Repository navigation
System apps: every one has its own agent that can notify - #274
Merged
Merged
Conversation
Photos, Maps, YouTube and Camera get the agent Mail and Calendar have
(manifest `agent`: read-only profile, `ask_user_question`, a tool-calling
model) and the `glance` capability, with one tool in their own namespace:
`<namespace>.notify {title, body, card_id?, priority?}`. News keeps
`news.list` and `news.read` and gains `news.notify`. The system agent
reaches each as the octos peer `card.<app id>`.
A notice is one fixed L0 card for every app (crates/shell/resources/
glance/notice.card, moved from Mail's service), with the app's icon and
manifest name put in by the shell, the time, and the agent's title and
text; it opens the app and posts a notification, published as the app
only when its manifest is granted `glance` (glance::publish_for). Mail's
and News's services hand `notify` to the shell (`on_notify`); every system
app no service of its own answers gets the shell's NoticeService
(glance_notice.rs), registered after the shell's own services.
AI providers gets no agent yet: App Hub takes a tool namespace only as
[a-z0-9_] (octos a tool name's segments as [a-z][a-z0-9_]), so
`ai-providers.notify` and with it the agent block are refused; a test
says so and fails when App Hub admits one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The system agent asked for a new app's agent (agents.ask raised the first-use sheet), got "not yet allowed, wait for them" at once, and ended its turn; when the person allowed it, nothing carried the request on, so Photos and News were allowed but never asked anything (seen live). The system chat now holds the call, acknowledged as awaiting confirmation, until the person answered and the agent's peer started; then it answers with the peer slug and "send the request now, in this turn" (`agents::ask_settled`). Denied: the agent is off, say so. A call still unanswered after two minutes says the person has not answered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Held for the person's answer, agents.ask still failed after 30 s in the
live run ("the app did not answer within 30000 ms"): the kernel gives a
`read` host tool 30 s and accepts "awaiting confirmation" only for a gated
call. Declared as the kernel expects a call the host's own sheet confirms
(`risk: act`, `outward`, `confirm: app`), it is held as long as an approval
(an hour by default); the shell answers within ten minutes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ymote
force-pushed
the
feat/system-app-agents
branch
from
October 2, 2026 07:19
6189c61 to
f6973b1
Compare
Contributor
Author
|
Local CI passed on f6973b1 ( GitHub would run for this PR: desktop.yml, phone.yml, apps.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.
Notes:
|
ymote
added a commit
that referenced
this pull request
Oct 2, 2026
… no chat in agents' cards) The headless instrument run of the desktop shell showed where #269's README was wrong, and #273 and #274 have since changed the same ground: - Notifications (#273): a new card opens the glance panel unless a card window is up, and a notify card always posts a toast that opens it in its card window; while the panel is open, toasts stack left of it. Each card has a dismiss button, the panel a close button. Phone: a shade notification. - Notice cards (#274): every <app>.notify fills the shell's one notice card (crates/shell/resources/glance/notice.card, glance_notice.rs); Mail and News hand notify to the shell, Photos, Maps, YouTube and Camera are answered by its notice service. The app-agent table gains them. - No agent-published card has an in-card chat: the notice card and Calendar's event and agenda cards declare no sys.chat, so the card flow ends at the blackboard (steps 12-14 dropped from the sequence and its drawing; step 8 is "toast and glance panel (desktop), shade notification (phone)"). The only shipped card with a chat is the OCTOSENSE_GLANCE_DEMO=mail demo card, with canned replies. For the system apps the way in is "Ask <app>". English and Chinese, root and apps READMEs together. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 2, 2026
docs: glance cards as main draws them (toasts, dismiss, notice cards, no chat in agents' cards)
#271
Merged
Merged
guofoo
added a commit
that referenced
this pull request
Oct 2, 2026
main gave every system app its own agent for its notices (#274, 0212ff7). With this branch's `model` for Memories on top, two tests written on either side no longer held: - photos_bundle_is_admitted_by_the_shared_app_contract asserted that Photos has no agent; it now checks that the agent stays read-only. Memories are still one-shot model.complete calls. - photos_maps_youtube_and_camera_offer_notify_from_their_bundles expected Photos' grants to be storage and glance; they are now storage, model and glance.
guofoo
added a commit
that referenced
this pull request
Oct 3, 2026
main gave every system app its own agent for its notices (#274, 0212ff7). With this branch's `model` for Memories on top, two tests written on either side no longer held: - photos_bundle_is_admitted_by_the_shared_app_contract asserted that Photos has no agent; it now checks that the agent stays read-only. Memories are still one-shot model.complete calls. - photos_maps_youtube_and_camera_offer_notify_from_their_bundles expected Photos' grants to be storage and glance; they are now storage, model and glance.
guofoo
added a commit
that referenced
this pull request
Oct 3, 2026
main gave every system app its own agent for its notices (#274, 0212ff7). With this branch's `model` for Memories on top, two tests written on either side no longer held: - photos_bundle_is_admitted_by_the_shared_app_contract asserted that Photos has no agent; it now checks that the agent stays read-only. Memories are still one-shot model.complete calls. - photos_maps_youtube_and_camera_offer_notify_from_their_bundles expected Photos' grants to be storage and glance; they are now storage, model and glance.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
agentblock, theglancecapability) with one tool in their own namespace,<app>.notify {title, body, card_id?, priority?}. News keepsnews.listandnews.readand gainsnews.notify. The system agent reaches each as the octos peercard.<app id>.crates/shell/resources/glance/notice.card, moved from Mail's service, filled byglance_notice.rs): the app's icon and manifest name, the time, and the agent's title and text; it opens the app and posts a notification, published as the app only when its manifest is grantedglance. Mail's and News's services handnotifyto the shell (on_notify); every system app with no service of its own gets the shell'sNoticeService.agents.askwaits for the person. It returned "not yet allowed, wait for them" at once, the system agent ended its turn, and after Allow nothing carried the request on (seen live: Photos and News were allowed but never asked). The system chat now holds the call until the person answered the first-use sheet and the agent's peer started, then answers with the peer slug, so the request goes on in the same turn. It is declaredoutwardwithconfirm: app, which is how octos holds a call the host's own sheet confirms (areadtool gets 30 s).[a-z0-9_](octos a tool name's segments as[a-z][a-z0-9_]), soai-providers.notifyand with it the agent block are refused. A test says so and fails once App Hub admits it.apps/README.mdandapps/README.zh-CN.md: the apps table and the App agents section (merged with docs: the system agent and app agents as main has them #269's rewrite).Verified
cargo test --locked -p octosense-shell --features app-hub --lib(753 passed on the combined build),-p octosense-mail-service -p octosense-calendar-service -p octosense-news-service,python3 tools/native_apps.py --check,python3 tools/setup.py --check --cargo, and fromphone/:cargo check --locked -p octosense-home --features mobile-apps.maps.notify; the card and toast showed. YouTube, never allowed:agents_askstayed open over 40 s while the sheet waited (no 30 s timeout), and after Allow the system agent sent YouTube the request in the same turn (agents.ask for os.youtube answered: allowed→starts os.youtube's turn→glance: os.youtube published hello.card).tools/ci-local-merge.shadds.🤖 Generated with Claude Code