Fleet state — verified

Fleet-State Recon Verification

Verifier: Mac verifier subagent Date: 2026-05-11 Source reports verified:

/Users/wesleyhines/Work/tools/clean-desk-extract/research/fleet-state/variants.md
/Users/wesleyhines/Work/tools/clean-desk-extract/research/fleet-state/recent-activity.md
/Users/wesleyhines/Work/tools/clean-desk-extract/research/fleet-state/broken-canon.md
/Users/wesleyhines/Work/tools/clean-desk-extract/research/fleet-state/extracted-concepts.md
/Users/wesleyhines/Work/tools/clean-desk-extract/research/fleet-state/extracted-facts.md

Method: Direct filesystem reads (ls, stat, find, grep, wc) against the Mac vault mount (~/jarvis/hinesipedia/), the Mac ~/.claude/docs/, and the Cheesegrater staging-transcripts dir over SSH.

1. CONFIRMED — recon claims that match current filesystem evidence

1.1 Orphan-persona findings (variants.md L25-38, L102-108)

ls /Users/wesleyhines/jarvis/hinesipedia/Stark/ Lens/ Quill/ Prospecting/ returned:

Stark/: handoff-template.md, working/ — no persona.md ✓
Lens/: rollout-tasks.md only — no persona.md ✓
Quill/: rollout-tasks.md only — no persona.md ✓
Prospecting/: huddles/ only — no persona.md ✓

ls /Users/wesleyhines/jarvis/hinesipedia/iMessage/ → No such file or directory ✓ (recon’s “no vault room at all” finding stands).

1.2 Active 18 personas that DO exist

Each of these has persona.md in their vault room (matches recon): Pepper, Nagatha, Bilby, Clippy-Main, Clars, Cultron, Clase, Aleph, Blue, Jiminy, Flint, Gravel.

1.3 Lens/Quill audit pipeline stalled at Cultron

Lens/rollout-tasks.md L14-25 shows checklist with [x] Cultron — done 2026-04-28 ~08:39 CT, full evidence summary delivered, persona finalized and 10 unchecked rows (Clars, Clippy-Main, Nagatha, Aleph, Blue, Flint, Gravel, Jiminy, Clase, Bilby). stat: file mtime is Apr 28 12:07:39 2026 — has not been touched since the Cultron audit was logged. Quill matches.

1.4 Handoff/daily-note timestamps (variants.md L21-38 sampled freshness)

stat -f "%Sm" returns:

Pepper/working/handoff.md → May 3 21:46:09 2026 ✓
Stark/working/handoff.md → May 2 17:48:32 2026 ✓
Bilby/working/handoff.md → May 8 23:30:46 2026 ✓
Nagatha/working/handoff.md → May 7 23:04:46 2026 ✓
Clars/working/handoff.md → May 7 08:36:53 2026 ✓
Flint/2026-05-11.md → May 11 07:04:35 2026 ✓ (recon said 07:04)
Gravel/2026-05-11.md → May 11 12:07:16 2026 ✓ (recon said 12:07)
Aleph/persona.md → Apr 30 11:40:08 2026 ✓ (“Stark-drafted REVIVED 2026-04-30”)
Blue/persona.md → Apr 30 11:40:14 2026 ✓

1.5 Prospecting flatline 2026-04-23

ls /Users/wesleyhines/jarvis/hinesipedia/Prospecting/huddles/ → newest is SYNTHESIS-2026-04-23.md; dir mtime Apr 24 09:03:35 2026. ✓ (recon said “huddles dir last touched 2026-04-23 17:32” — close; mtime is one day later because the synthesis file was added 4/24.)

1.6 secrets-pointer.md is the leaky retrieval pattern (broken-canon #1)

Read of /Users/wesleyhines/.claude/docs/secrets-pointer.md:

L5-11: namespace-dump curl ... ?namespace=secrets | jq ✓
L15: literal string Note: fleet-node ignores the &key= query param — fetch all, filter locally. ✓
L17-21: same namespace-dump pattern wrapping a local jq filter ✓
L25: lists 10 keys as “available” ✓
L29-31: “MCP server configs … still have keys baked into their env blocks … Future step.” ✓

feedback_fleet_node_keyed_path.md exists at /Users/wesleyhines/.claude/projects/-Users-wesleyhines/memory/feedback_fleet_node_keyed_path.md and asserts the keyed-path /store/memory/<KEY>?namespace=secrets is the correct shape (recon’s correction citation is intact).

