v0.7.0: RED→GREEN for scroll-notify + autocomplete

Properly followed TDD cycle:
- Reverted implementations, proved RED (3 assertions fail)
- Re-added implementations, proved GREEN (3 assertions pass)
- Recorded both outputs in org files

docs/DESIGN_DECISIONS.org

@@ -462,4 +462,16 @@ The critical risk is implementation: achieving the retrieval precision, Dispatch
 
 6. *The self-repair criterion.* "What belongs in core?" is decided by a single test: if this file is corrupted, can the agent fix it without human help? Corrupted core = dead brain, dead hands, or unreachable. Corrupted skill = degraded but self-repairable. If the agent has tools, identity, and user input, it can reason about missing awareness, edit the corrupted source file, reload the skill, and continue. If it loses its own reasoning loop, it has no way to self-diagnose. This is why context assembly and heartbeat generation were extracted to skills in v0.5.0 — the agent can detect their absence and reload them. The core contracts to the absolute minimum needed for self-repair: the pipeline, the memory, the transport, and the skill loader.
 
+7. *Why no subagents?* Claude Code, OpenCode, OpenClaw, and Hermes all implement multi-agent delegation (parent spawns child with separate context, tools execute, child reports back). Passepartout rejects this on principle. There are five reasons:
+
+   *Zero coordination overhead.* Subagents spend tokens on delegation protocols — prompt templates for spawning, agent-summary messages for progress reporting, sidechain transcripts for integration. Passepartout's single-brain model pays zero tokens for inter-agent communication.
+
+   *Causal traceability.* Every decision traces through a single Merkle chain, a single gate stack, a single memory space. With subagents, if a delegated agent makes a bad decision, the parent agent may never see the full reasoning — the subagent's internal context is opaque.
+
+   *Memory coherence.* Subagents require either duplicated context (wasteful) or context partitioning (lossy). Passepartout's foveal-peripheral model sees everything relevant in a single memory space — there is no context to split.
+
+   *The arXiv paper (2604.14228v1) validates this.* Section 11.3 notes that subagent isolation is a genuine trade-off: "Isolated subagent boundaries" vs unified memory coherence. The paper treats both as legitimate architectural choices.
+
+   *When would subagents be warranted?* If Passepartout ever needs to execute background tasks that don't share the main agent's context (e.g., nightly cron jobs, cross-project analysis), the architecture can add isolated agents as a skill — not as a core mechanism. The single-brain model is the default, not the only option.
+
 

docs/ROADMAP.org

@@ -1432,8 +1432,9 @@ Content (ordered vertically):
 4. ~Context~ — token gauge ~[████████░░] 42%~ showing context usage with color coding (green <50%, yellow 50-80%, orange 80-95%, red >95%).
 5. ~Files~ — modified files list with +/- line counts. Updated on every tool execution that touches files.
 6. ~Cost~ — session cost (~$0.12 this session~) updating after each LLM call.
+7. ~Protection~ — gate effectiveness counter: "Gates blocked: 3 destructive, 7 network exfil, 12 secrets." Updated on each gate decision. This is the specific-value-proposition panel — no competitor has deterministic gates to count.
 
-Implementation uses a fourth Croatoan ~window~ (sidebar on right) or a panel overlay. All data is already in the daemon's response plist (~:rule-count~, ~:foveal-id~, ~:gate-trace~). ~200 lines.
+Implementation uses a fourth Croatoan ~window~ (sidebar on right) or a panel overlay. All data is already in the daemon's response plist (~:rule-count~, ~:foveal-id~, ~:gate-trace~). The gate block counts come from a new ~*dispatcher-block-counts*~ alist tracked in ~dispatcher-check~. ~200 lines (includes panel 7 addition).
 
 *** TODO Sidebar overlay mode (< 120 cols)
 :PROPERTIES:
@@ -1651,6 +1652,24 @@ Claude Code has "output styles" (~default~, ~Explanatory~, ~Learning~). Hermes h
 - Style changes are immediate (next think() call). Survive restarts via config persistence.
 ~100 lines (~60 prompt templates + ~40 TUI integration).
 
+*** TODO Skill auto-detection — file-watch hot-reload
+:PROPERTIES:
+:ID:       id-v082-auto-reload
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Passepartout's image-based Lisp model enables hot-reload — redefine a function without restarting. No competitor has this. Claude Code plugins require manual ~/reload-plugins~. Passepartout can auto-detect changes.
+
+- Daemon watches ~org/~ and ~~/.config/passepartout/skills/~ with ~inotify~ (Linux) or ~kqueue~ (macOS). On ~.org~ file change:
+  1. Wait 200ms debounce (multiple writes within 200ms coalesce)
+  2. Tangle the changed org file: ~(org-tangle-file "org/skill-name.org")~
+  3. Compile the tangled lisp: ~(compile-file "lisp/skill-name.lisp")~
+  4. Reload: ~(load (compile-file-pathname "lisp/skill-name.lisp"))~
+  5. TUI shows system message: ~"Skill 'skill-name' reloaded (23 defuns, 0 errors)"~
+- Respects ~SELF_BUILD_MODE~ — core files require HITL before reload. Skills reload automatically.
+- On compile error: keep the old version loaded, log the error, show TUI warning: ~"✗ Skill 'skill-name' failed to compile — old version retained."~
+~80 lines in a new ~symbolic-file-watch.org~ skill.
+
 ** v0.8.3: Direction 3 — Adaptive Layout + Personality
 
