[ymote]

Why

OctoScript#53 lets L0 cards show text the model wrote (marked AI-written) and adds an in-card chat with the app's agent: source convo sys.chat(app, thread, fields) plus ChatEntry. The checker admits the card, but the host decides who may chat, keeps the transcript, writes each role and runs the agent. This PR is that host side. It also moves the email action card MVP off its workarounds.

Depends on OctoScript#53 and Octoscript-Makepad#68, and is stacked on #261 (feat/mail-card-mvp; retarget to main once it merges) (l0_ai_text and the AI-written mark). At the current pins this branch does not build, because l0_eval.rs reads the kit's new ai attribute. Pins are not moved here; see "Pin moves" below.

What

crates/l0-chat (octosense-l0-chat) is the code both host paths use: the shell's glance cards and card window, and AppCard's L0 cards.

• Ownership.
  • app must be the publishing app. A card naming another app is refused at publish (check_publisher).
  • Such a card reads an unavailable transcript (seed) and writes nothing (perform).
• The transcript is the host's.
  • seed replaces whatever the publisher put under a sys.chat source's name in data. A forged model entry is never drawn.
  • Entries are {id, role, text, at}. Ids are never reused.
• Roles.
  • The card's one write, append, is accepted only when its payload is what the person typed (ValueOrigin::UserInput). It is recorded as a user entry.
  • Only ChatStore::append_reply writes a model entry (the agent's answer) or a host entry (a notice). A payload shaped like {"role":"model",…} is just the text of a user entry.
  • Any other op, helper or origin is refused.
• Limits.
  • At most 4 KB per message after trimming. Control characters are dropped.
  • At most one message per 2 s per thread, and none while the agent is still answering.
  • The last 200 entries are kept.
  • A reply is cut at 16 KB.
• Storage (ADR 0004 §11). One file per thread, owner-only (0600 files in 0700 directories), in the app's account folder: apps/<app>/accounts/<account>/chat/<thread>.json.
  • The account is the one the app's agent acts for; it falls back to device.
  • Threads are keyed by file, so switching accounts switches transcripts.
  • Without host storage (unit tests), threads are kept in memory.
• Stale. Each change bumps a generation and wakes the UI. The card window lowers the card again when the reply arrives (L0Session::chat_moved).
• Responder trait.
  • Shell AgentResponder: a turn in the app's conversation on the host-owned app peer (agents::conversation, octos.turn.start in the person's lane, TurnTrigger::AppSaysPerson).
  • If the app has no agent, or the person has not allowed it, the reply is a host notice saying why.
  • Mail has no agent wiring yet (no octos services, no tools.json). Under OCTOSENSE_GLANCE_DEMO=mail it answers with the existing canned demo reply (Canned).
  • AppCard uses NoAgent, a host notice. Its agent is not wired to answer inside a card yet.

Shell (glance).

• glance.rs checks the publisher and seeds the host's transcript before lowering.
• glance_card::L0Session knows its publisher and dispatches with event_payload_origin / dispatch_reporting_with_origin. It performs sys.chat writes through glance_chat.rs.
• The demo seeds the earlier Q&A as host entries.

AppCard.

• with_durable no longer treats a writable sys.chat as a user-store collection. It seeds the chat instead.
• tap_inner routes chat writes.
• The module claims the storage the shell offers and keeps chats in apps/appcard/accounts/device/chat/.
• l0_eval.rs reads ai, and l0_widgets::to_dsl runs octoscript_node::ai::expand_ai_marks, so the mark is drawn on the device.

Mail card. mail-request.card now uses:

• model-copy for the summary, the suggestion and the reply draft. Reply writes the draft into a text state with set(copy.draft).
• sys.chat + ChatEntry for Ask.

The sys.dataset fields standing in for summary/draft, the sys.news_digest transcript and the sys.topics stand-in are gone. The hand-made "AI" eyebrows are dropped, because the kit's mark replaces them.

Docs.

• framework/catalog.md is regenerated with gen-catalog.py. It adds ChatEntry and sys.chat, plus the missing sys.digest, sys.dataset, sys.news_digest and sys.news_status.
• framework/l0.md §4: model-copy is shown and marked, never acted on; new sys.chat section.
• docs/LEDGER-ARCHITECTURE.md §5.3: the new rule and the host's chat rules.

CI: apps.yml tests and lints octosense-l0-chat.

Tests

All run against OctoScript#53 (3ca709c) and Octoscript-Makepad#68 (51c4c51) checked out in .sources.

• octosense-l0-chat, 8 tests:
  • ownership
  • role forgery refused (published transcript, role-shaped payload, non-append op, authored/model/no origin, other helper)
  • length, rate, retention and cut limits
  • append → model reply, synchronous and later from another thread
  • no agent → host notice
  • thread from state
  • files kept per app with 0600
• Shell (--features mobile-apps):
  • the_ai_written_mark_reaches_the_card_window: summary and suggestion are marked, the draft is marked until the person edits it, and in the chat only the agent's entry is marked.
  • the_mail_card_asks_mails_agent_in_the_card: the field commit records the user entry plus the canned model reply, and a second message within 2 s is refused.
  • a_published_transcript_is_not_the_hosts
  • a_mail_toast_opens_its_own_card: also checks that another app cannot publish the card.
  • an_app_without_an_agent_gets_a_host_notice
  • the existing glance tests
• AppCard: appcards_chat_is_the_hosts_and_its_own, plus the existing 200 octos-app tests.
• desktop/scripts/mail_card_remote.sh passes in hidden windows, with a scratch home. Ask → ➤ stores apps/os.mail/accounts/device/chat/ana-contract.json.

Pin moves (after OctoScript#53 and Octoscript-Makepad#68 merge)

• Cargo.toml: octoscript-ui-l0, octoscript-core, octoscript-capabilities, octoscript-schema move dbd48cf → System-Apps 03350348: AppCard on the shells' runtime (6881fb6c) #53's merge commit. octoscript-makepad and octoscript-node move e0df0b5 → the Octoscript-Makepad commit that has Tracking: ADR 0002 first slice — News (M1–M8) #68 and pins System-Apps 03350348: AppCard on the shells' runtime (6881fb6c) #53's merge in runtime.json (Tracking: ADR 0002 first slice — News (M1–M8) #68 still pins 30a21b78). Update the comment above them too.
• native-runtime.lock.json and apps/appcard/native-runtime.lock.json: e0df0b5 → that same Octoscript-Makepad commit.
• Makepad stays at e29a0eaa.
• Docs that name the old revisions: phone/docs/makepad-fork.md, rom/docs/home-build.md.

🤖 Generated with Claude Code