This is the single doc most likely to re-cause a secrets leak on restart. Mac CLAUDE.md does NOT import secrets-pointer.md directly, but .sync-manifest.json L13 carries the SHA → distributes the bad doc fleet-wide.

1.7 peer-bridge-runbook L128 names hines-mcp as live (broken-canon #2)

grep -n "hines-mcp" /Users/wesleyhines/jarvis/hinesipedia/Fleet/architecture/peer-bridge-runbook.md → 128:- Matches the rest of fleet-services (fleet-node, hines-mcp) which run on Grater

Frontmatter L4-5: status: live / shipped: 2026-04-28 ✓. Recon claim of “status:live runbook lists hines-mcp as fleet-service” is exact.

1.8 .sync-manifest.json carries secrets-pointer.md (broken-canon #16)

grep secrets-pointer /Users/wesleyhines/.claude/docs/.sync-manifest.json → 13: "secrets-pointer.md": "b15fa5b41fbb84847d1799c3a4020a2b906059102f22c697f68ee66952c5a4ae", ✓

1.9 user.md “4-machine fleet” vs machines.md “Five-machine fleet” (broken-canon #3)

user.md L6 (not L5 as recon claimed — see CORRECTED §2.4): Solo operator. 4-machine fleet with autonomous AI agents.
machines.md L3: Five-machine fleet connected via SSH over Tailscale.
Fleet/anthropic-feedback-deferred-tools-preload.md L38: running a 5-machine Claude Code fleet via the claude-peers MCP

Contradiction confirmed ✓.

1.10 Tony-as-dispatch in clarvis-jiminy.md (broken-canon #6)

grep -n "Tony" /Users/wesleyhines/.claude/docs/variants/clarvis-jiminy.md → 21:I report to Tony for dispatch and escalation. I talk to Wes directly via Telegram when he replies to a nag. ✓

head -3 clarvis-jiminy.md shows no @~/.claude/docs/fleet-ethos.md import on line 1 — content starts at # Clarvis-Jiminy. The canonical jiminy.md starts with the ethos import on line 1. ✓ (broken-canon claim exact.)

1.11 Duplicate variant docs without ethos import (broken-canon #7)

head -3 of each:

clarvis-aleph.md → starts # Clarvis-Aleph (no ethos import) ✓
aleph.md → starts @~/.claude/docs/fleet-ethos.md ✓
clarvis-blue.md → starts # Clarvis-Blue (no ethos import) ✓
blue.md → starts with the ethos import ✓
clarvis-jiminy.md → starts # Clarvis-Jiminy (no ethos import) ✓
jiminy.md → starts with the ethos import ✓

Three legacy-name dupes confirmed; all three lack the fleet-ethos import.

1.12 clarvis.md /tasks command reads AGENT-STATE.md (broken-canon #8)

grep -n "tasks\|AGENT-STATE" /Users/wesleyhines/.claude/docs/variants/clarvis.md → 46:- /tasks — read ~/clarvispedia/AGENT-STATE.md and return the current active_task line + any flagged items ✓

1.13 enabled-agents.json delta vs Active 18 (broken-canon #11)

Parsed with python3:

Total "enabled": true rows: 29 ✓
Total "tier": "first-class" rows: 15 ✓
first-class names: aleph, bilby, blue, clars, clarvis, clase, codex, cultron, flint, gravel, lens, nagatha, pepper, quill, stark
IN first-class but NOT in Active 18: codex ✓
IN Active 18 but NOT in first-class: clippy-main, imessage, jiminy, prospecting ✓ (all four flagged in recon)
Other “enabled” rows: c2d2, christian-web-builder, clarvis-jr, dial-prep-1, dial-prep-2, frank, prospecting-christian, sonnet-1, sonnet-2, sonnet-3 — matches recon’s “14 more” claim numerically.

