{
  "layers": [
    {
      "name": "fossil",
      "purpose": "Reading and writing Fossil, through operations named for what they do"
    },
    {
      "name": "protocol",
      "purpose": "Protocol v1 and the tools: what OCX writes in Fossil and reads back, and how each tool is defined, reached and answered"
    },
    {
      "name": "workspace",
      "purpose": "Where a run's program works, and how it is confined: its workspace, sandbox, inbox and watcher"
    },
    {
      "name": "console",
      "purpose": "The console, served by Fossil as a CGI program"
    },
    {
      "name": "release",
      "purpose": "Building, staging, accepting and rolling back releases"
    },
    {
      "name": "git",
      "purpose": "Git clients reading a Fossil export"
    }
  ],
  "modules": [
    {
      "file": "src/ocx/importing.cr",
      "layer": "release",
      "purpose": "Count stage runs by the served repository's receipts and the root owner's builder list, check their pattern and files, copy and smoke them."
    },
    {
      "file": "src/ocx/commands/release_import.cr",
      "layer": "release",
      "purpose": "Offer import with checks and changes under the shared release root lock."
    },
    {
      "file": "src/ocx/fossil.cr",
      "layer": "fossil",
      "purpose": "Reach Fossil only through operations named for what they do, on a Place: where fossil acts, on the host or in a sandbox, its transport private and its one start of the fossil program, a command that met a writer outside OCX holding the repository, storing nothing, run again once Fossil has waited, outside OCX's lock beside the repository, for that writer to let go, within two stated bounds; read a setting."
    },
    {
      "file": "src/ocx/fossil/said.cr",
      "layer": "fossil",
      "purpose": "Read the forum posts and ticket changes that may hold an OCX message, or those of one thread or ticket, each with its thread or ticket, its text, when it was written, whether Fossil holds it private, its receipt (the user, whether it has an address, its number), its ocx-message tag's value and, for a post, the post it replies to, in the order received; the check-ins among the artifacts listed, or those that change files on a branch or every branch, with their branches, the users they name and their receipts; artifacts' receipts; and what a user may do, as Fossil grants it, inherited capabilities included."
    },
    {
      "file": "src/ocx/fossil/repository.cr",
      "layer": "fossil",
      "purpose": "Ask Fossil what a repository holds besides its artifacts: a user's password, a capability letter added to or taken from those a user holds of its own in one statement, the default user, its login group, the checkout a directory is in, the remote, the names it resolves, a checkout's changes, what a run's checkout and clone hold that their server lacks (changes, files Fossil does not track, stashes, artifacts not sent), its public URL, its server-code, its hooks, and whether it holds wiki edits, or ticket changes made in its pages, for a moderator."
    },
    {
      "file": "src/ocx/fossil/tickets.cr",
      "layer": "fossil",
      "purpose": "Read and write tickets' changes in Fossil: a ticket's newest change, the tickets and threads a prefix of a hash names, a ticket by its id or any of its changes, and a comment appended as a user, composed as Fossil's ticket change and stored, with its ocx-message tag when it holds an OCX message, by one command."
    },
    {
      "file": "src/ocx/fossil/forum.cr",
      "layer": "fossil",
      "purpose": "Read and write forum posts in Fossil: a post a prefix of its hash names, read from its artifact, and a reply or a thread's first post composed as Fossil's forum artifact and stored, with the ocx-message tag on one holding an OCX message, by one command."
    },
    {
      "file": "src/ocx/fossil/stored.cr",
      "layer": "fossil",
      "purpose": "Store the artifacts OCX composes, a post or a ticket change with the control artifact tagging it, or a control artifact of tags, by one fossil command, bundle import, from a bundle file OCX writes, each artifact named by the repository's hash policy: every one stored, indexed and tagged together, or, should the command fail, none, needing no checkout."
    },
    {
      "file": "src/ocx/fossil/message_tags.cr",
      "layer": "fossil",
      "purpose": "Read for questions every post and ticket change the ocx-message tag was ever put on, whatever its value or cancellation; add tags to several artifacts at once in one control artifact, stored and indexed atomically."
    },
    {
      "file": "src/ocx/fossil/wiki.cr",
      "layer": "fossil",
      "purpose": "Read and write wiki pages in Fossil: the names of the pages with a prefix, every version of a page with its text as its artifact holds it and the user and receipt it came by, and a new page written as a given user, as create reads a pattern and project copies the patterns."
    },
    {
      "file": "src/ocx/fossil/described.cr",
      "layer": "fossil",
      "purpose": "Describe the links a person is shown, where questions and runs are and what a question replies to and refers to, as a person reads them without a hash, by one query over blob, forumpost, ticketchng and ticket, event, the event- and wiki- tags, and mlink and filename: each one's kind, title, sender by its receipt, time and excerpt, an OCX message's block left out, a file's lines by Fossil's ln=, each hash in a title or an excerpt shown by its artifact's title by one more, any hash in that title cut, and one naming nothing here, or several, cut; the notes of decisions and runs shown so too; and only what the caller may read."
