Broken canon inventory

Broken Canon — Stale / Contradictory References

Audit date: 2026-05-11 Scope: ~/jarvis/hinesipedia/Fleet/, ~/.claude/docs/*.md, ~/.claude/CLAUDE.md, plus ~/jarvis/CLAUDE.md and ~/jarvis/hinesipedia/CLAUDE.md (vault-root variants that load on cwd). Purpose: Inventory what would mislead a restarting agent BEFORE Wes restarts variants. Severity tagging at end. Checklist at bottom.

Conventions used below:

HIGH = would actively mislead a restarting agent into a wrong action (e.g., hit a dead service, lean on a deprecated authority, leak a secret).
MED = inaccurate or stale framing; unlikely to cause damage but degrades trust / sows drift.
LOW = cosmetic, structural, or duplicate; clean up but no urgency.

1. `secrets-pointer.md` — actively dangerous secrets-retrieval pattern

File: /Users/wesleyhines/.claude/docs/secrets-pointer.md Lines: L7-21 (the entire “Grab all keys” + “Grab one key” blocks)

Quoted content:

## Grab all keys
curl -s -H "Authorization: Bearer $FLEET_AUTH_TOKEN" \
  "http://100.69.233.7:7700/store/memory?namespace=secrets" | jq

## Grab one key
Note: fleet-node ignores the `&key=` query param — fetch all, filter locally.
curl -s -H "Authorization: Bearer $FLEET_AUTH_TOKEN" \
  "http://100.69.233.7:7700/store/memory?namespace=secrets" \
  | jq -r '.entries[] | select(.key == "GEMINI_API_KEY") | .value'

Why it’s stale: per Wes’s correction captured in ~/.claude/projects/-Users-wesleyhines/memory/feedback_fleet_node_keyed_path.md (2026-05-07), this exact pattern — listing the namespace and filtering client-side — silently dumps the full namespace into the transcript and is the shape that leaked four secrets into Frank’s PC jsonl. The correct retrieval is the keyed-path GET /store/memory/<KEY>?namespace=secrets. Wes flagged this as “at least 4 secrets leaked into PC jsonl before stop-and-surface.” The doc still teaches the leaking shape and explicitly tells the reader that keyed lookup doesn’t work.

Severity: HIGH — a restarting variant that follows this doc will replay the 2026-05-07 leak incident. This is the single most dangerous stale doc in the audit.

Additional staleness on the same file:

L25 lists only 10 keys as “available”. The actual namespace per Fleet/working/fleet-finish-2026-05-06/validations/secret-connection-inventory-*.json carries far more (Brave, Cloudflare, GHL/HCP per-client, Meta/Google Ads, Slack, multiple Telegram bots, etc.). MEDIUM on its own; HIGH in combination with the leaking shape because users will try to “grab the missing key” using the wrong endpoint.
L29-31 admits MCP env blocks still have keys baked in and calls it “Future step” — that future is largely closed; security-canon.md (L83-126) is the live rule-set.

Recommended action: delete this file or rewrite to point at the keyed-path pattern from feedback_fleet_node_keyed_path.md + security-canon.md. Until then it actively contradicts canon.

2. `architecture/peer-bridge-runbook.md` — names hines-mcp as a live fleet-service

File: /Users/wesleyhines/jarvis/hinesipedia/Fleet/architecture/peer-bridge-runbook.md Line: 128

Quoted: - Matches the rest of fleet-services (fleet-node, hines-mcp) which run on Grater

Why it’s stale: hines-mcp on Grater :3847 was deprecated by Wes 2026-04-22 and confirmed dead by Flint’s grater-lane audit (Fleet/working/grater-lane-flint-2026-05-04.md L191-203: “no process on :3847, ss -tlnp empty”). Every other canon doc flags this; this runbook treats it as a peer fleet-service in a sentence Wes could read and miss.

The runbook frontmatter says status: live, shipped: 2026-04-28 — so it loads at face value as current architecture, not history.

Severity: HIGH — quoted in a status:live runbook, presented as fleet context for a migration plan. Exactly the “forgotten doc still says use hines-mcp port 3847” line Wes flagged in the recon brief.

