soul.demarkus.io:6309/index/decisions.md/v36 draft reader meta

Decisions

Architecture decision records for the demarkus core, for maintainers and agents finding what was settled and where the canonical copy lives.

Part of the demarkus-soul hub. Canonical here since 2026-09-28; docs/adr/ in git is a frozen archive of 0001 to 0027 (see where decisions live). Sub-project decisions live in their own series, for example /demarkus-library/adr/. Status, dates and supersession live in each ADR.

  • Decisions 0001 to 0020: the first twenty, from the broker web-client registry to the reconcile owner

  • ADR 0021: world registry announces drops, DNS label world names, one tenant door

  • ADR 0022: the MCP gateway takes its dependencies from Run, not the Server

  • ADR 0023: the broker is core, oauthsrv, gateway and storage behind one Run

  • ADR 0024: plugin binary packages by concern, a harness is a host.Host value

  • ADR 0025: WATCH is the eighth verb, the store emits hints only, protocol 1.0 freezes after it

  • ADR 0026: a client SDK under MIT with its own semver, the server never imports it

  • ADR 0027: world token files are optional at open and split into runtime and static files

  • ADR 0028: every store owns a durable change epoch and sequence behind backend.ChangeSource

  • ADR 0029: the broker issues the federation agent's hub token from agentTokens

  • ADR 0030: the broker generates and persists its state cookie key

  • ADR 0031: the bucket store seals receipts into change blocks the hub reads as a backlog

  • ADR 0032: the knowledge and memory brokers run inside the knowledge server process

  • ADR 0033: the knowledge server's bearer listener takes an identity bearer in the auth field

  • ADR 0034: the knowledge server derives the federation graph in process into the hub's checkpoints

  • ADR 0035: drop content-addressed fetch and the hash index tools before protocol 1.0

  • ADR 0036: the bucket store commits through create-only log slots with group commit

  • ADR 0037: the contract is the protocol, transports are bindings, two doors by credential kind

  • ADR 0038: a broker write carries the verified email as user and the MCP client name as agent

  • ADR 0039: drop the standalone federation agent before 1.0; the knowledge server is the only graph producer

  • ADR 0040: memory mechanics (gate, doctor, journal, context, curate, promote staging) live in the server; skills keep intent and the gate

  • ADR 0041: the knowledge gateway serves the hub's four branding documents without a bearer, so the library brands a cold pod and its sign-in page

  • ADR 0042: soul entries are agent-written; software supplies facts, never entries

  • ADR 0043: the memory model lives in client/memory/, a directory of the client module, not its own module

soul.demarkus.io:6309/adr/0042-soul-entries-are-agent-written.md draft reader meta

ADR 0042: Soul entries are agent-written; software supplies facts, never entries

Status: accepted (2026-10-14). Plan: deterministic session capture. Applies the responsibility boundary (agents decide meaning, software executes mechanics) to what lands in the soul. Part of the decisions hub.

Context

  • Capture depends on the agent choosing to write. The session-end nudge fires when a session changed files and wrote nothing, but carries no facts, so entries come out vague or not at all.
  • The first draft of the capture plan had the plugin binary write a journal stub on SessionEnd from the transcript and git state, with no agent involved, first as the default and then as an opt-in.
  • Automatic capture is a different product concept: record everything, then rank, decay and deduplicate the noise. demarkus is built the other way round. The agent is the librarian, writes are deliberate, the soul rules forbid trivia and anything derivable from the repo, and lookup quality rests on every document having been chosen.
  • An entry nobody chose to write is not curated. Even a factual stub competes with curated entries in lookup and dilutes the journal the session primer reads.

Decision

  • Nothing writes to the soul except an agent acting on its own judgment or a user's instruction. No hook, binary, server job or background pass creates or edits soul documents on its own, by default or as an option.
  • Software may compute facts deterministically and hand them to the agent: in a nudge, through a subcommand, in a tool result. The agent decides whether any of it is worth recording and words the entry.
  • Mechanics that act on a write the agent already chose stay allowed: the journal route, hub links, tag widening, the write gate, curate proposals applied after a human gate.
  • Reports stay reports. Doctor, staleness, conflict and near-duplicate checks surface findings; the agent or the user resolves them.

Consequences

  • A killed or abandoned session can leave no entry. Accepted: the floor is the agent's habit plus better facts, not an uncurated record.
  • The capture plan narrows to facts in the session-end nudge and a session-facts subcommand for /soul-journal.
  • Future proposals for auto-capture, decay, automatic consolidation or model rewrites of soul content are out of scope under this decision; reopening one needs a superseding ADR.
  • The knowledge system already holds the stricter form of this rule through promote and its human gate; the soul now states it explicitly too.

Alternatives considered

  • Automatic stub on session end, default on. Rejected: uncurated content in every soul, against the restraint rule and the librarian principle.
  • Automatic stub, opt-in. Rejected: an option that lowers lookup quality for those who enable it is still a second product concept to maintain, and it invites the next automatic writer.
  • Stubs in a separate unindexed area. Rejected: hidden content still costs storage and review, and a stub nobody reads has no value; facts handed to the agent at the right moment do the same job.
trail
  1. soul.demarkus.io:6309 v36
  2. 0042-soul-entries-are-agent-written