    },
    {
      "file": "src/ocx/fossil/referenced.cr",
      "layer": "fossil",
      "purpose": "Read the links Fossil's pages answer to, and resolve each reference post is given, a hash, a prefix, an id, or a link of the server whole or from its root, to the one artifact, ticket, tech-note or wiki page it names, by the same query, as a link from the repository's root, a file's lines at a check-in as its artifact's; refusing a link elsewhere, one naming nothing or several, and what Fossil holds private."
    },
    {
      "file": "src/ocx/fossil/checkins.cr",
      "layer": "fossil",
      "purpose": "Read and write check-ins and their tags in Fossil: when the newest was made, who checked one in, a tag on one with the user Fossil received it from, every change control artifacts made of a tag on a check-in, read from their T cards with who sent each, and a tag added, on a check-in or another artifact."
    },
    {
      "file": "src/ocx/fossil/sync.cr",
      "layer": "fossil",
      "purpose": "Clone, open and push with Fossil, a checkout naming its repository by the path from itself so it opens wherever the two are seen together, saying why a push did not reach its remote; import git's fast-export from a pipe, export a repository to git and read where its export stands."
    },
    {
      "file": "src/ocx/fossil/direct.cr",
      "layer": "fossil",
      "purpose": "Read a repository's database directly in Crystal, query-only, waiting on Fossil's lock as Fossil does, the second implementation of Fossil's reads; and find the checkout a directory is in by its checkout file, from there up. Seed a new git export's state, so its first export keeps an imported upstream's commits."
    },
    {
      "file": "src/ocx/git.cr",
      "layer": "protocol",
      "purpose": "Reach git through the operations OCX uses: the refs a fetch is offered and the pack it is answered with, on the host; and an upstream's bare clone, its default branch and its branches' fast-export with marks into a pipe, in a sandbox; starting git in one private place with PATH alone in its environment."
    },
    {
      "file": "src/ocx/git_export.cr",
      "layer": "protocol",
      "purpose": "Serve a repository's git export read-only over git's smart HTTP, from where fossil git export recorded it, refusing pushes, viewers who may not read code and requests too large."
    },
    {
      "file": "src/ocx/mirror.cr",
      "layer": "git",
      "purpose": "Keep a repository's git export current: run fossil git export into the export its setting names, one run at a time, a run asked for meanwhile making it export again, keep the last run in the export's .git, and read where the export stands as fossil git status says."
    },
    {
      "file": "src/ocx/worktree.cr",
      "layer": "release",
      "purpose": "Start the tree's own programs, crystal and shards, the one place they are started, to gate and build a release."
    },
    {
      "file": "src/ocx/releases.cr",
      "layer": "release",
      "purpose": "Keep the release root: stage a release as next, accept it into the root, install it the first time, and roll back."
    },
    {
      "file": "src/ocx/staging_checkout.cr",
      "layer": "release",
      "purpose": "Check that a stage checkout is committed and name its release from Fossil's check-in."
    },
    {
      "file": "src/ocx/staging.cr",
      "layer": "release",
      "purpose": "Stage a committed checkout's built programs as a release named for its check-in, smoked before it is offered."
    },
    {
      "file": "src/ocx/refusal.cr",
      "layer": "protocol",
      "purpose": "Name what a caller can cause, one exception every tool answers as a refusal: input not understood, or not allowed or possible now."
    },
    {
      "file": "src/ocx/elements.cr",
      "layer": "protocol",
      "purpose": "Define OCX's typed elements: a branch's JSON, derived shape, walk and reading from text, all from its type; every input's dry_run; and the leaves with rules of their own, a question's option among them, read by a person numbered, and a moment, read as how long ago and its time in UTC."
    },
    {
      "file": "src/ocx/shape.cr",
      "layer": "protocol",
      "purpose": "The shape of an element's JSON, as JSON Schema writes it, derived from the element's type, never written by hand: what the catalog gives of each tool's input and output, and what every entry point reads a call by."
    },
    {
      "file": "src/ocx/shown.cr",
      "layer": "protocol",
      "purpose": "What console's view shows a person to follow or do next, as typed elements its page and its text each lay out their own way: a link, by its title, where it leads and its excerpt; and a press, a tool, the input it gives it and the field left for the person to fill in, and whether it is the one recommended."
    },
    {
      "file": "src/ocx/log.cr",
      "layer": "protocol",
      "purpose": "Perform every operation of a command through one typed log, the single place dry_run is honored: checks run even in a dry run, changes only for real, and a tool that writes nothing cannot log a change. Record what ran and stop a project's later operations once TERM asks it to stop. Read the final typed entry of a line log backwards in bounded blocks for status's daemon round and projects' last outcome, returning none for a missing or malformed log."
