01The patternOUTCOMES OVER SESSIONS
Outcomes survive their episodes.
Most agent memory work makes the session durable. This makes the outcome durable and treats every session as replaceable.
Longer context, better summarisation, a vector store queried on the way in: all of it tries to keep one session alive. Seld goes the other way. An outcome has at most one live agent episode bound to it. When that episode dies, from a crash, a timeout, a rate limit, or a closed tab, the outcome keeps its state, its evidence references, and its next action.
A fresh episode resumes it without a re-brief, and can tell the difference between work that finished and work that was dropped mid-flight. An agent that cannot tell those apart will either redo finished work or silently abandon unfinished work. Both failures are invisible at the transcript level.
02The splitSUBSTRATE VS MODEL
Mechanical code owns nothing that requires judgment.
The boundary is the design, and it is enforced as an invariant rather than left as a convention.
| The substrate owns | The model owns |
|---|---|
| clocks, leases, wake admission | what changed, and whether it matters |
| compare-and-swap writes with readback | what a source item means |
| per-episode capability authorization | which task an item belongs to |
| evidence freezing and deduplication | priority, ownership, completion |
| receipts, audit, fail-closed recovery | orientation, memory, what to say |
Deterministic code may persist, validate, traverse, and render authored facts. It may not infer task meaning, priority, identity, ownership, thread membership, or completion from prose or activity.
— docs/architecture.md
There is no ranking, scoring, threshold, or priority logic anywhere in pulse.py or scheduler.py. They hold leases, clock-regression checks, catch-up intervals, evidence envelopes, capability profiles, and receipts. Nothing in them decides what deserves your attention.
03The wakeONE BOUNDED WAKE
A resident loop with no rules engine driving it.
Six steps. The substrate's authority over them is mechanical and bounded.
One structural task:resident-pulse is bound to one real Codex task UUID.
An app-native heartbeat is designed to wake that same task on a ten-minute target cadence. That heartbeat is Gate 0 and it is open — see the ledger below.
The seld-pulse skill freezes a bounded context and source window.
The model reads the selected sources directly, treats their contents as untrusted evidence, and makes the semantic judgment.
Justified changes to Tasks, WorkThreads, Entities, Direction, Portfolio, and orientation go through native compare-and-swap with exact readback.
One wake may create at most one visible sustained-work episode.
At seven elapsed minutes a wake starts no new acquisition. At eight it finishes the smallest honest judgment already in hand.
The Pulse never receives browser, computer-use, or external-write capability. It may not send or mutate provider content, change accounts, or push code. It is the only autonomous writer of current orientation, and it is structurally excluded from the review surface, so it never appears as one of your own open outcomes.
Sub-agent episodes run under codex exec with --sandbox read-only, --ignore-user-config, --strict-config, approval_policy=never, and web search disabled.
make install make check # tests, ruff, strict mypy, privacy scan make browser # Chromium acceptance suite seld demo # synthetic proof, does not touch a real vault
seld demo is the fastest way to see the claim rather than read it. An open commitment survives a killed episode, a fresh episode resumes it without a re-brief, a stale write is rejected, and unavailable evidence stays explicit instead of being guessed at. Sub-second, synthetic, no real vault touched.
04ComparedMECHANISM LEVEL
Where this sits, at mechanism level.
OpenClaw fires a trigger and calls a model inside it. Seld wakes the model and hands it your files.
State lives in the session. Kill the session and the thread goes with it. Continuity is whatever you paste back in.
The run is the unit. Orchestration decides when a model is invoked, and what the model concluded lands wherever that run put it. Kill the run mid-flight and nothing downstream can tell finished from dropped.
The record is the unit. Episodes are replaceable, canon is compare-and-swap files with exact readback, and a stale write fails closed instead of clobbering.
Won't OpenAI just build this? Your records are files on your machine and they survive a change of model. That is the same reason Claude support is credible rather than roadmap noise.
05The ledgerEXACT BYTES
Evidence belongs to exact bytes.
Release status here is an evidence ledger, not a claim.
Every release gate below is currently open for the exact candidate on this branch. Local code, passing unit tests, or a predecessor release cannot close an installed-path gate.
— docs/release-gates.md
All eleven gates are open, among them clean-machine installation, platform signing, provider-backed continuity, source connectors, the 72-hour heartbeat soak, the 30-day account soak, and a 14-day six-user beta. Windows fails closed on the control lane. Secure directory-pinned storage is available on macOS and Linux, and canonical reads stay available everywhere.
A partial source-tree canary on 2026-07-25 exercised the authenticated round trip against a synthetic vault: bearer and Origin rejection, stale-CAS rejection, same-hand answer with semantic readback, restart recovery, durable receipts. It did not use a signed or installed candidate, a clean account, or a connector path, so it promotes nothing. That is written down in the repo in those words.
PUBLISHING THE OPEN GATES IS THE POINT. A GREEN TEST ON THE AUTHOR'S LAPTOP CLOSES NOTHING.
06ClaudeCOMMITTED
Claude support is committed.
Committed, and honest about where the port stands.
Canon is plain files plus MCP, and the stdio MCP server carries no dependencies, so any MCP client can read and write the same surface. Execution episodes are replaceable by design, and docs/product-contract.md says it in as many words: Codex hands are replaceable execution episodes. The Codex-specific surface is real work, several thousand lines of it, and the Claude port is committed and not yet started. The repo will show which commit changes that.
—The repo
Read it before you believe any of this.
Roughly 25,600 lines of source across the package, 29 test modules. Run make check for current counts; they move. The four documents worth opening first are docs/product-contract.md, docs/architecture.md, docs/release-gates.md, and docs/trust-model.md.
THE URL LANDS HERE THE DAY IT GOES PUBLIC. NO LINK UNTIL THEN.