

• Native attachment transport. Managed turns use one cloud AgentFS object plus a standard file:///... ACP resource locator handled by pinned upstream Hermes. R2 keys, inline/base64 bytes, custom agentfs:// locators, descriptor prose, and private ACP bridges were removed from the managed boundary.

• Transient transcript projection construction. The original hydrateFromHermesTranscript, projectMessage, projectSearchHit, and Object.assign(new Message(), ...) compatibility layer was removed, but the same projection survives under the renamed CanonicalTranscriptMessageResponse / CanonicalTranscriptSearchMessageResponse types and readCanonicalTranscriptMessages serializer. It maps native roles and timestamps and folds Postgres governance into new message-shaped objects. Authorized reads must expose the native SessionDB records unchanged and return access-controlled product metadata separately, keyed only by the exact Hermes locator. See conversation-transcript.response.ts and conversations.service.ts.

• Content/time duplicate masking. matchesModuloRedaction and containsProjectedTurn were removed. The frontend no longer suppresses legitimate identical messages by comparing role, content, or timestamps.

• Fabricated transcript-unavailable content and silent empty history. UNAVAILABLE_TRANSCRIPT_MESSAGE, hydrateUnavailableMessageContent, and caught authoritative-read failures returning false empty history were removed. Transcript failure remains a visible failure.

• Redundant full SessionDB rereads and custom completion metadata. resolveLatestTurnLocators and readCanonicalMessageContent were removed from successful completion. Humanwork does not make Hermes return private completion locators or rescan the full transcript after every turn; explicit authorized transcript reads consume native SessionDB records. The remaining blocker is the private Expert thread: its frontend expects workspace_message_added, but no production source currently emits that event from a native SessionDB mutation and the event lacks the full {sessionId, messageId} locator. A test-only injected socket event is not acceptance evidence.

• Postgres governance UUIDs exposed as transcript identity. Attachment URLs and Agent API message cursors/responses still expose Postgres message UUIDs. Public transcript identity must be the exact Hermes { sessionId, messageId } locator. The pushed feedback/SSE/socket correction is partial while attachment URLs, Agent API cursors, and compatibility DTOs still accept or expose the wrong identity.

• Mutable Humanwork response-style reconfiguration. The client mutation control and PATCH endpoint, prompt-snapshot invalidation, AgentFS SOUL.md rewrite, holder-generation key, worker rebuild environment, and Hermes patch were removed. A legacy/pre-provisioned typed value may be normalized into the immutable session configuration once at creation and shown read-only; warm turns cannot mutate or rebuild it.

• Repeated warm-turn configuration assembly. Warm turns still re-resolve release configuration, load pinned tool assets, derive tool ceilings, and persist runtime manifests. Stable configuration and tool availability must be established once and retained by the Hermes session.

• Legacy delivery/review state. Active and client-visible held_for_review, confidence thresholds, confidence/review response fields, and related UI/types were removed from the managed success path. Historical migrations retain only forward/rollback history and do not constitute a runtime gate.

• Synthetic delegation/tool-progress projection contracts. The dedicated backend projection subsystem, UI rendering, frontend API fields, and compatibility shapes were removed. Native Hermes/AgentFS records remain authoritative; the MCP ledger records only calls that actually traverse MCP.

• Fabricated media, automatic summaries, and ordinary-turn mode gate. [Media message], automatic threshold/status summary-model calls, and the agentic_mode_enabled ordinary-turn gate were removed. Attachment-only messages use their real AgentFS object. The explicit user-triggered summary endpoint remains a separate, intentional product operation.

• Polling and read-to-detect-change loops. Fixed conversation, queue, analytics, crisis, KB, machine-health, setup/KYC, pairing, client-creation, provisioning/eval, and metrics refresh loops were removed or replaced with mutation events and explicit reads. Remaining timers are display clocks, active WebRTC telemetry, coordinator/connector heartbeats, or genuine provider/scheduled jobs. AgentFS uses only explicit native pull/push work boundaries. An explicit user open/reload/refresh may perform one bounded authoritative read.