    },
    {
      "file": "src/ocx/text.cr",
      "layer": "protocol",
      "purpose": "Write any element as text, the CLI's layout and MCP's text, from its type alone: an answer's result before its log; and the pieces console's own text uses: a link's target escaped, a record's words on one line, and text wrapped."
    },
    {
      "file": "src/ocx/console_text.cr",
      "layer": "protocol",
      "purpose": "Lay out console at the command line and in MCP's text, with no answer around it, a refusal or a dry run as one line, then `next:` where the tool says what to do instead, a dry run's line saying it was one and why console would stop without it, where it would: each question as a short card, the call that answers it said once, the command line or MCP's call, its options numbered beneath; each excerpt's lines quoted, any control character shown as U+FFFD; every other open question on a line; each section holding none named in one closing line; the runs in aligned columns."
    },
    {
      "file": "src/ocx/markdown.cr",
      "layer": "console",
      "purpose": "Write any element as Markdown, the web page's layout, from its type alone: sections for its branches, an answer's log last, tables for its schemas, a line for each operation, letting a page draw an item of a list itself; a leaf that links by its words on one line, where it leads escaped; text escaped so it never reads as markup, a fence's backticks and tildes among it."
    },
    {
      "file": "src/ocx/cli.cr",
      "layer": "protocol",
      "purpose": "Read a command line from each tool's derived input shape, required fields either bare or named; print its answer as text, console's layout, or JSON, keeping the explicit repository and user in commands it prints."
    },
    {
      "file": "src/ocx/command.cr",
      "layer": "protocol",
      "purpose": "Define a tool once, generically: the entry points and the context a tool receives, its one method with the log, which a caller may hold to stop the run, and its answer, each shape derived from its type; and the one check by which every entry point refuses, before any tool reads it, a field's name or value that is not UTF-8 or holds a NUL, a JSON value's once its escapes are decoded."
    },
    {
      "file": "src/ocx/commands.cr",
      "layer": "protocol",
      "purpose": "Find every tool by walking Command's subclasses, and run one on its input as named text or JSON."
    },
    {
      "file": "src/ocx/commands/echo.cr",
      "layer": "console",
      "purpose": "Answer with exactly the arguments read and who gave them, so every way in can be shown to deliver the same input."
    },
    {
      "file": "src/ocx/commands/list.cr",
      "layer": "console",
      "purpose": "List every tool with the derived shape of its input, what runs when no tool is named and what MCP lists; help adds each output's shape, the context's and the answer's, and where releases live."
    },
    {
      "file": "src/ocx/commands/status.cr",
      "layer": "console",
      "purpose": "Show who is calling and from where, the resolved context, this program's release and source check-in, and what its root serves and offers. Read Fossil's export hook, its backoffice settings and timeline chat user. On the served repository, show readable open runs for every node user an administrator's run names, from the record alone, without local care or a node's decision note. Given a clone and its project password file, log sign-in as that node, show its offer (node user, clone server-code and enforced limits), and read runs only through its last completed pull, including local care and, for setup, descendant processes. Read the daemon's last round from daemon.log and show imports running or abandoned beside the served repository and their last logged outcome."
    },
    {
      "file": "src/ocx/commands/questions.cr",
      "layer": "console",
      "purpose": "Say what waits on a user, as data, the same at every entry point, writing nothing: each question for them they have not decided, each they may confirm answered that has a decision, and every other open question, each with its fields once, where it was asked, who sent it and when, what it replies to and its references described by one read, its decisions with their notes titled, and who may confirm it; from a clone's checkout, the server's receipt tool says who sent each question and decision."
    },
    {
      "file": "src/ocx/commands/console.cr",
      "layer": "console",
      "purpose": "Show a person's view without writing: read questions' answer, then runs as status reads them, from the served record or through a clone's completed pull after a logged sign-in. Shape each question waiting on them with its sender, age, stakes, links and excerpts to read first, a press per option, the recommended first, and their own words; each they may confirm answered with its decisions and a press to confirm; then every other open question. Show all named nodes' open runs and the five that ended last, with who sent each, its process user, phase, age and reports; include local care and decision notes only on the agent machine. Keep hashes in links or presses and let each entry point lay the view out in its own way."
    },
    {
      "file": "src/ocx/commands/release.cr",
      "layer": "release",
      "purpose": "Offer staging, accepting and rolling back a release as commands."
    },
    {
      "file": "src/ocx/commands/release_operations.cr",
      "layer": "release",
      "purpose": "The checks and changes staging, accepting and rolling back a release perform: read the root, check the checkout, run the gate and the build, copy, smoke, offer, take, serve and roll back."