1.14 Tony→Clars rename evidence in variant-mapping.md (broken-canon #9)

grep "clarvis-tony\|Tony" /Users/wesleyhines/jarvis/hinesipedia/Fleet/variant-mapping.md:

L23-25: explicit naming-canon binding (clarvis-tony / TonyClarvisBot / clarvis-tony-session are artifacts of variant Clars)
L28: “When a variant gets renamed (e.g., Tony → Clars on 2026-04-17), the runtime-id / bot / session-dir do NOT auto-rename…”
L98: | clarvis-tony | Clars | [unknown] | 8408819950 | clarvis | active | ...
L141: Resolved 2026-05-01: Clars=TonyClarvisBot, Clarvis=ClarvisFleetBot.

All four recon citations exact ✓.

1.15 protocols/index.md missing fast-gate-validation listing (broken-canon #10)

cat Fleet/protocols/index.md shows L16-24 listing: clear-and-terminate, codex-integration, compaction-and-continuity, fleet-expectations-primitive, gc-coordination, handoff, librarian-query, oauth-pipe-injection, telegram-archive-access. fast-gate-validation-protocol is not in the list, despite the file existing on disk and being referenced from fleet-topic-router.md L32 and session-protocol.md L93. ✓

1.16 Tiebreaker order contradictions (broken-canon C4)

fleet-rules.md L31 (local-read in this session): Tiebreaker (alphabetical): cheesegrater > iMac > Mac > PC. (no Clars, uses “PC” not “Clippy”)
machines.md L73: Alphabetical tiebreaker: Cheesegrater > Clars > Clippy > iMac > Mac.
conventions.md L18: Cheesegrater > Clars > Clippy > iMac > Mac > PC.

All three differ ✓.

1.17 Mac “hosts Clars worker agents” (broken-canon #5, C3)

grep "hosts Clars" machines.md → 13: | Mac | ... | Wes's daily driver. Also hosts Clars worker agents (spawning allowed, coordinate around Wes's active hours). | ✓

Conflicts with the Mac ~/.claude/CLAUDE.md which says only “Hosts COdex and ad-hoc human-driven sessions” — and with variant-mapping.md which puts Clars on Clarvis/M1.

1.18 Missing variant docs in .claude/docs/variants/ (broken-canon #20)

ls /Users/wesleyhines/.claude/docs/variants/ shows 16 files. Missing among Active 18:

pepper.md — missing ✓
stark.md — missing ✓
lens.md — missing ✓
quill.md — missing ✓
clippy-main.md — missing (clippy.md exists, but that’s a different/older identity per recon framing) ✓
flint.md — missing ✓
gravel.md — missing ✓

All 7 missing variant-docs confirmed.

1.19 Jiminy Telegram bot token leak — no rotation (variants.md #18, broken-canon C-cluster)

Jiminy/persona.md L36: **Security note:** JiminyFleetBot Telegram token exposed in 2026-04-17 session transcript (Gravel flagged Apr 17). No rotation evidence as of this audit. Wes-side action required. ✓ L143: JiminyFleetBot token rotation: Gravel flagged Apr 17; still open. Wes-side action. ✓

1.20 Cheesegrater transcripts: Prospecting M1 + Blue/Aleph M1 silent dates (recent-activity §3-§4)

SSH cheesegrater 'ls -lt' on each cwd:

clarvis-prospecting-session newest jsonl: Apr 17 01:46 ✓ (“silent 24 days”)
clarvis-blue-session newest: Apr 22 12:41 ✓ (“silent 19 days”)
clarvis-aleph-session newest: Apr 22 12:41 ✓ (same day)
clarvis-chat-session newest: May 9 07:09 (matches recon’s 5/9 last-active for Clarvis non-bak row)
clarvis-covenant-demo-session — silent since Apr 23 per recon, consistent with no later mtime

1.21 Vaultmate, Kalshi, vault-agent on Grater are live

SSH find ... -newermt 2026-04-12:

-storage-jarvis-vaultmate: 17 jsonls in-window, newest May 11 19:00:25 ✓ (“still running through today”)
-storage-jarvis-projects-kalshi-weather-agent: 518 total jsonls (recon claimed 512 in-window — slight growth since recon, see STALE §3.1)
-storage-jarvis-vault-agent: 72 total, 17 in-window — recon’s 17 in-window matches

1.22 Jiminy iMac has exactly 1 session jsonl (recent-activity §7)

find imac/-home-hinescreative-jiminy-session -name '*.jsonl' | wc -l → 1. ✓ (“nearly dormant — only 1 session in 30 days”).