Same file other concerns (MEDIUM):

L37-46 paths reference C:\Users\wes\Work\research\cortextos\... and ~/.cortextos/state/.... Per Fleet/working/clars-ethos-intake-2026-05-06.md L24-26 and cortext-contamination-audit-2026-05-04.md, the .cortextos daemon and PC .cortextos/state collector are PROPOSAL/QUARANTINE, not approved canonical fleet substrate. Treating “cortextos dashboard reads those heartbeats to render the agents list” as live (L12) overstates current state — PC has the collector, no other machine does.

3. `.claude/docs/user.md` — fleet count contradicts machines.md

File: /Users/wesleyhines/.claude/docs/user.md Line: 5

Quoted: Solo operator. 4-machine fleet with autonomous AI agents.

Why it’s stale: Every other canon doc says 5 machines. ~/.claude/docs/machines.md lists Clarvis (M1) + Clippy + Cheesegrater + iMac

Mac = 5. Fleet/anthropic-feedback-deferred-tools-preload.md L22 says “~15 Claude Code variants across 5 machines.” Health-check report 2026-05-11 says “5 machines scanned via Lynis.” Auto-memory in MEMORY.md says “5-Machine Fleet Status.”

Severity: MED — user.md is loaded by every CLAUDE.md import on every machine. A restarting agent that internalizes “4 machines” will silently exclude Clarvis when reasoning about fleet scope. Not catastrophic, but it mismatches the operator-doctrine line in index.md L34 and machines.md L40-46 which name the Active 18 on five machines.

4. `.claude/docs/fleet-rules.md` — Clarvis missing from coordination protocol + vault paths

File: /Users/wesleyhines/.claude/docs/fleet-rules.md

L21-25 (vault paths):

- Cheesegrater: /storage/jarvis/hinesipedia/
- PC: Z:\hinesipedia\ (mapped from \\100.69.233.7\jarvis — use hinescreative account)
- Mac: ~/jarvis/hinesipedia/
- iMac: /mnt/jarvis/hinesipedia/

Missing: Clarvis (M1) — should be ~/jarvis/hinesipedia/ per machines.md L31 and conventions.md L41.

L28-31 (coordination protocol):

Staggered wake times: cheesegrater 30s → iMac 45s → Mac 60s → PC 75s
Claim-before-act on group asks. Post "Claiming [task]", wait 15s, check competing claims.
Tiebreaker (alphabetical): cheesegrater > iMac > Mac > PC. Lower-priority stands down.

Conflicts with conventions.md L18 ordering Cheesegrater > Clars > Clippy > iMac > Mac > PC (which includes Clars/M1). Also conflicts with machines.md L73 `Cheesegrater > Clars > Clippy > iMac

Mac`.

Severity: MED (drifting toward HIGH on multi-machine claim-before-act). Loaded globally; would cause Clarvis/M1 to (a) be invisible to claim-before-act arithmetic and (b) be miscounted in the tiebreaker if multiple machines try to claim simultaneously.

5. `.claude/CLAUDE.md` (Mac machine doc) — Codex framing as “hosts COdex”

File: /Users/wesleyhines/.claude/CLAUDE.md Lines: 4-6

Quoted: Hosts COdex and ad-hoc human-driven sessions.

Not strictly stale, but partial. Per variant-mapping.md L113-118 and the 2026-05-02 entry, Mac now has Codex as a named first-class variant (in the Active 18-adjacent layer per enabled-agents.json “first-class” tier). This is fine. The drift: machines.md L13 says Mac “Also hosts Clars worker agents (spawning allowed, coordinate around Wes’s active hours)” — that contradicts variant-mapping.md which puts Clars on M1/Clarvis, not Mac.

Severity: MED — would mislead a Mac-side agent into spawning Clars workers locally when Clars is the M1 persona.

6. `.claude/docs/variants/clarvis-jiminy.md` — uses dead-name “Tony”

File: /Users/wesleyhines/.claude/docs/variants/clarvis-jiminy.md Line: 21

Quoted: I report to Tony for dispatch and escalation. I talk to Wes directly via Telegram when he replies to a nag.

Why it’s stale: per variant-mapping.md L23-32 “naming canon (binding)” and variant-mapping.md L98 (clarvis-tony runtime-id maps to PersonaName Clars), “Tony” is explicitly the kind of bot/runtime-artifact-as-name drift Wes called out 2026-05-01 as a category error. clars.md (the live variant doc) L5 says directly: “‘Tony’ is an informal role-flavor — it is not my name.”