    },
    {
      "file": "src/ocx/entry.cr",
      "layer": "protocol",
      "purpose": "Choose the entry point by the program's name, or MCP for ocx2 --mcp, or a project the web page started for ocx2 --project-detached, and resolve the caller once."
    },
    {
      "file": "src/ocx/cgi.cr",
      "layer": "console",
      "purpose": "Answer Fossil's CGI requests as Markdown in the skin: the OCX page, the list, with each tool as a card and console linked in its header, or a tool's answer with a button back to the list and its own card, or console's page of its own, to which a press there comes back by a redirect, or JSON; drawing nothing a tool does not answer; a tool that writes nothing taken from any request, one that may change something only from a POST from OCX's own page, never from another page of the site."
    },
    {
      "file": "src/ocx/page.cr",
      "layer": "console",
      "purpose": "Lay out the web page around the Markdown walk: a style block taking its colours from the skin, the strip of the context's facts, the link to console in the list's header, and each tool but console as a card with a link to where it is defined, the capabilities it needs marked for the viewer, what it would do now, and its form unless a POST of it would be refused."
    },
    {
      "file": "src/ocx/console_page.cr",
      "layer": "console",
      "purpose": "Lay out console on the web, a page of its own in the skin holding nothing but what a person reads and presses, as one block of HTML Fossil's Markdown keeps whole: each question waiting on them as a card, with what to read first, its excerpts folded, a button per option, the recommended marked, and a field for their own words; what they may confirm, with its decisions; every other open question on a line; each section holding none named in one closing line; the runs as a table; one link to the list; a refusal or a dry run as one line, a dry run's saying it was one and why console would stop without it, where it would; each button posting to its tool and coming back here, saying what was written."
    },
    {
      "file": "src/ocx/mcp.cr",
      "layer": "protocol",
      "purpose": "Offer every tool over JSON-RPC: tools/list as the list tool's answer, tools/call into the tool's typed input; served by ocx2 --mcp too; the edge where JSON is read."
    },
    {
      "file": "src/ocx/mcp_http.cr",
      "layer": "protocol",
      "purpose": "Serve MCP over HTTP on this host's loopback alone: one JSON-RPC message posted to /mcp answered as the standard input's server answers a line, for a client beside it such as a provider's tunnel."
    },
    {
      "file": "src/ocx/mcp_tunnel.cr",
      "layer": "protocol",
      "purpose": "Be OCX's own client of OpenAI's Secure MCP Tunnel: long-poll the tunnel's control plane, connecting out alone, answer each JSON-RPC command as the MCP server answers a line, and post each answer with its correlation, backing off a refused poll and ending at a refused key."
    },
    {
      "file": "src/ocx/ollama.cr",
      "layer": "protocol",
      "purpose": "Hold a conversation with a model at an Ollama server's /api/chat, a step at a time: each step's request and reply kept exactly and given to its caller before any tool call it makes, or writes as text, is answered and sent back, until it calls none, its step budget is spent, the next request would pass its bytes, or its caller says why; a server not reached, answering no reply or none in time refused."
    },
    {
      "file": "src/ocx/mcp_ollama.cr",
      "layer": "protocol",
      "purpose": "Be OCX's own agent for local models, a run's command: read the run's line and a delivery's, work the objective through the checkout's tools as MCP serves them to the run's user, refusing any other, print each reply as a line of JSON before its calls run and each answer after it, within what the run keeps of its standard output, and post the model's last words as the run's user where the delivery or the run is."
    },
    {
      "file": "src/ocx/hook.cr",
      "layer": "fossil",
      "purpose": "Read and identify Fossil's own after-receive export command, %F git export --if-mirrored -R %R, and the old ocx2-hook executable when replacing or removing it. Say whether one current command, an old or repeated command, or no command is installed; report other after-receive programs, whether backoffice is queued, immediate or disabled, and the user naming timeline chat events. The hook needs no release root, node user or OCX lock: Fossil runs one hook at a time and its export holds a write transaction. No hook schedules, decides or reports on run-work."
    },
    {
      "file": "src/ocx/workspaces.cr",
      "layer": "workspace",
      "purpose": "Lay out a run's workspace under the agents root, by its user, project and run, write a kept log there unless the run took its place, and build the checked public URL its clone is made from, with the explicitly supplied user and password in it; for a run whose directory step has remove_on saved, remove its workspace once the run has ended if the server holds its work, Fossil reading it in a sandbox, or say what it kept, remove one whose process never ran unread, as nothing in it can be unsent, and keep unread one whose watcher failed; and say removed only once nothing is left at its path, and otherwise what is left."