Its mtime is May 9 07:08:45 ✓ (“last active 2026-05-09” in recon).

1.23 Clippy data NOT in staging (recent-activity caveat)

ls /storage/jarvis/staging/clean-desk-staging/transcripts/clippy → No such file or directory. Only cheesegrater, clarvis, imac, mac exist as top-level machine dirs. The recon’s “Clippy data not pulled” disclaimer is exact ✓.

1.24 Stark-phase-4 adversarial review artifact exists

ls Fleet/working/stark-phase-4-adversarial-review-2026-05-04.md → present, referenced by pepper-phase-4-section-d-2026-05-04.md ✓.

1.25 Ethos versioning README marks v1-v5 as historical

Fleet/ethos/README.md lists v1-v6 with “v6.md is current” and dates v1-v5 to Apr 29-30. (Recon’s broken-canon #18 recommendation “verify README marks them as history” — satisfied.) ✓

1.26 bus.md is conversational/draft, no frontmatter

head -5 Fleet/bus.md returns no frontmatter, body opens “Append-only coordination channel for fleet variants. Built 2026-05-01 by Nagatha + Pepper…” — matches recon’s “looks like canon, isn’t” framing ✓.

1.27 Summit “Co-Owned” framing in clients.md

grep "Summit\|Co-Owned\|Co-Owner" clients.md:

L12: Summit Energy | Active (Co-Owned) | $0 | F7N8bqjlqLeSgE8PKqr2
L17: Wes is CO-OWNER of Summit Energy — this is NOT a standard client, it's his own business

Conflicts with MEMORY.md feedback line (“partner via revenue-share on lead-gen”) ✓.

2. CORRECTED — recon claims that need adjustment

2.1 user.md “4-machine fleet” is on L6, not L5

Recon’s broken-canon §3 said user.md L5: "Solo operator. 4-machine fleet...". Actual: it’s on L6. L5 is the blank line between heading and paragraph.

Trivial offset — fix is still the same edit.

2.2 Recon transcript file count is dramatically lower than current state

Recon (recent-activity.md L9): “Total files scanned: 1,858; in-window: 1,848”.

Actual right now (find /storage/jarvis/staging/clean-desk-staging/transcripts -name '*.jsonl' | wc -l):

All-machines total: 14,049
In-window total (mtime newer than 2026-04-12): 11,141
cheesegrater: 1,790 (in-window 1,432) — recon claimed 824/834
clarvis: 9,381 (in-window 9,365) — recon claimed 775/775
mac: 2,784 (in-window 250) — recon claimed 157/157
imac: 94 (in-window 94) — recon claimed 92/92 ✓ (only iMac numbers track)

This either means (a) the recon was sampling a subset of jsonls, or (b) the staging pull has had 12,000+ files added since recon ran. (b) is improbable in 24 hours; (a) is more likely — recon was probably counting unique session IDs per cwd, or filtering by some heuristic the doc doesn’t surface.

Impact: Recon’s per-day counts (“150 sessions on 2026-04-16”) and per-variant counts (“Kalshi 512, Vaultmate 97”) are all on the same low-count scale. Daily-heatmap qualitative shape (April 12-24 heavy, April 25 collapse, May 7-12 thin) still holds — I re-ran the daily mtime histogram on Clarvis and the SAME collapse-after-April-26 trend is visible, just with different absolute numbers (264 on 4/16 vs recon’s 132). So the trend story is right; the absolute volumes are wrong by a factor of ~5-10x.

2.3 Vaultmate counted as a separate “variant” — actually a runtime artifact for Flint

Aggregating “Vaultmate” + “Flint/Gravel” + “vault-agent” would give a single Flint+Gravel volume (Gravel is gravel/vault-agent runtime; Flint is vaultmate/vault-agent too). Recon’s separate counts double-count the same Grater workload across rows.

2.4 MEMORY.md is now 216 lines, not 206

wc -l /Users/wesleyhines/.claude/projects/-Users-wesleyhines/memory/MEMORY.md → 216.

