Orbit · Project Knowledge Base
Seventeen open calls across the agent-wiki plan and its self-hosted sync layer, ordered by what each one blocks. Recommendations are marked; pick yours, then copy the register back into the thread.
docs/wiki/ is personal-only. Enforced in three places already.Nothing can begin until these three are settled.
What gets built first?
WhyThe sync layer is independently useful the day it ships, and it gives the wiki compiler a surface every machine and agent can already see.
If wrongWiki-first means the compiler spends weeks writing into a directory only one machine can read.
Which repos get instruction files in Phase 0?
WhyPhase 0's proof is one fresh Codex session showing the injected block. One repo proves it. (Orbit itself has neither file today — Codex runs there uninstructed.)
If wrongStamping thirty repos before the schema settles buys you thirty rewrites.
How is the cross-harness contract carried?
WhyCodex auto-injects the AGENTS.md chain; Claude loads CLAUDE.md. One generated block in two files means no drift — and symlinks break on Windows and some CI checkouts.
If wrongDivergent instructions mean the two agents follow different filing rules into the same wiki.
Shape of the pipeline. Expensive to reverse once the compiler is writing.
Which architecture?
WhyB reuses the entire existing event spine and is worktree-proof; C is forced for work projects by the write invariant anyway.
If wrongA loses knowledge silently on abandoned branches and poisons pages with conflict markers. C-everywhere makes your approval queue the bottleneck, and agents stop recording lessons that need a click.
Where does the shared memory directory live?
WhyOut-of-repo is the only home that covers every project: it keeps the work invariant intact, survives worktrees, and adds no git noise.
If wrongIn-repo-only permanently excludes work projects from shared memory — the half of your work where cross-session context matters most.
What triggers the compiler?
WhyNightly matches the dream pass you already run. On-merge is the right end state — after the idempotence proof holds.
If wrongOn-merge before idempotence is proven puts compiler churn in every pull request.
What is the compiler's output budget per run?
WhyOpenWiki needed exactly these countermeasures in production; the diff budget is what keeps updates surgical.
If wrongChurn makes diffs unreviewable, and unreviewable pages stop being trusted — which is the whole asset.
Three amendments from the Hermes plan review. Each changes what ships, not just how it's described.
Do status pages carry completeness metadata, or only freshness?
as_of_snapshot source_watermarks expected_source_set unresolved_event_count quarantined_event_count completeness: complete | degraded | unknown
WhyThe review's sharpest point: continuing event traffic does not prove nothing was missed. Hooks fail open and 145 events are already quarantined — invisibly.
If wrongPages read as authoritative while silently incomplete — precisely the failure the snapshot machinery exists to prevent.
Who assigns provenance to agent-authored knowledge?
WhyIdentical to the dispatch-authority doctrine already shipped: an agent asserting its own trust level proves nothing about the world.
If wrongA prompt-injected or mistaken agent launders its claims into observed fact, and every downstream reader inherits it.
What happens when a project flips personal → work?
WhyBy the time the tag changes, knowledge already exists in git history, mirrors, the search index and possibly harness memory. A flag flip retracts none of it.
If wrongWork content stays published in places you believe are personal-only — and you have no list of where.
What counts as proof that a work project stayed clean?
WhyA clean git status misses committed changes, index state, and everything written outside the repo entirely.
If wrongThe test passes green while the invariant is already broken — the worst possible combination.
Shared memory is a credential-leak and prompt-injection surface. These three set the containment.
How does secret scanning behave on sync?
WhyYou already run a gitleaks-style scanner on the spool, so extending it is cheap. Reporting is the part upstream gets wrong.
If wrongA silently skipped file means a machine is missing knowledge nobody knows is missing.
Do agents get a knowledge digest injected at session start?
WhyIt is the only read path that needs zero cooperation from the model — but it is also a persistent instruction channel into every session, so the cap and the lint gate are the containment.
If wrongOne unvetted page poisons every future session on the machine, and the digest quietly eats the context budget.
Who may write to shared memory?
WhyThe membership table with exactly these two roles already exists and is already enforced for dispatch — reusing it costs nothing.
If wrongA read-only collaborator's machine can rewrite shared truth for everyone, with no audit of who changed what.
Safe to postpone — but each needs a named condition that says "now".
When does a real search layer go in?
WhyThat threshold is the documented cliff for index-first navigation, and your vault already has full-text search below it.
If wrongEmbeddings added early mean a refresh cost on every wiki write, for retrieval you don't need yet.
Do distilled facts get published back into each harness's own memory?
WhyCodex inlines its global summary into every session regardless of project, and the vendor team-memory path routes through an org server. Both are visibility decisions, not storage ones.
If wrongProject knowledge bleeds into unrelated sessions, or leaves the machine for a server you didn't intend.
What is the sync conflict policy?
WhyMarkdown edited at human pace conflicts a few times a year. The proven engine's judgment holds, and it is a day of work rather than a subsystem.
If wrongYou buy convergence machinery — and its bugs — for a problem you don't have.