    },
    {
      "file": "src/ocx/sandbox.cr",
      "layer": "workspace",
      "purpose": "Name bubblewrap, the one program that confines a process, and start a sandbox or a run's process with the one call that starts either; say how a process ended, by its status or the signal that ended it, and keep the end of what it printed; start a run's process in a session of its own, which it leads a process group of; be Linux's subreaper while a run is watched; end what a run's program left, each process group of the session it led and each sandbox init it took, with every process of that sandbox, waiting for each by its pid until none is left; and signal a group only while a child of its own not yet waited for is in it, so never one that took its number, and signal each such child, as a detached project asked to end does."
    },
    {
      "file": "src/ocx/tasks.cr",
      "layer": "workspace",
      "purpose": "Hold OCX's own jobs in a sandbox, such as a project's git and fossil, as data: a task's sandbox and limits written as a run's layers, its wall inside its sandbox, so bubblewrap is its caller's own child and ends with it, its workspace the directory it works in, its input or output a pipe's end another task holds the other end of, run through the same plan and the one start as a run's process; read the space free where a task works, which bounds a project's git tasks' files; and watch that space while a task runs, stopping it once it has fallen below two-thirds of what it was as it started."
    },
    {
      "file": "src/ocx/session.cr",
      "layer": "workspace",
      "purpose": "Make a run's inbox, a named pipe in the node's directory held open for reading and writing, as large as Linux lets it be, and inherited by no program; put a line in one whole or not at all, never waiting; and start a detached process, such as a watcher, a project the web page started or a watcher, in a session of its own, in the environment given, answering the process: the one place one is started."
    },
    {
      "file": "src/ocx/commands/create.cr",
      "layer": "workspace",
      "purpose": "Write a run as the caller on the served repository: the first post of a new thread, a reply to a post, or a change to a ticket, its fields from a pattern's JSON block, the version of its wiki page an admin or setup wrote, and those given over them, the check-in each files step takes among them, checked as a node checks it. From a clone's checkout, as a run's program writes one: pulled first, the pattern's version the server says an admin or setup sent, and a reply or ticket change pushed."
    },
    {
      "file": "src/ocx/commands/secret.cr",
      "layer": "workspace",
      "purpose": "Set a secret a run may use, such as a tunnel's key, on the served repository: a setting no run user's clone holds, its value shown in no answer, log or page."
    },
    {
      "file": "src/ocx/commands/stated.cr",
      "layer": "workspace",
      "purpose": "The one rule for every way an agent's work reaches the server: a check-in's comment stated as precept C3 asks, each part one line that says something, and what a comment lacks; the branch no agent's check-in lands on; and, where OCX commits, every change, new files included, once each test has passed since the last edit."
    },
    {
      "file": "src/ocx/commands/sync.cr",
      "layer": "workspace",
      "purpose": "Sync an agent's own clone with the server through the call, for an agent that keeps no login key: read its bundle, refuse a check-in off its working branch or unstated, import and push the rest as the run's user, and answer a bundle of what it asks back."
    },
    {
      "file": "src/ocx/commands/commit_and_sync.cr",
      "layer": "workspace",
      "purpose": "Guide an agent through saving its own clone's work for sync, a stated message filled from what it gives and each step a command for its own shell; and, where the agent's files are, take those steps: commit on its working branch and answer the branch's bundle, doing nothing when called remotely."
    },
    {
      "file": "src/ocx/checkout_files.cr",
      "layer": "protocol",
      "purpose": "Name a checkout's files by their paths from its root, never outside it; read its text; find the tests its project names; and record which passed with the checkout as it is."
    },
    {
      "file": "src/ocx/commands/reading.cr",
      "layer": "protocol",
      "purpose": "Offer reading a run's checkout as tools: context, what the run is and where its work stands; find, a text's lines; read, a file's lines exactly."
    },
    {
      "file": "src/ocx/commands/editing.cr",
      "layer": "protocol",
      "purpose": "Offer changing a run's checkout as tools: edit, a text replaced where it appears once; test, one of the project's tests run and recorded."
    },
    {
      "file": "src/ocx/commands/saving.cr",
      "layer": "protocol",
      "purpose": "Offer saving a run's checkout as a tool: save, every change committed on the working branch once each test has passed, and pushed as the run's user."
    },
    {
      "file": "src/ocx/commands/sharing.cr",
      "layer": "protocol",
      "purpose": "Offer a run's clone's wiki as tools: wiki_read, a page and its version, the clone pulled first, refusing a pull that does not reach the server; wiki_edit, a page changed as edit changes a file, old copied exactly and appearing once, or added to the page's end."
    },
    {
      "file": "src/ocx/commands/unversioned.cr",
      "layer": "protocol",
      "purpose": "Offer a run's clone's unversioned files as tools: unversioned_list, unversioned_get and unversioned_put, for sharing binaries."
    },
    {
      "file": "src/ocx/fossil/unversioned.cr",
      "layer": "fossil",
      "purpose": "Read and keep Fossil's unversioned files on a place, and sync them with its remote."