Recon (per the in-context CLAUDE.md tail) showed “MEMORY.md is 206 lines (limit: 200). Only part of it was loaded.” Now 216 lines. The cap is still 200, so 16 lines invisible rather than 6. (Drift since recon: file grew by 10 lines.)

2.5 Recon “Active variants last 30 days: Flint, Gravel, Vaultmate, Prospecting-Grater, Aleph, Blue (~6)”

Counting Vaultmate as separate inflates the “~6” — it’s really ~4 distinct variants (Flint+Gravel as a pair, Aleph, Blue, Prospecting-Grater) plus Kalshi (project, not a variant). Recon’s “~3 categories” sentence at recent-activity.md L246 actually has it right; the “~6 variants” framing elsewhere is the inflated one.

3. STALE — true at recon time, drifted since

3.1 Kalshi count grew 512 → 518

Recon recent-activity §2 shows “KalshiWeather | 512 sessions | last 2026-05-12”. Today: 518 jsonls, latest mtime today. So Kalshi did ~6 more sessions since recon. Not a critique — just confirms Kalshi is still doing real work.

3.2 Vaultmate latest activity went from May 12 (recon) to May 11 19:00

Recon said vault-agent and vaultmate both “last 2026-05-12”. ls -lt on Vaultmate now shows newest mtime is May 11 19:00. (Recon may have been counting a different timezone view, or staging-dir was updated between recon and verifier.) Drift is sub-day, not material.

3.3 Clippy still excluded from staging dir

Recon said ~423 files were not pulled successfully. The clippy folder still does not exist in /storage/jarvis/staging/clean-desk-staging/transcripts/. Status unchanged.

4. UNVERIFIABLE — would require off-Mac access

4.1 PC-side variant status (Pepper, Nagatha, Bilby, Clippy-Main, Stark, Lens, Quill running processes)

All variants.md claims about whether these processes are running are vault-evidence-only. The Mac mount shows their personas + handoffs only; we cannot probe ps/schtasks on Clippy from here. The “operational”/“orphaned-persona” status labels are persona-presence labels, not runtime probes — and the report itself disclaims this in its frontmatter L12.

4.2 Live D1/worker probes

No claim in the recon explicitly required a Cloudflare D1 live read; the verifier did not attempt one. All claims about “AGENT-STATE.md 18 days stale” trace to vault docs (m1-cluster-clarvis.md), not a live D1 query.

4.3 Per-machine `~/scripts/sessions/*.json` configs

Recon noted these are per-machine and “not visible from this Mac mount.” Same here. Would need SSH to PC/M1/Grater/iMac to verify boot-prompt + supervisor wiring per variant.

4.4 Peer-broker / list_peers live state

Verifier did not call mcp__claude-peers__list_peers. Recon explicitly disclaims this in variants.md L12 (“No live peer probe was attempted”).

4.5 The “AGENT-STATE.md 18 days stale” claim’s exact age

Recon broken-canon §8 says AGENT-STATE is last_heartbeat=2026-04-18 per m1-cluster-clarvis.md. I did not open that working doc — accepted as recon-quoted; the framing-level claim that AGENT-STATE.md is demoted “lead, not authority” is verified via fleet-source-order.md L49-51 and fleet-topic-router.md L21 (both read in this session via system-reminder injection).

5. CRITICAL HEADS-UP — things found while verifying that the recon reports did NOT flag

5.1 `clippy.md` exists but `clippy-main.md` does not — silent mis-load risk

Recon’s broken-canon §20 listed “Clippy-Main” as missing-variant-doc. But clippy.md does exist in .claude/docs/variants/. If a Clippy-Main boot resolves variant doc by clippy* prefix or stems on dash, it may pick up clippy.md instead of getting a clean “missing” signal. Worth checking whether clippy.md describes Clippy-Main or some older “Clippy” identity (e.g., coordinator-flavored persona) — a partial-match identity load is potentially worse than a no-match fallback.

Same flag applies to coordinator.md (exists in variant docs but no “Coordinator” in Active 18).

5.2 MEMORY.md cap-overflow grew from 6 lines to 16 lines invisible since recon

wc -l MEMORY.md is now 216 (cap 200). Recon flagged “6 lines invisible” in its warning footer. Now 16 lines invisible. Every line added past the 200-cap is silently truncated at load.