 The TUI adapts to the terminal it's running in — full sidebar at ultrawide, compact at standard, minimal at narrow (phone/SSH). It has a personality: spinner style, relative timestamps, progress bars, live context help.
@@ -1859,6 +1878,21 @@ When moved from v0.12.0: the internal eval harness must ship before v0.10.0 so i
 - Task suite grows with codebase: every bug fix adds a regression task
 ~200 lines.
 
+*** TODO Autonomous certification badge
+:PROPERTIES:
+:ID:       id-v090-certification
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+After N HITL approvals of the same pattern, the dispatcher auto-approves it. But unlike Claude Code's "auto mode," this is deterministic — no probability, no model hallucination granting permission. The certification is a logical certainty.
+
+- When a pattern crosses ~DISPATCHER_RULE_THRESHOLD~, the dispatcher writes the rule to ~rules.org~ AND grants a certification entry: "Certified: shell commands targeting ~/memex/projects/* with git status are deterministically safe. 47 approvals, 0 denials."
+- The sidebar Rules panel shows: ~[Rules: 47 | Certified: 12]~ — learned rules vs certified patterns
+- ~/certifications~ TUI command: lists all certified patterns with approval counts, last-used timestamps, and the gate vector that checks them
+- Certification downgrade: if a certified pattern is later denied by the user, the certification is revoked and the pattern returns to HITL
+- This is the operational realization of "the more you use it, the cheaper it gets" — each certification represents a category of actions that will never cost another HITL prompt
+~60 lines in ~security-dispatcher.lisp~ + sidebar rendering reuse.
+
 ** v0.10.0: Tool Ecosystem (MCP-Native) + Voice Gateway
 
 *(Renumbered from old v0.8.0.)*
@@ -1957,6 +1991,35 @@ Claude Code's ~extractMemories~ runs at the end of each query loop, scanning the
 - Opt-out via ~AUTO_MEMORY=false~ env var. Extraction frequency capped at one per minute to prevent runaway API costs.
 ~80 lines in ~core-reason.lisp~ + reuse session transcript for context.
 
+*** TODO Universal cross-project Org query
+:PROPERTIES:
+:ID:       id-v100-org-query
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Passepartout's entire memex is Org — one format for memory, tasks, documents, transcripts. No competitor has this. Claude Code queries CLaude.md (one file), SQLite (separate DB), and file tools (grep). Passepartout can query everything with one function.
+
+- ~(org-query :tag "@urgent" :state "TODO" :since "-7d" :path "~/memex/projects/")~ — scans all projects in memex, returns matching Org headlines as memory objects. Zero LLM tokens, ~2ms execution.
+- ~(org-query :property "DEADLINE" :before "-1d")~ — overdue items. Feeds ~/agenda~ command.
+- ~(org-query :where "dispatch" :in-title-p t)~ — search headlines containing a term across all projects.
+- ~(org-query :limit 20 :sort :priority)~ — sorted, capped results.
+- This is the infrastructure that makes the GTD weekly review (v0.13.0) possible — pure Lisp tree traversal with no external database.
+~150 lines in ~programming-org.lisp~ (extends existing Org manipulation primitives).
+
+*** TODO ~debug-inspect~ cognitive tool — live state inspection
+:PROPERTIES:
+:ID:       id-v100-debug-inspect
+:CREATED:  [2026-05-08 Fri]
+:END:
+
+Lisp enables live state inspection that no TypeScript/Python agent can match. Claude Code has no REPL. Passepartout can inspect and modify its own running state.
+
+- ~debug-inspect~ cognitive tool: evaluates a Lisp form in the running image and returns the result as a structured plist. Parameters: ~code~ (Lisp form string), ~package~ (optional).
+- Read-only tool: auto-approve via v0.7.2 safe-tool allowlist. No side effects — inspection only.
+- Use cases: ~(hash-table-count *memory-store*)~, ~(inspect memory-object-by-id "node-42")~, ~(map 'list #'car *skill-registry*)~
+- The agent can introspect its own state to answer meta-questions: "How many objects are in memory?" "What skills are loaded?" "What was the last HITL decision?"
+- ~30 lines in ~programming-repl.lisp~ (extends existing repl-eval with safety guard).
+
 *** Competitive Advantage Analysis — v0.10.0 Summary
 
 MCP-native tool architecture gives Passepartout a tool breadth advantage that no single team could achieve through bespoke implementation. The MCP ecosystem is growing faster than any individual agent's tool set. By connecting to it rather than competing with it, Passepartout's tool count scales with the ecosystem — every new MCP server is a new Passepartout tool.