    },
    {
      "file": "src/ocx/fossil/scratch.cr",
      "layer": "fossil",
      "purpose": "Make a scratch project's repository, set the user a checkout acts as, and read its branches and a file at a check-in, as the battery does."
    },
    {
      "file": "src/ocx/commands/run.cr",
      "layer": "workspace",
      "purpose": "Start a manual run on the agent machine using its clone and matching project password file: refuse a clone with no completed pull, find the run only through that completion number, log sign-in as the entry's node and check the node, clone and manual flag. Decide under the node's lock, using receipts and local care at the same complete pull, refusing a waiting or settled run and respecting its durable done state. Log handing it to ROOT/current/ocx2 watch with its run, server and credentials as bare words and --by-hand; a dry run performs reads and lists the hand without starting a watcher."
    },
    {
      "file": "src/ocx/commands/stop.cr",
      "layer": "workspace",
      "purpose": "Write a stop for a run as the caller on the served repository, where the run is: a reply to its post, or a change to its ticket."
    },
    {
      "file": "src/ocx/commands/attach.cr",
      "layer": "workspace",
      "purpose": "Join a person's terminal, at the node's host, to the terminal of a run's process, found by a prefix of the run's hash in the node's directory: they see what it shows and type into it until they press Ctrl-], leaving it running; offered on the command line alone, to the account the node runs as, whose alone the socket is."
    },
    {
      "file": "src/ocx/commands/audit.cr",
      "layer": "protocol",
      "purpose": "Record a verdict on a check-in as an audited tag by the caller, never its author, from a clone and pushed or on the served repository, and read it back as the served repository holds it; and list the check-ins that change files and that no verdict that counts has judged, by the reading rules, in the server's order, from a clone asking the server's own unaudited tool."
    },
    {
      "file": "src/ocx/messages.cr",
      "layer": "protocol",
      "purpose": "Read and write protocol v1's OCX messages: find the one an artifact's text holds, its fences paired as CommonMark pairs them, and the text as a person reads it, each message's block left out; read it into the struct of its kind, a run first refused, naming the field, for any text in it, a key among them, that is not UTF-8 or holds a NUL once its escapes are decoded, for `create` and the node alike; write a message, or an object's members, as a fenced block; and the value of the ocx-message tag on an artifact holding one."
    },
    {
      "file": "src/ocx/messages/run.cr",
      "layer": "protocol",
      "purpose": "Hold a run's layers as protocol v1, sections 5 to 8, defines them: its workspace steps, a directory step's remove among them, its sandbox with every field required, its limits and its process, ends among its keys; and check what a run's own text decides, refusing with the note its ended carries."
    },
    {
      "file": "src/ocx/steps.cr",
      "layer": "protocol",
      "purpose": "Fill a run's $$name$$ values, and check its workspace steps against the table of step kinds when it arrives, before any step: what each needs before it, the values it sets, and where its paths may lie; and that its sandbox paths keep apart from the node's own files."
    },
    {
      "file": "src/ocx/launch.cr",
      "layer": "workspace",
      "purpose": "Perform a run's or a task's layers as tables: each workspace step's act, each sandbox field as bubblewrap's arguments in the protocol's order, workspace_at binding the workspace at one path every run sees it at, with each value within it read as the process sees it, each limit as what enforces it, the secrets its env names, the program found on the right PATH, a plan run to its end, its process given to a task's watch once started, its input or output a pipe's end closed once it has started, and the kept logs as a post."
    },
    {
      "file": "src/ocx/acting/view.cr",
      "layer": "protocol",
      "purpose": "Hold every protocol message through a completed pull, independent of message tags, with each sender and receipt order confirmed by the server. Retain the concrete server and host types so only a view holding a Writer can post or supply passwords. Served pages need no host and read only the record's runs and reports for every node user an administrator's run names, including runs addressed to another clone. A daemon or watcher supplies its host to read care, workspace steps and faults, protected files and the values set before a run's first step. Plan each workspace before reserving it under the node's lock, and turn each run and its authorized stops and reports into the situation the single decision table reads."
    },
    {
      "file": "src/ocx/acting/sharing.cr",
      "layer": "workspace",
      "purpose": "Write what a build left, as the node: its ci verdict on the check-in it took, and the files its run names, shared as unversioned files of the server, saying what was shared and what was not."
    },
    {
      "file": "src/ocx/decisions.cr",
      "layer": "protocol",
      "purpose": "Decide what a node does next about one run, from what it knows and with no Fossil in it: wait, refuse with a note, answer it stopped or lost, start it, end its program for a stop, or nothing; protocol v1's rules with version 2's removal of the works-for and password refusals and the wait per process user, as one function its failure cases test."