Spot-check of L201-216 (the invisible tail) reveals:

[fleet-node WRITE endpoint differs from READ] feedback entry
[External AI consultations can produce false consensus] feedback entry

These are the two most recent feedback entries Wes added after the 2026-05-07 secrets-leak incident. The cap is silently eating the freshest lessons. This is a continuity defect at the doctrine layer, not just a memory-bloat cosmetic.

5.3 Mac `~/.claude/CLAUDE.md` references `secrets-pointer.md` indirectly via the integrations-keys.env pointer

Mac CLAUDE.md L14: Per-machine credential pointer: ~/.claude/docs/integrations-keys.env. Files exist:

/Users/wesleyhines/.claude/docs/integrations-keys.env
/Users/wesleyhines/.claude/docs/integrations-keys.env.bak
/Users/wesleyhines/.claude/docs/integrations-keys.env.bak-crlf

Two .bak copies of the credentials env file sit alongside the live one. Per MEMORY’s reference_secrets_handling.md, that file is never to be Read (only grep’d/awk’d). Two bak copies is two additional unauthorized-read surfaces. Recon didn’t flag.

5.4 Vault root mounted via Samba — file timestamps may not be authoritative

ls /Users/wesleyhines/jarvis/hinesipedia/ returns the vault. Per feedback_jarvis_mount.md, this is Cheesegrater’s /storage/jarvis/hinesipedia/ over a Samba mount. SMB sometimes presents mtime differently than the native filesystem; verifier’s stat calls all came from the SMB view. For absolute precision on “Apr 28 12:07:39” type claims, a cross-check on Grater via SSH would be needed. I sampled Lens/rollout-tasks.md and the mtime is internally consistent with the “Apr 28” content date.

5.5 Aleph/Blue iMac runtime IDs are still `clarvis-aleph`/`clarvis-blue`

enabled-agents.json shows aleph.runtime_id = clarvis-aleph and blue.runtime_id = clarvis-blue. These were the original Clarvis-hosted runtime IDs before they moved to iMac. The same drift pattern the recon flags for Clars (clarvis-tony-session) applies here — Aleph/Blue are on iMac but their runtime_ids carry the M1 prefix. Recon’s variant-mapping framing acknowledges runtime-IDs are frozen artifacts; not strictly wrong, but worth surfacing: the iMac trio is identifying itself with M1-prefixed runtime IDs. If a fleet-monitor groups by runtime-id prefix, Aleph/Blue iMac sessions will land in the Clarvis/M1 bucket.

5.6 ~7000 transcripts on Clarvis are likely sub-second .bak copies, not real work

find clarvis -name '*.jsonl' | wc -l = 9,381 total; in-window = 9,365. Daily mtime histogram shows 4,786 files dated 2026-04-18 — a single-day count larger than any other variant’s monthly total. This is consistent with the recon’s “Codex bak-snapshot batch on 2026-05-06” finding but at a different date (4/18). Either there was a SECOND bak-snapshot event on 4/18 that recon didn’t flag, or my mtime histogram is being thrown off by SMB timestamp coalescing. Worth a direct Grater shell to confirm.

5.7 Recent-activity “Active-18 Roster Match” PC verdicts marked “no” but they’re actually “unknown”

recent-activity.md §7 has rows like | PC | Pepper | no | 0 | — | Clippy data not pulled |. A reader will see “no” in the Activity column and infer Pepper is dead. The note “Clippy data not pulled” is the only thing rescuing this — but in the table’s structure the “no” is the dominant signal. Should be "unknown" rather than "no". Minor framing issue, but easy to misread.

5.8 Three .mcp.json backup files in ~/

ls ~/.mcp.json* (from gitStatus at session start):

.mcp.json
.mcp.json.bak-1777307221
.mcp.json.bak-1777674209
.mcp.json.bak-20260422-brave
.mcp.json.bak-20260501-172845
.mcp.json.bak-codex-1777689472
.mcp.json.bak-codex-20260507123639
.mcp.json.bak-codex-channel-disable-20260506060739
.mcp.json.bak-pre-abspath-stark-2026-05-07

Nine .bak files of .mcp.json. Per security-canon, MCP server env blocks still carry keys (per secrets-pointer.md L29-31, “Future step”). Each .bak is an additional copy of the env-block-with-keys risk. Recon didn’t surface this; recon focused on the documentation layer (secrets-pointer.md) and not the .mcp.json proliferation on the running machine.