• One supervisor AgentFS overlay with native sync. Zig must confined-exec one resident Bun machine per supervisor. That Bun machine must open one organization AgentFS delta over the immutable bunfs runtime and serve every conversation-scoped Hermes child spawned with Bun.spawn. Current per-holder connection/lifecycle code must be removed. Sync follows the native pull -> local work -> pull -> push sequence with atomic rollback/apply/replay and last-push-wins conflicts. There is no long poll, NFS, Redis, revision protocol, ACP frame, or application merge bookkeeping. See the AgentFS overlay guide, AgentFS sync guide, and Turso conflict guide.

• No database run lease/fence or AgentRun on the normal turn path. The managed conversation, Expert side-chat, and Tavus paths no longer create, start, complete, fail, or foreign-key a per-turn AgentRun. Deterministic resident-holder affinity and in-process per-session serialization own concurrency. Measured completion scalars remain direct response data for billing; they do not require a second run ledger.

• Crisis authority rejects and never fabricates transcript content. crisis_mode_full_stop is enforced at client admission, queued-job recheck, Expert reply/draft release, Expert-to-Hermes dispatch, and final channel delivery before transcript mutation or external send. Misconfiguration is an explicit error; neither case manufactures assistant prose or review state. Outside those real authority/configuration failures, product posture does not withhold a valid Hermes turn. See the message-admission paths in conversations.service.ts.

• Attachment-only turns rejected by the managed boundary. The managed boundary now accepts a non-empty native ACP block list, so a real resource, image, audio, or embedded-resource block is valid without prose. The [Media message] workaround was removed.

• Legacy Humanwork prompt and history assemblers. assembler.service.ts, task-classification utilities, history-hygiene helpers, and the duplicate agent-gateway surface still encode red lines, crisis directives, KB blocks, skill/persona rendering, response contracts, placeholder filtering, or synthetic history. Dead compatibility code is not compliant merely because the current managed caller usually bypasses it; remove it or narrow any genuinely separate product use so it cannot assemble a Hermes turn.

• Duplicate Agent API transcript endpoint. GET /v1/agent-api/conversations/:conversationId/messages and its separate SessionDB scan/cursor/role mapping were removed. Hermes resumes its own SessionDB history; product consumers use the canonical authorized transcript API and exact Hermes locators. Current remaining Agent API surface: agent-api.controller.ts and agent-api.service.ts.

• Hidden full conversation-list and queue polling. The 30-second full conversation/sidebar reads and the SideChatPanel, ConversationTabs, ThreadSummaryCard, and AgentStatusBadge loops were removed. Authorized product mutations now refresh their scoped consumers; explicit open/reload/refresh remains one bounded authoritative read.

• Fabricated review telemetry and duplicate agent audit transport. The runner no longer invents confidence/review values, and a completed turn no longer makes a second synchronous POST /audit/log. Measured usage remains as direct scalar fields in the agent response for API-side billing plus local Prometheus and structured completion logs. There is no nested audit DTO or per-turn AgentRun projection. The resident worker still calls AgentFS.tools.start/success/error around just-bash even though Hermes' native SessionDB record already owns that tool call. Delete the duplicate worker ledger rather than retaining two audit authorities. The model gateway retains only the evidence it natively owns, and the platform security/admin audit log remains intact for real Humanwork actions. See worker.ts.

• Organization invariants are rewritten during conversation creation. ManagedHermesTurnService.establishNewSessionHome currently writes the organization /.env and /config.yaml again for every new conversation, and no organization /SOUL.md is established. Organization runtime provisioning must establish the three private organization files once; conversation creation writes only the conversation layer. The resident AgentFS view composes both levels on read without a third materialized file, compatibility adapter, or repair fallback. See managed-hermes-turn.service.ts and org-agentfs.writer.ts.

• Legacy transcript-mode/projection compatibility shell. boundary-transcript.ts, boundary_records, held_draft, sent_reply, and projectTranscriptRow were removed. The retained governance row is keyed by the exact Hermes locator and is not a prose transcript authority.

• Per-turn runtime-manifest and credential-control assembly. ManagedHermesTurnService.execute still resolves release configuration, loads every pinned tool binding, derives the session ceiling, persists a runtime manifest, and re-enters provisioning logic on every warm turn. Move immutable release/persona/tool configuration to session admission and retain it in the resident session; the warm call resolves only the existing session and routes the exact ACP turn without a credential or configuration carrier.