    },
    {
      "file": "src/ocx/bounds.cr",
      "layer": "protocol",
      "purpose": "Keep a run from a user holding R alone from reaching past itself: require a sandbox ending with its parent, no path holding .., directory paths ending in the run's hash and shares named for it."
    },
    {
      "file": "src/ocx/exchange.cr",
      "layer": "protocol",
      "purpose": "Ask a server over HTTP and have its answer in full within ten seconds, however it spreads what it sends, or refuse; each of OCX's asks of a server goes through it."
    },
    {
      "file": "src/ocx/server.cr",
      "layer": "protocol",
      "purpose": "Read the server's account of artifact senders, their capabilities and receipt order, its public URL and project, and its receipt and unaudited answers to unsigned readers. Here reads the served repository for status and audit, with no node and no write operations. Writer carries posting, run passwords, verdict publication and shares by its type. Asked signs in through Fossil's login page with credentials only its owner may read, supplies explicitly kept run passwords, and batches receipt queries as bounded POSTs over HTTPS or loopback HTTP. It confirms a verdict's --once push by the server's receipt and syncs shares to ocx-server, refusing failed publication without changing the default remote."
    },
    {
      "file": "src/ocx/acting.cr",
      "layer": "protocol",
      "purpose": "Provide protocol v1's decisions, reports and session deliveries on the node's clone, as its daemon and each watcher read them. Own ROOT/state and its private mode. Decide a run at a complete pull using the single decision table, its server-confirmed sender, local care and run isolation rules. Identify stops and started or ended reports where their run is, counting reports only when the receipt names the node user and the named clone matches; an ended from before the daemon settles a run without a state file. Write held-back replies through the view's Writer, naming only the run holding a post back. Order posts, ticket changes and check-ins for sessions, apply section 9's filters and describe the first filter that held a person's post back; never deliver another node's messages or a run user's own posts."
    },
    {
      "file": "src/ocx/care.cr",
      "layer": "protocol",
      "purpose": "Keep the node's care of runs as locks beneath its directory: a lock for decisions, each run's lock naming the watcher, host boot and launched programs, and the one held by a run from a user holding R alone. Take or try care only under the node's lock, preserving the lock's process words when another watcher owns it; name inboxes, terminals and workspace notes beside it. End what a gone watcher left in the boot and process starts its lock names: its program's and watcher's groups, the groups of their sessions and the sandboxes they started, never the checking process's own group. Read a cared-for run's descendant processes from /proc, including children of each thread, tolerating processes that disappear during the read."
    },
    {
      "file": "src/ocx/served.cr",
      "layer": "protocol",
      "purpose": "Resolve what a tool names in the served repository or an explicit node clone: a ticket or forum thread by a hash prefix, a reply's post from its artifact, or a run with the node and clone it names. Refuse ambiguous, absent or malformed names. Read a node clone's published completion before acting and bound its run lookup to that complete pull; served tools may read the whole record. Read Fossil's export hook and server-code through named Fossil operations, without installing a node or manufacturing host state."
    },
    {
      "file": "src/ocx/writes.cr",
      "layer": "protocol",
      "purpose": "Write a tool's caller's text where its forum post or ticket change belongs: a ticket comment in the caller's clone followed by a push, or directly on the served repository. Compose and store each write through named Fossil operations and return the written artifact, including a push refusal that identifies what remains in the clone. Creating a run or stop writes only its request; the server's chat event wakes the daemon and no write schedules a server node or invokes a hook."
    },
    {
      "file": "src/ocx/watcher.cr",
      "layer": "workspace",
      "purpose": "Hand each chosen run to ROOT/current/ocx2 watch with its clone, server and credentials, resolving the release for each start. Watch one run only at completed pulls, holding its run lock and, for a run from a user holding R alone, the node's one such lock. Decide again and reserve its workspace under the node lock before preparing workspace steps and posting started, then run its process in the requested sandbox and limits, with its run and session deliveries on standard input or its terminal. Always start that watcher's own Giving at completion numbers; unknown posts retry there under only the run lock. Keep logs, verdicts and shares, end everything the process left, and write the held ended only once before marking done. Read taken, ending and done states: the next watcher taking the free run lock ends what the old lock names and posts lost for taken, retries the exact ended for ending, and does nothing for done, respond to TERM, and leave a waiting run without state for a later daemon round; never hand on another run itself."
    },
    {
      "file": "src/ocx/terminal.cr",
      "layer": "workspace",
      "purpose": "Hold a terminal for a run's process: a fresh pseudo-terminal, its far end the process's standard input and output and the controlling terminal of the session the process starts in, and a pipe of its own for its standard error, copied to what the terminal shows; type the process's lines in, each ended by Enter, and an end of input where its input closes, each typed alone, as src/ocx/terminal/typed.cr types it; keep what the terminal showed, as text, for the kept logs; let a person at the node's host join it through a socket in the node's directory, one at a time, at their window's size, which Linux tells its program by a signal, never waiting on them; and join a person's own terminal to such a socket, raw, until they press Ctrl-] or the process ends."