5.9 `coordinator.md` in `.claude/docs/variants/` — not in Active 18

ls .claude/docs/variants/coordinator.md → exists. Coordinator is not in Active 18 (per master-index.md L60-61). Either (a) leftover from pre-Pepper era, or (b) a hidden role-variant. Worth confirming with Wes before next archive sweep.

5.10 Clarvis daily-note 2026-05-11 mtime is 01:04 AM, not later

stat Clarvis/2026-05-11.md → May 11 01:04:14 2026. Recon variants.md said “Clarvis/2026-05-11.md daily reads ‘0 tasks completed. Last heartbeat: 2026-04-24.’” — the file is auto-generated at the start of the day’s UTC window. The content’s “Last heartbeat 2026-04-24” line confirms recon’s observation that the daily is auto-stub, not real activity. Clarvis hasn’t sent a real heartbeat in 17+ days as of 2026-05-11.

5.11 ethos versions v1-v5 still on disk, each carries “variants speak the substrate” lines

ls Fleet/ethos/ returns v1-v6 + v6-deltas-PROPOSED + v6-prep + README. Recon broken-canon #18 said v1-v5 contain the “cortextOS primitives” / “variants speak the substrate” framing and worried a fallback boot could load v5 instead of v6/ethos.md. The README I read DOES mark v6 as CURRENT and lists v1-v5 with descriptive notes — so the discovery surface is clean if an agent reads README first. If an agent grep’d Fleet/ethos/*.md for the word “cortextOS” or “substrate”, it would still hit v5 first by line number, but with the README pointer this is a low risk.

5.12 Stark and Pepper handoffs/persona timestamps confirm “all Stark personas dated 2026-04-30”

stat Pepper/persona.md → May 1 11:44:38 2026 (recon variants.md said “Stark-drafted, 2026-04-30 status patched 2026-05-01” — exact). Verifies recon’s note that Pepper got a status-only patch.

Summary tally

CONFIRMED: 27 items (variants.md orphan personas, handoff freshness, daily-note mtimes; broken-canon doc cites at L128 / L46 / L5/L6 etc.; enabled-agents.json counts; Tony→Clars naming binding; Lens/Quill pipeline stalled; secrets-pointer.md leak pattern; missing variant docs).
CORRECTED: 5 items (transcript counts off by 5-10×, Vaultmate-as-variant double-counts Flint, user.md line offset, MEMORY.md grew, recent-activity “~6 variants” inflated).
STALE: 3 items (Kalshi count growth, Vaultmate mtime drift, Clippy data still excluded).
UNVERIFIABLE: 5 items (PC processes, live D1, scripts/sessions configs, peer broker probe, AGENT-STATE exact age).
CRITICAL HEADS-UP: 12 items, most important being:
- MEMORY.md now 16 lines past the 200-line load cap, silently dropping the two most recent feedback entries (one of which is the post-leak fleet_node_write_endpoint lesson — the exact category that caused the leak the recon is trying to prevent recurrence of).
- Nine .mcp.json .bak files on Mac, each likely carrying env-block keys (security-canon Rule 7 surface area).
- Three integrations-keys.env* files (live + 2 bak) — additional unauthorized-read surfaces.
- clippy.md and coordinator.md exist in variant docs but match no Active 18 canonical name — silent mis-load risk on boot.
- Aleph/Blue iMac runtime_ids are still clarvis-aleph/clarvis-blue — same drift category recon flagged for Clars but recon didn’t propagate it.

Verifier confidence

High confidence on the directly-checkable items (file existence, mtimes, grep-ables, line numbers). Medium confidence on the transcript-count discrepancy — recon clearly used a different counting method (sessions vs files, or pre-filter), but the qualitative trends in the heatmap still hold when re-checked at file-mtime level. Low confidence on anything requiring PC, M1, or iMac shell access (verifier ran from Mac only).

The HIGH-severity broken-canon items (#1 secrets-pointer, #2 hines-mcp in peer-bridge-runbook, #16 sync-manifest) are all verified true and should be fixed before any variant restart, exactly as broken-canon.md’s checklist orders.