Severity: MED — this is a variant identity doc; a Jiminy restart that loads it will think its dispatch line goes to “Tony” which is no longer a canonical name on the mesh.

Also same file (LOW): the file is a duplicate of jiminy.md (the current canonical one with @~/.claude/docs/fleet-ethos.md import). Per diff jiminy.md clarvis-jiminy.md the two diverge at line 1 — the legacy clarvis-jiminy.md lacks the ethos import. If a runtime resolution picks it up, the variant boots without the shared ethos.

7. Duplicate / legacy variant docs in `.claude/docs/variants/`

Files:

/Users/wesleyhines/.claude/docs/variants/clarvis-aleph.md (legacy) vs aleph.md (current with ethos import)
/Users/wesleyhines/.claude/docs/variants/clarvis-blue.md (legacy) vs blue.md (current)
/Users/wesleyhines/.claude/docs/variants/clarvis-jiminy.md (legacy) vs jiminy.md (current)

Each pair: the clarvis-*-prefixed file omits @~/.claude/docs/fleet-ethos.md on line 1; the current file leads with it. The legacy files match the old clarvis-aleph / clarvis-blue runtime-id naming shape, which by variant-mapping.md rule is an artifact, not the variant’s name.

Severity: MED — same identity-drift risk as #6. A boot recovery that falls back to runtime-id resolution and picks clarvis-aleph.md rather than aleph.md loads (a) the wrong title shape and (b) no fleet ethos.

Recommended action: archive the three clarvis-* legacy files into ~/.claude/docs/variants/_archive/ or delete; canonical files are aleph.md, blue.md, jiminy.md.

8. `.claude/docs/variants/clarvis.md` — slash command leans on demoted authority

File: /Users/wesleyhines/.claude/docs/variants/clarvis.md Line: 46

Quoted: /tasks — read ~/clarvispedia/AGENT-STATE.md and return the current active_task line + any flagged items

Why it’s stale: Wes explicitly demoted AGENT-STATE.md to “lead, not authority” per fleet-source-order.md L49-51 and master-index.md L102. fleet-topic-router.md L21 says “Treat AGENT-STATE.md as historical unless it is fresh and agrees with handoffs/live probes.” m1-cluster-clarvis.md (fleet-finish-2026-05-06) notes last_heartbeat=2026-04-18 (18d stale) for Clarvis’s AGENT-STATE.

This is the Clarvis variant’s documented Telegram command still pointing at the demoted file. A restart will re-establish that command as canon.

Severity: MED — would return stale 18-day-old task lines to Wes on /tasks Telegram queries. Not data-loss, but actively misleads Wes about current state in the channel Wes uses to check current state.

9. `variant-mapping.md` — embeds artifact “tony” in active variant cells

File: /Users/wesleyhines/jarvis/hinesipedia/Fleet/variant-mapping.md

Lines:

L98: | clarvis-tony | Clars | [unknown] | ...
L117: comment about MCPs: claude-peers (codex-server.ts), telegram-codex, tooling

The L98 runtime-id is intentionally frozen per the canon at L23-32 (rename breaks running processes). Frontmatter at L1-5 already calls out “Working-canon note (2026-05-04): This roster is operationally live and binding for runtime identity, but it is not fully cleaned.” This is acceptable per the canon’s own rule. No action required. Listed here only so future audits don’t re-flag it.

Severity: LOW — informational; rule already explains why.

But: L141 says “Resolved 2026-05-01: Clars=TonyClarvisBot, Clarvis=ClarvisFleetBot.” That sentence still couples Clars’s bot to the dead-name shape (TonyClarvisBot). telegram-archive-access.md L29 lists TonyClarvisBot in example bot_username list — same issue, but as an example value, not as the canonical bot’s name.

Severity: LOW — bot handle is a stable Telegram identifier; rename would break Telegram routing. Document the rationale at L141 inline so future audits don’t re-flag.

10. `Fleet/index.md` and `protocols/index.md` disagree on fast-gate-validation listing

Files:

/Users/wesleyhines/jarvis/hinesipedia/Fleet/index.md L56: - [[Fleet/protocols/fast-gate-validation-protocol|Fast gate validation protocol]]
/Users/wesleyhines/jarvis/hinesipedia/Fleet/protocols/index.md (full list, L16-24): does NOT include fast-gate-validation-protocol

The file exists on disk (protocols/fast-gate-validation-protocol.md) and is referenced by fleet-topic-router.md L32 and session-protocol.md L93. But the protocols index that other docs link to as the canonical map omits it.

