Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/dos-the-trust-substrate-for-agent-fleets/issues.md or /mcp/dos-the-trust-substrate-for-agent-fleets/issues.json, or Pod over MCP.

Reported issues for DOS — the trust substrate for agent fleets

Pod holds 17 of 21 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to DOS — the trust substrate for agent fleets.

Most discussed

Subagent in-lane edit hard-DENIED: inherited CID_RUN_ID misclassifies a child as a dispatch loop + blocks self-lease resolution

Failure class: a legitimately-dispatched subagent's in-lane edit is hard-DENIED (no operator softening)

What

When a parent (a /dispatch-loop, a /goal worker, or any session that holds a lane lease) spawns a subagent to edit files inside the lane the parent already holds, the PreToolUse hook hard-DENIES the in-lane Edit/Write — even though the edit is squarely in-scope.

The deny carries an empty reason_class (a pure contention collision, not SELF_MODIFY), so it is not

Read the thread · 2026-06-16 · closed · 3 comments

distribution: MCP Registry serves stale v0.24.1 (PyPI is 0.25.0) — re-dispatch publish to refresh the github.com/mcp + VS Code + PulseMCP fan-out

What

The official MCP Registry serves a STALE version of DOS. As of 2026-06-12:

The registry is the auto-fan-out multiplier — its entry feeds GitHub's github.com/mcp app store, VS Code's @mcp gallery, PulseMCP's crawl, and Mastra's index. So all four downstream surfaces are currently advertising 0.24.1,

Read the thread · 2026-06-13 · closed · 3 comments

design: dos.testing.suite - an exportable conformance suite + JudgeTester so a third-party plugin's CI proves the seam safety laws

What

Ship an importable conformance suite — working name dos.testing.suite — plus an ESLint-RuleTester-style micro-harness (JudgeTester), so a third-party dos.judges / dos.notifiers / dos.overlap_policies / dos.hook_dialects / dos.predicates plugin can prove the seam safety laws in ITS OWN CI, without this repo ever seeing its code.

The laws are already enforced for in-tree occupants (fail-to-abstain in run_judge, the admissible_under_floor AND, send_safely fail-soft) —

Read the thread · 2026-06-12 · closed · 2 comments

MCP dos_arbitrate reports a HELD lane FREE: it never reads the lane-journal, unlike the CLI and lease-lane acquire

Two lease verbs disagree about the same lane at the same moment

Observed live in C:/work/fak (22 leases in the WAL, tools held by w4591 since 2026-07-18). Same workspace, same second, three surfaces:

MCP dos_arbitrate(lane="tools", workspace="C:/work/fak") — says FREE:

{"outcome":"acquire","lane":"tools","lane_kind":"cluster","tree":["tools/**","scripts/**"],
 "auto_picked":false,"reason":"cluster lane 'tools' free — admitted.","free_clusters":[],
 "interpretation":"GO 

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/246) · 2026-08-07 · closed · 1 comment

### design: scoreboard consumption surfaces - the opt-in badge + a per-repo verdict.json agents can query (the context7 / Tessl-registry mechanic)

## What

Two consumption surfaces over the per-repo scoreboard artifact (#84), each copied from a proven distribution mechanic:

1. **The badge** (the Scorecard/Snyk move). A shields.io-compatible endpoint JSON per indexed repo (`/scoreboard/<org>/<repo>/badge.json`) so a repo can embed `commit-claims: audited clean (as of <date>)` in its README. Every embed is a backlink and a standing referrer; CLEAN is the grade the pilot says most reviewed repos earn — i.e. the grade repos will actually want

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/85) · 2026-06-12 · closed · 1 comment

### design: OpenClaw host support - dos verdicts behind its typed block-capable hooks (seventh host)

## What

Host support for OpenClaw — the seventh host. A plugin registering its typed `api.on(...)` hooks (which are block/cancel-capable, i.e. a real enforcement seam) to consult the dos verdicts: pre-tool (`arbitrate` for lane collision, `exec_capability` for arbitrary-exec advisory) and at stop (verify-on-stop, the false-"done" gate), plus a `dos.hook_dialects` driver if its hook output grammar differs from the shipped dialects.

Unlike Trae (#27, blocked on an unpublished contract), the docs

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/74) · 2026-06-12 · open · 1 comment

### design: plugin manifest handshake - min kernel version + Protocol validation at resolve time across the five entry-point seams

## What

A version/capability handshake for the five entry-point seams (`dos.judges`, `dos.predicates`, `dos.notifiers`, `dos.hook_dialects`, `dos.overlap_policies`):

- a plugin may declare a minimum kernel version (and later, conservative-default capability bools, Sphinx-style — absent means the safe value);
- the by-name resolvers check the declaration at resolve time — a mismatch yields a TYPED refusal/abstain-shaped outcome (the built-in default still serves), never a crash and never silent

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/63) · 2026-06-12 · open · 1 comment

### dos_mcp: remote transport + OAuth serving mode for connector catalogs

## What

`dos_mcp` serves stdio only: a local process, one workspace, launched by the client. Every connector catalog that would let third-party agent platforms call DOS tools requires the opposite shape — a **remote** MCP server over HTTPS with real auth. Two concrete catalogs, same requirements (verified from their published docs, 2026-06-11):

- Anthropic's connector directory (remote MCP servers, OAuth).
- Harvey's MCP Connector Library (legal-agent platform; requires OAuth 2.1 with PKCE S25

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/43) · 2026-06-11 · closed · 1 comment

## Most recent

### SessionStart/UserPromptSubmit hooks fail under the OpenAI Codex backend

Codex registers the dos-kernel plugin's `hooks.json` events in `~/.codex/config.toml` (`[hooks.state."dos-kernel@dos:hooks/hooks.json:session_start:0:0"]` and `:user_prompt_submit:0:0`) and invokes them, but both return failure on every codex session.