• No-file turns do not mutate or scan AgentFS. prepareTurnFiles and readTurnOutputs were removed from the managed turn. A text-only, no-output turn performs no API-side AgentFS read, delete, or outbound scan. See managed-hermes-turn.service.ts and org-agentfs.writer.ts.

• Dead shared-dropbox contract removed. Turn preparation, deletion, scanning, and attribution of /workspace/.humanwork/outbound were already gone; the remaining unused environment key and source constant are now deleted as well. The legitimate AgentFS workspace remains unchanged.

• Outbound files are not duplicated. The dropbox reader, copy beneath turns/<turn>/outbound, verification reread, base64 carrier, and managed R2 materializer were removed. An output remains its original AgentFS workspace object plus its managed virtual file URI.

• Telegram attachments reach AgentFS. Telegram media-only and captioned turns preserve their attachment metadata. The authorized API integration resolves the provider file_id, writes the bytes once to AgentFS, and sends the locator with the exact caption text. See normalize.ts, telegram.service.ts, and inbound-artifact-materializer.service.ts.

• Raw and Cloudflare email attachments are discarded. Email normalization retains only filename, MIME type, and size while dropping the parsed bytes; Cloudflare ingress then routes no attachments. Preserve the provider bytes only long enough for the API to write the sole AgentFS object, then pass its locator to Hermes. See normalize.ts, channels.controller.ts, and channel-media-proxy.service.ts.

• Live agent image has no host-workspace/R2 compatibility runtime. R2FileExchangeClient, r2_client.py, workspace_layout.py, inline-base64 staging, and host session-tree mounts were removed. The agent image exposes ACP; API file interaction is direct to cloud AgentFS.

• Second obsolete ACP/process implementation removed. The Docker-attach ACP transport and removed host-home provisioner contract were deleted. The sole supervisor is the resident Bun machine using Bun.spawn.

• Managed-agent R2 credential/proxy compatibility remains wired. The Agent API and runner control plane still expose artifact signed-URL credentials consumed by the legacy R2 client, and the related providers stay registered in the runtime-control-plane module. Remove the managed-turn artifact proxy path. Do not conflate this with separately authorized device or Mac PoC file-sync products. See agent-api.controller.ts, runner-control-plane.controller.ts, and runtime-control-plane.module.ts.

• Released documentation taught the wrong file authority. The current docs now define one cloud AgentFS object, one standard file:///... locator, one supervisor-local AgentFS overlay with native pull/push synchronization, and no runner file API. The misleading agent/R2_INTEGRATION.md, obsolete agent-harness guide, and executable legacy runtime plans were deleted; current companions are agent/AGENTFS_INTEGRATION.md, agent/docs/WORKSPACE_LAYOUT.md, sandbox-generated-artifact-persistence.md, session file authority, and railway-env-vars.md. Historical archive records remain explicitly non-authoritative. Executable R2/base64/host compatibility removal remains tracked by the separate code items above.

• Legacy host runtime-config distribution removed. The internal runtime-config endpoint, orgs-runtime-config.service.ts, and host ORGS_RUNTIME_ROOT reads of SOUL.md, config.yaml, and skills were removed. Agent Service provisioning/routing rows remain only to locate the resident Hermes holder.

• Organization suspension destructively cascades through durable Hermes state. The single-assignment offboarding path retains the Specialist, but organization-wide suspension removes every OSA row. Foreign-key cascades then delete Hermes session indexes, delivery receipts, native-memory/recall records, Slack routes, runtime bindings, and video-context snapshots. Suspend access and stop new admission without deleting the Specialist identity, AgentFS/SessionDB indexes, transcript locators, memory, or durable routing; destructive retention/purge is a separate explicit operation. See organizations.service.ts and the Hermes, governed-memory, Slack-route, Tavus-binding, and video-context migrations under api/migrations.

Completion rule

ADR-046 is not implementation-complete until this ledger is empty, the residual repository audit finds no additional violation, all required automated evidence passes on the exact pushed head, and fresh Percy 01-10 browser conversations pass against a stack rebuilt from that same head.