Severity: LOW — discoverability bug, not behavioral risk.

11. `state/read-model/enabled-agents.json` — 29 enabled rows, 15 first-class, vs Active 18

File: /Users/wesleyhines/jarvis/hinesipedia/Fleet/state/read-model/enabled-agents.json

29 "enabled": true rows. 15 "tier": "first-class" rows. The Active 18 per fleet-source-order.md L42-43, index.md L34-35, master-index.md L60-61, machines.md L40-46, and fleet-operating-protocol.md L50-53: Pepper, Nagatha, Bilby, Clippy-Main, Stark, Lens, Quill, Clarvis, Clars, Cultron, Clase, iMessage, Flint, Gravel, Prospecting, Aleph, Blue, Jiminy.

enabled-agents.json “first-class” tier currently: Aleph, Bilby, Blue, Clars, Clarvis, Clase, Codex, Cultron, Flint, Gravel, Lens, Nagatha, Pepper, Quill, Stark.

Delta:

IN first-class, NOT in Active 18: Codex (Mac, added 2026-05-02).
IN Active 18, NOT in first-class: Clippy-Main, iMessage, Prospecting, Jiminy (these are “known” or “first-class”-adjacent tiers in the JSON).

Plus 14 more enabled rows: c2d2, Christian-Web-Builder, Clarvis-Jr, dial-prep-1, dial-prep-2, Frank, Prospecting-Christian, Sonnet-1/2/3, etc. — all flagged “known” or similar, not Active 18.

Why it’s not strictly stale: fleet-source-order.md L41-45 explicitly states “Read-model fixtures can contain known, archived, virtual, ad-hoc, or stale rows. Do not count an enabled row as live without broker, D1/readback, supervisor, or Fleet Monitor evidence.” So the file is intentionally a superset.

But: "enabled": true is a misleading field name. An agent that loads this file and trusts the field name will count 29 enabled variants. The disambiguation lives in a separate doc that the loading agent may or may not read.

Severity: MED — would inflate Wes’s roster mental model if a peer loads this and reports back “29 enabled agents on the mesh.” Already cited as a known drift trap (Fleet/working/fleet-architectural-audit-nagatha-2026-05-07.md calls out identity-roster duplicated across 5+ surfaces).

Recommended: rename enabled → present-in-registry or add a top-level active_18 array to the fixture so the gap is structural, not interpretive.

12. `.claude/docs/fleet-operating-protocol.md` — shadow doctrine, not imported

File: /Users/wesleyhines/.claude/docs/fleet-operating-protocol.md

This file (193 lines) is a parallel operating doctrine — its own Source Order, Active Roster rule, Identity Contract, Reset Decision Matrix. It is NOT imported by ~/.claude/CLAUDE.md (which imports soul, user, fleet-ethos, fleet-source-order, fleet-topic-router, fleet-rules, session-protocol, machines — but not this).

Content: largely consistent with current canon. Active 18 list at L50-53 is correct. But it’s a doctrine layer that loads only if an agent goes looking for it.

Severity: LOW-MED — risk is divergence over time. If fleet-ethos.md is edited and fleet-operating-protocol.md is forgotten, the two will silently disagree. Decision needed: promote this into the import set, fold it into fleet-ethos.md / session-protocol.md, or archive.

13. `machines.md` — iMac variant list inconsistent within file

File: /Users/wesleyhines/.claude/docs/machines.md

L12: iMac | ... | QA + research workers (aleph, blue). Sonnet 4.6 not Opus. L45: iMac: Aleph, Blue, Jiminy

Two lines, two iMac rosters: row description (L12) lists aleph+blue; Active 18 listing (L45) adds Jiminy. Per variant-mapping.md L79 and jiminy.md L5 (“Jiminy. Haiku, iMac, jiminy-session”), Jiminy is on iMac.

Severity: LOW — internal inconsistency, but L45 is the authoritative roster; L12 is shorthand. Add Jiminy to L12 description.