**Witnessed:** in a codex-backend dispatch worker log, in order: `hook: SessionStart` / `hook: SessionStart Failed` / `hook: UserPromptSubmit` / `hook: UserPromptSubmit Failed`, immediately before the worker's credit-wall ERROR. The Claude and ope

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/237) · 2026-06-29 · open · 0 comments

### packaging: native hook binaries ship without +x → live hooks silently passthrough (|| true) while MCP verbs keep working

Found while auditing dos-kernel **v0.28.0** (Claude Code plugin) on macOS (arm64). The MCP verbs (`dos_doctor`, `dos_commit_audit`, …) all worked, but **live PreToolUse/Stop enforcement was silently disarmed** — every hook fell through to `|| true`.

## Root cause

`hooks/hooks.json` resolves each hook in order: native `bin/dos-hook` → `python -m dos.cli` → `python3 -m dos.cli` → `|| true`. On this box every branch failed:

1. **Native binaries shipped without the execute bit** (`-rw-r--r--`), s

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/227) · 2026-06-18 · closed · 0 comments

### Promote residual review to a first-class `dos review` verb + MCP tool

## Promote residual review to a first-class `dos review` verb + MCP tool

`examples/residual_review/` (shipped `56f2e46`, design in docs/358) is the
product expression of the witness invariant: it re-projects `commit-audit`'s
per-commit verdict into CLEARED / RESIDUAL / UNVERIFIABLE so review attention
concentrates on the claims git could not back. It works, has 11 passing tests,
and audits OK/diff-witnessed.

But it ships **only** as `python examples/residual_review/residual_review.py`.
That is

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/211) · 2026-06-16 · closed · 0 comments

### mcp: dos_arbitrate is missing the --class-budget parity surface (concurrency-class budget unreachable over MCP)

## Problem

The `dos arbitrate` CLI accepts `--class-budget KIND=N` (docs/97 / docs/110 Phase 1) and threads a `{lane_kind: max_concurrent}` concurrency-class budget into `arbiter.arbitrate(class_budgets=...)`. The `dos_arbitrate` **MCP tool** (`src/dos_mcp/server.py`) does **not** expose this — so an agent driving the in-session deconfliction handshake (Recipe 8) over MCP cannot cap concurrent leases of a kind. The pure-data half of the concurrency-class model is unreachable from the MCP surf

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/175) · 2026-06-15 · closed · 0 comments

### dos-goal-gate: cross-reference the Fable-5 guide's 'don't stop early' discipline — the witness gate is the enforced version of 'check your last paragraph'

## Summary

The Fable-5 guide's **"Rare cases of early stopping"** section and DOS's `dos-goal-gate` skill are solving the *same problem from opposite ends*, and they should be explicitly connected.

The guide (model-side, prompt-only mitigation):

> Deep into a long session, Claude Fable 5 can occasionally end a turn with a text-only statement of intent ("I'll now run X") without issuing the corresponding tool call, or pause to ask permission when it already has enough to proceed.
>
> ```
> Bef

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/173) · 2026-06-15 · closed · 0 comments

### vibe coders: Cursor on-ramp — surface the already-shipped `--hooks cursor` where Cursor users look

## The gap

Cursor is the dominant AI-native editor for vibe coders — and DOS **already wires it**. `dos init --hooks cursor` writes `.cursor/hooks.json` today (see `dos init --help`, `src/dos/hook_install.py`, `src/dos/drivers/hook_dialects.py`). The problem is pure **discoverability**: nothing tells a Cursor user this exists, and the install path isn't where a Cursor user looks.

This is *not* an adapter-engineering task (the adapter ships). It is an on-ramp / framing task: surface the already

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/162) · 2026-06-14 · closed · 0 comments

### design: Qwen Code host support - the CC-grammar settings.json install spec

## What

Host support for Qwen Code — the open-source terminal coding agent in the Gemini-CLI lineage. Its hooks are Claude-Code-shaped nearly verbatim: `.qwen/settings.json` carries `PreToolUse` matcher groups whose command hooks receive JSON on stdin; it adds `sequential`/parallel execution and an HTTP hook type. Expected shape: an install spec (JSON merge into `.qwen/settings.json`) plus a dialect that likely delegates to the Claude Code renderer the way `CodexDialect` does — the plan's prove

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/88) · 2026-06-12 · open · 0 comments

### design: GitHub Copilot host support - the preToolUse allow/deny dialect + install spec (the largest-audience host)

## What

Host support for GitHub Copilot — dialect + install spec over its GA hooks surface (CLI, SDK, and the coding agent). Copilot's `preToolUse` hook receives the tool call and answers with a structured `allow` / `deny` / `ask` decision on stdout, and is deliberately fail-CLOSED (an erroring/timing-out hook denies, never silently allows) — the same posture as the dos sensors. A `dos.hook_dialects` renderer for the decision object + a `dos.hook_installs` spec for its hooks configuration, exac

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/86) · 2026-06-12 · open · 0 comments

### design: LangSmith webhook bridge - the env-evidence verdict for runs their hosted evaluators cannot reach

**Found while:** a 2026-06-11 sweep of host-platform extension points (primary vendor docs).

**The seam.** LangSmith's hosted code evaluators run network-sandboxed: they cannot reach git or the execution environment, so no hosted evaluator there can hold an env-authored rung. Their webhook rule action is the documented path for remote evaluations — it POSTs matched production runs to an endpoint you control, and a verdict can be written back through the feedback API. The receiving infrastructur

[Read the thread](https://github.com/anthony-chaudhary/dos-kernel/issues/47) · 2026-06-12 · open · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/anthony-chaudhary/dos-kernel/issues).