#Boundary vs guidance

Everything the harness does to keep a colony in line is one of two things. A boundary is enforced by the kernel or the host: it holds whatever the agent does or says, because the agent takes no part in it. Guidance is the rest — prompt text, skill packs, denial hints, nudges — that translates a denial into a next action. Guidance never changes a return code, and removing it weakens nothing. The split is a reviewer's first question: a control claimed as a boundary that turns out to be guidance is a finding.

#Boundaries

#Guidance

#Classifying a finding

• Hit a wall. The boundary held: an errored tool result carrying denial — an egress deny, a read-only mount, a refused tool. The colony works around it or asks. At worst this is a guidance gap (the hint was unhelpful), never a security finding.
• Defeated a control. The boundary failed: an event shows the publish rewrite, a secret swap, a mount or a gate crossed. Stop the colony and flag it; this is a security finding, and it goes to audit.md with a negative test on a real colony.

The audit record and the watchdog key on the same split: a guidance gap is work on the hints; a crossed boundary is a stop.

#Watchdog signatures

The watchdog (decide() in crates/colonizer/src/watchdog/mod.rs) keys on three signatures:

• Hint-loop — consecutive errored tool_result events carrying a denial, with no successful (non-errored) tool result in between, count as not progress: from two in a row the watchdog nudges on the clock of the progress that preceded the loop, not on the loop's own churn, and the nudge names what was denied (hint_loop_text, the class and the hint). The loop's retried calls and text cannot spend the nudges back, so the existing max_nudges → nudges_exhausted path still ends it. A successful result ends the loop, and so does anything that is a real break in it — a person's message, a question, a turn end — which count as progress as before.
• Genuine stall — no events at all: the existing nudge-then-flag behaviour, unchanged.
• Control-defeat (#609) — read off boundary events, below.

#Boundary events

A boundary event is the typed record that a control refused something (docs/agent-events.schema.json, #/$defs/boundary): its kind, the control or rule that decided, a one-line detail (redacted, at most 300 characters), the target host or path when the reporter can name one, and at, when the control decided. It is reporting only — the control has already decided, and the event grants nothing. Each lands in the colony's events.jsonl and shows in the chat as a muted row after the message it followed (web/src/components/BoundaryRow.tsx).

Not reported: a seccomp denial is an EPERM the agent sees like any other, logged only to the guest kernel's audit stream, so nothing on the wire tells it from an ordinary permission error; a nested .git stripped at publish is logged but routine (tests and vendored checkouts leave them); a refusal by the delegation gate (tool_disabled) is guidance-shaped and hit in normal work; and the runners other than Claude Code and ACP apply no exec policy and classify no denials.

#The control-defeat signature

note_boundary and note_reach_result in crates/colonizer/src/watchdog/defeat.rs fold each boundary event into the colony's trail, timed on the mothership's own receive clock, and fire on:

A path_policy_unbound alone fires nothing — off Linux every nested checkout produces one — but its target joins the deny-then-reach watch. The events a signature used are spent, so the same evidence never flags twice. The trail is in memory, capped at 64 events, and a restart forgets it.

Response: attention and a log line, not a stop. A signature sets the colony's attention to control_defeat, carrying signature, a one-sentence detail and the boundary events as evidence; the colony's log gets an error line naming the signature; the cockpit's attention banner lists the evidence; and an attention notification goes out if they are on. The watchdog does not nudge over the flag or replace it with a stall flag, the colony carrying on does not lift it, and only a person's own message (or the colony stopping) clears it. It does not stop the colony: "Defeated a control" above is a stop once a person has confirmed the boundary failed, and a signature is a pattern that says where to look, not that proof. Stopping is the person's call.