Same file L12: “Sonnet 4.6 not Opus” — partial. Jiminy is Haiku per its variant doc. So iMac mixes Sonnet (Aleph, Blue) + Haiku (Jiminy). The “not Opus” framing is fine; the model spec needs to be “Sonnet 4.6 + Haiku for Jiminy” if we’re calling out model per-machine.

14. `Fleet/changelog.md` — correctly marked stale (no action)

File: /Users/wesleyhines/jarvis/hinesipedia/Fleet/changelog.md

L7-9: > [!WARNING] STALE FILE — DO NOT WRITE HERE / This is not the active changelog. The active changelog is at /storage/jarvis/fleetipedia/Fleet/changelog.md.

Severity: N/A — already self-flagged. Listed here so it’s not re-found in the next audit. Note: L21 talks about “Cortextos dashboard now sees the fleet — 21 agents healthy, all bridged” which contradicts current-fleet-definition-2026-05-04.md demotion of cortextOS as “not the operating substrate” — but again, the file is marked stale, so this is acceptable.

15. `clients.md` — Summit framed as “Co-Owned” vs memory’s “partner”

File: /Users/wesleyhines/.claude/docs/clients.md

Conflicts with ~/.claude/projects/-Users-wesleyhines/memory/project_lance_summit_partner.md: “Lance is Wes’s partner at Summit Energy Solutions… Comp is partnership/revenue-share via the SES lead-gen program. Frame Summit work as ‘ours,’ never as a vendor deliverable.”

Both framings agree on the “not a vendor client” core. They disagree on the legal/ownership shape: “co-owner” vs “partner via revenue-share on lead-gen program.” Wes corrected an agent 2026-05-08 specifically about this (project_lance_summit_partner.md L9).

Severity: LOW-MED — won’t break a restart, but a client-facing agent that reads this could over-state ownership in a deck, email, or compliance filing. Reconcile the two framings.

Same file L20: Ignoffo owner is Jimmy Ignoffo (NOT Joe) — defensive, fine.

16. `.sync-manifest.json` references `secrets-pointer.md`

File: /Users/wesleyhines/.claude/docs/.sync-manifest.json Line: 13: "secrets-pointer.md": "b15fa5b41fbb84847d1799c3a4020a2b906059102f22c697f68ee66952c5a4ae",

Why flagged: this is what propagates the broken doc (finding #1) to every fleet machine via claude-config-sync. Until #1 is fixed or removed, the manifest entry is the carrier.

Severity: HIGH (transitive on #1). If #1 is deleted, remove this line too or the sync daemon will re-pull it.

17. `Fleet/bus.md` — appears authoritative but is conversational scratch

File: /Users/wesleyhines/jarvis/hinesipedia/Fleet/bus.md

Frontmatter: none. Filename suggests canon (“bus.md” alongside ethos.md, conventions.md). Content is conversational variant-to-variant chat about bus-protocol design — including extensive Tony/Clars references, BusAdapter discussion, decisions later overridden by current-fleet-definition-2026-05-04.md (“bus.md, BusAdapter, bus.*, and _bus_router are not current architecture”).

L303-339 specifically: extended cortext peer-tier discussion that is proposal-layer per master-index.md L99-100.

Severity: MED — looks like canon, isn’t. An agent that grep’s Fleet/ for bus/peer/tier wording will hit this file and treat it as doctrine. Either move to Fleet/working/ (where audit history lives per master-index.md L25-27) or prepend a > [!WARNING] DRAFT — not canon block.

18. Old Cortext / BusAdapter references in active doctrine docs

Catalog of where the deprecated bus-vocab still shows up at canon level (everything _bus_router, BusAdapter, raw “bus.*” primitives is FUTURE TARGET or PRIOR/STALE per fleet-source-order.md L58-59):

Fleet/ethos.md L48-51: “Cortext fork are not outside projects in this doctrine. They are part of the operating environment being shaped around Wes’s actual fleet.” — fine framing, but pairs with v6’s other lines that treat cortextos as substrate (see Fleet/ethos/v5.md L169 “Variants speak the substrate. Fleet runs on cortextOS primitives” — that line is PROPOSAL/QUARANTINE per clars-ethos-intake-2026-05-06.md).
Fleet/ethos/v4.md L161, v3.md L140, v2.md L103, v1.md L83: all contain the “Variants speak the substrate / cortextOS primitives” line. These are archived ethos versions; should not be confused with v6.md / ethos.md. Per Fleet/ethos/README.md they’re history. Acceptable IF the README clearly marks them as history.

Severity: LOW for the archived v1-v5 files (history). MED for the “substrate” framing carrying forward into v5/v6 if a restart loads Fleet/ethos/v5.md instead of ethos.md.

Recommended: verify Fleet/ethos/README.md says “v6.md is current; v1-v5 are history.” Then no further action needed.

19. `Fleet/anthropic-feedback-deferred-tools-preload.md` — public letter referencing 15 variants

File: /Users/wesleyhines/jarvis/hinesipedia/Fleet/anthropic-feedback-deferred-tools-preload.md Line: 22, 38

Quoted: We run ~15 Claude Code variants across 5 machines.

Why noted: external-facing feedback letter, ~15 variants is close-enough but not exact (Active 18 + Codex + dial-prep + Frank + Sonnet 1/2/3 etc. is ~25-29 depending on how you count).

Severity: LOW — external doc, intentional rounding. No action.

20. Variant docs missing for some Active 18 members

.claude/docs/variants/ contains: aleph, bilby, blue, clars, clarvis-aleph, clarvis-blue, clarvis-jiminy, clarvis, clase, clippy, coordinator, cultron, imessage, jiminy, nagatha, prospecting.

Active 18 missing variant docs: Pepper, Stark, Lens, Quill, Clippy-Main, Flint, Gravel.

Severity: MED — boot-recovery for those variants per variant-mapping.md L141-143 falls back to “title-cased runtime-id with a warning.” Persona drift risk on restart for half the Active 18.

(Not strictly stale content — missing content. Flagging because a restart of e.g. Stark with no ~/.claude/docs/variants/stark.md loads the global identity + fleet-ethos with no persona overlay. Per v6-deltas-PROPOSED.md L114 “Per-variant CLAUDE.md is load-bearing for boot identity. A variant booting from a global or another variant’s identity doc is silently misaligned.”)

Internal contradictions (cross-doc)

C1. Fleet machine count

user.md L5: “4-machine fleet”
machines.md L3: “Five-machine fleet”
MEMORY.md (auto-memory): “5-Machine Fleet Status”
Fleet/anthropic-feedback-deferred-tools-preload.md L22: “5 machines”

C2. Variant count on iMac (within `machines.md`)

L12: “QA + research workers (aleph, blue)”
L45: “iMac: Aleph, Blue, Jiminy”

C3. Mac variant list

machines.md L13: “Mac … Also hosts Clars worker agents”
variant-mapping.md L93-107: Clars is on Clarvis (M1), not Mac
.claude/CLAUDE.md: Mac “Hosts COdex and ad-hoc human-driven sessions” (no mention of Clars workers)

C4. Tiebreaker order in claim-before-act

conventions.md L18: Cheesegrater > Clars > Clippy > iMac > Mac > PC
machines.md L73: Cheesegrater > Clars > Clippy > iMac > Mac
fleet-rules.md L31: cheesegrater > iMac > Mac > PC (no Clars; uses “PC” not “Clippy”)

C5. Active 18 ordering / membership

index.md L34 / master-index.md L60 / fleet-source-order.md L42: “Pepper, Nagatha, Bilby, Clippy-Main, Stark, Lens, Quill, Clarvis, Clars, Cultron, Clase, iMessage, Flint, Gravel, Prospecting, Aleph, Blue, Jiminy.”
fleet-operating-protocol.md L50-53: orders M1 as “Clarvis, Clars, Clase, Cultron, iMessage” (Clase before Cultron) — minor reorder, same membership.
machines.md L42-45: same membership, grouped per machine.
enabled-agents.json “first-class” tier: 15 names, NOT identical (adds Codex, drops Clippy-Main, iMessage, Prospecting, Jiminy from first-class).

C6. AGENT-STATE authority status (resolved doctrine, drift in execution)

fleet-source-order.md L49-51: lead, not authority.
fleet-topic-router.md L21: “Treat as historical unless fresh and agrees with handoffs/live probes.”
master-index.md L102: “lead, not authority.”
variants/clarvis.md L46: actively reads it as the source for /tasks Telegram command.
variant-mapping.md L100: row notes “AGENT-STATE 10d stale” — propagated into state/fleet-registry.json L1081, state/read-model/fleet-read-model.json L1253, state/read-model/heartbeats/clase.json L38 — three durable state files now carry the stale flag forward as if current.

C7. hines-mcp deprecation status

Authoritative deprecation (multiple): fleet-source-order.md L55-57, fleet-topic-router.md L55, machines.md L11/L58, mcp-reference.md L8, master-index.md L101, index.md L73.
One contradiction: architecture/peer-bridge-runbook.md L128 lists hines-mcp as a peer fleet-service (#2 above).

C8. CortextOS / BusAdapter as substrate

fleet-source-order.md L58-59, master-index.md L99-100, index.md L71-72: future/proposal language unless live evidence.
ethos.md L48-51 / ethos/v6.md L48-50: “ClarvisOS and Wes’s Cortext fork are not outside projects… operating environment being shaped around Wes’s actual fleet.”
ethos/v1-v5.md (multiple): “Variants speak the substrate. Fleet runs on cortextOS primitives” — archived ethos versions.
peer-bridge-runbook.md L12 (status:live runbook): “cortextos dashboard reads those heartbeats to render the agents list” — treats it as live substrate.

C9. Sync manifest authority for stale docs

.sync-manifest.json L13 references secrets-pointer.md (HIGH-risk doc per #1) → propagates to all fleet machines.
No corresponding “deprecated” or “do-not-sync” flag in the manifest.

Grouped findings

HIGH severity — MUST fix before restart

.claude/docs/secrets-pointer.md (entire file) — actively teaches the 2026-05-07 leak pattern. Either delete and remove from sync manifest, or rewrite to the keyed-path GET pattern.
Fleet/architecture/peer-bridge-runbook.md L128 — drop the hines-mcp reference from the fleet-services list. Optional: add a footer noting .cortextos/state is partial/proposal not fleet-wide canon.
.claude/docs/.sync-manifest.json L13 — remove the secrets-pointer.md entry if the file is deleted (transitive on #1).

MEDIUM severity — fix during cleanup pass

.claude/docs/user.md L5 — “4-machine fleet” → “5-machine fleet.”
.claude/docs/fleet-rules.md L21-31 — add Clarvis to vault-paths list (Clarvis: ~/jarvis/hinesipedia/) and update tiebreaker to match conventions.md and machines.md (include Clars).
.claude/CLAUDE.md (Mac doc) — already says Mac hosts COdex, which is correct; remove implicit conflict with machines.md L13 “Mac … Also hosts Clars worker agents” by either deleting that line in machines.md or making explicit it’s worker-spawn-target only (not Clars-the-persona).
.claude/docs/variants/clarvis-jiminy.md L21 — change “Tony” to “Clars” OR (better) delete this file as a duplicate of jiminy.md.
.claude/docs/variants/clarvis-aleph.md / clarvis-blue.md / clarvis-jiminy.md — archive all three; keep aleph.md / blue.md / jiminy.md as canonical.
.claude/docs/variants/clarvis.md L46 — /tasks command should read live state (peer broker list_peers, D1 heartbeats, or a fresh handoff) rather than AGENT-STATE.md. At minimum, add “if AGENT-STATE.md is >24h stale, return ‘state stale, run /fleet for live’.”
Fleet/bus.md — move to Fleet/working/ or prepend a “DRAFT — not canon” header. Currently sits as if doctrine alongside ethos/conventions.
Fleet/state/read-model/enabled-agents.json — rename enabled field to present-in-registry OR add a top-level active_18: [...] array so the disambiguation is structural, not interpretive.
.claude/docs/machines.md L12 — Add Jiminy to iMac row description; clarify model mix (Sonnet for Aleph/Blue, Haiku for Jiminy).
Fleet/ethos/README.md — verify it marks v1-v5 as history (so v5.md “variants speak the substrate” line can’t be loaded as current doctrine).
.claude/docs/variants/ — create missing variant docs for Pepper, Stark, Lens, Quill, Clippy-Main, Flint, Gravel. At minimum a 5-line file that imports @~/.claude/docs/fleet-ethos.md so boot-recovery doesn’t fall back to global-only identity.

LOW severity — can wait

Fleet/protocols/index.md — add fast-gate-validation-protocol to the protocols list (it exists on disk and is referenced from index.md and the topic router).
Fleet/variant-mapping.md L141 — leave the TonyClarvisBot line; it documents the frozen Telegram bot identifier. Add an inline “(rename breaks Telegram routing; frozen on purpose)” so it’s not re-flagged.
Fleet/protocols/telegram-archive-access.md L29 — same as above; the TonyClarvisBot example value is a real bot handle, not a name drift.
.claude/docs/clients.md L12/L17 — reconcile “Co-Owned” with project_lance_summit_partner.md’s “partner via revenue-share on lead-gen.” Both are non-vendor framings; pick one and use it.
Fleet/changelog.md — already marked stale; no action.
.claude/docs/fleet-operating-protocol.md — decide: promote into CLAUDE.md import set, fold into fleet-ethos.md / session-protocol.md, or archive. Currently floats as parallel doctrine.

Before-restart checklist (one page)

Each line is a single concrete fix. Cross off as you go. The four HIGH lines are the ones that would actually cause damage if a restarted variant follows them.

HIGH (do before any restart)

DELETE or REWRITE ~/.claude/docs/secrets-pointer.md — the ?namespace=secrets pattern leaks the whole namespace into transcript. Replace with keyed-path GET (/store/memory/<KEY>?namespace=secrets) per feedback_fleet_node_keyed_path.md.
REMOVE the secrets-pointer.md line from ~/.claude/docs/.sync-manifest.json so the bad doc doesn’t re-replicate to other machines on next sync.
EDIT ~/jarvis/hinesipedia/Fleet/architecture/peer-bridge-runbook.md L128: drop hines-mcp from the fleet-services list (or strike with a ~~hines-mcp~~ (deprecated 2026-04-22) annotation).

MEDIUM (do during the same cleanup pass — none of these are blockers but

all of them silently misalign a restart)

LOW (queue, no urgency)

Reconcile Summit “Co-Owned” vs “partner via revenue-share” framing between clients.md and project_lance_summit_partner.md.
Add fast-gate-validation-protocol to Fleet/protocols/index.md listing.
Annotate variant-mapping.md L141 and telegram-archive-access.md L29 with “TonyClarvisBot is a frozen bot handle; rename breaks Telegram routing.”
Decide fate of ~/.claude/docs/fleet-operating-protocol.md: promote, fold, or archive.
Fleet/changelog.md — keep self-flagged stale notice; no action.

Process notes for the cleanup pass

Do HIGH items in one sitting; they’re the only ones that could re-cause an incident on restart.
The MEDIUM items mostly converge on three structural issues that, if fixed, knock out half the list:
- Pick canonical machine doc (likely machines.md) and make every other doc point at it for fleet topology rather than restating.
- Pick canonical variant identity doc (already is variant-mapping.md) and delete the duplicate clarvis-* variant files.
- Decide what enabled-agents.json means structurally vs Active 18 and fix the field name.
After fixes, run a re-grep for hines-mcp, Tony, BusAdapter, AGENT-STATE, 4-machine, port 3847, and _bus_router and confirm only doctrine-flagged usage remains.
Then restart variants.

Broken canon inventory

Broken Canon — Stale / Contradictory References

1. secrets-pointer.md — actively dangerous secrets-retrieval pattern

2. architecture/peer-bridge-runbook.md — names hines-mcp as a live fleet-service

3. .claude/docs/user.md — fleet count contradicts machines.md

4. .claude/docs/fleet-rules.md — Clarvis missing from coordination protocol + vault paths

5. .claude/CLAUDE.md (Mac machine doc) — Codex framing as “hosts COdex”

6. .claude/docs/variants/clarvis-jiminy.md — uses dead-name “Tony”

7. Duplicate / legacy variant docs in .claude/docs/variants/

8. .claude/docs/variants/clarvis.md — slash command leans on demoted authority

9. variant-mapping.md — embeds artifact “tony” in active variant cells

10. Fleet/index.md and protocols/index.md disagree on fast-gate-validation listing

11. state/read-model/enabled-agents.json — 29 enabled rows, 15 first-class, vs Active 18

12. .claude/docs/fleet-operating-protocol.md — shadow doctrine, not imported

13. machines.md — iMac variant list inconsistent within file

14. Fleet/changelog.md — correctly marked stale (no action)

15. clients.md — Summit framed as “Co-Owned” vs memory’s “partner”

16. .sync-manifest.json references secrets-pointer.md

17. Fleet/bus.md — appears authoritative but is conversational scratch