    },
    {
      "file": "src/ocx/terminal/typed.cr",
      "layer": "workspace",
      "purpose": "Type into a terminal's near end, the node's lines and a joined person's keys: each written whole, waiting while the terminal is full, raising once its far end hangs up or it is let go; and type keys alone, once the program on it has read all typed before them, as its far end, opened through the near end, says, woken at each of its reads, or once a bound has passed, so a program reading keys as they come reads a line's Enter by itself, never a program reading lines waited on."
    },
    {
      "file": "src/ocx/relay.cr",
      "layer": "workspace",
      "purpose": "Relay a session's deliveries from its inbox to its program's standard input, or to the watcher that types them on its terminal, in order, holding up to a bound of what the program has not taken, past which it reads the inbox no more, so the watcher, which never waits on a session, gives it nothing more."
    },
    {
      "file": "src/ocx/stopping.cr",
      "layer": "workspace",
      "purpose": "Hold what a watcher's TERM asks: before its program is launched, that it never is; after, that it ends, with the process groups of the session it leads; end what the program left once it has ended, in those groups and in a sandbox bubblewrap left, as each child of the watcher ends; wait until the program and all it left have ended, before the run's ended is written, and then forget it; and name the program in its run's lock as it is launched, with its start."
    },
    {
      "file": "src/ocx/commands/post.cr",
      "layer": "protocol",
      "purpose": "Write a plain post as the caller: a reply in the thread of the post replied to, or a change to a ticket, from a clone's checkout put in the clone and pushed, on the served repository made there; refusing text that holds an OCX message; given a user, the text written as a question for that user, each reference resolved to a link from the repository's root to the one thing it names, which the server must have received, and linked by its title, refused when it would ask no one, when its decision could wait for a moderator in a thread or in a ticket's pages, or when the user asked may not read and edit, or a moderator would hold their edits of, a wiki page it references; given a run too, the caller's own, signing in as them, its hash in full written as the run whose process asks it; given decision, the caller's decision, whoever they are, for the question named, where it is, an option's number written as its words, from its sender, or from whoever sent the run it names as asking it, when that run counts, closing it, but for the first decision of the user asked, refused to a question closed already, by the server's receipts from a clone; and refusing any question or decision whose text would not read back as it."
    },
    {
      "file": "src/ocx/question.cr",
      "layer": "protocol",
      "purpose": "A question and its decision (precept C4; protocol v1's questions): the OCX messages question and decision, typed and read leniently, a question naming the run whose process asks it when one does, a question's options numbered, a question refused when it would ask no one: naming no user, saying nothing, offering one choice, more than four or one twice, or past its bounds or holding a hash or a link in its words; a decision refused when it names no question in full or has no note; each found in a post's text, and written as readable Markdown, each reference linked by its title, and its block."
    },
    {
      "file": "src/ocx/questions.cr",
      "layer": "protocol",
      "purpose": "Read the questions as the record holds them: of every post and ticket change the ocx-message tag was ever put on, whatever its value, cancelled or not, read in one query, each message saying what it is, pair each question with its decisions that count, from anyone where it is, up to the first that confirms it, from its sender or the sender of the run it names as asking it, when that run counts: its user the question's sender, signing in as them, received with its started from the login it names as its node before the question; describe the links a person is shown, and title the hashes the notes hold. questions answers them as data, and post reads them to write a decision."
    },
    {
      "file": "src/ocx/commands/thread.cr",
      "layer": "protocol",
      "purpose": "Read a thread or a ticket, named by any of its posts or changes, as the caller may: each post or change in the order the server received them, with the user it received it from, when it was written and its text, at most 20, after a given post; from a clone's checkout, pulled first, each sender as the server's receipt tool says. It writes nothing."
    },
    {
      "file": "src/ocx/commands/tag_messages.cr",
      "layer": "protocol",
      "purpose": "Backfill missing or wrong ocx-message tags as the caller in one control artifact; pull first and push afterwards from a checkout, without deciding any run."
    },
    {
      "file": "src/ocx/commands/hook.cr",
      "layer": "console",
      "purpose": "Install or remove Fossil's own git export as the after-receive hook, replacing old ocx2-hook commands and leaving other hooks alone; read its standing back."
    },
    {
      "file": "src/ocx/commands/receipt.cr",
      "layer": "protocol",
      "purpose": "Say of each artifact who the served repository received it from, that user's capabilities there, the receipt's number and the artifact's row number, or that it has not received it; or a user's capabilities, and whether the wiki edits they save, or the ticket changes they make in its pages, wait for a moderator. Never an address, nor anything of an artifact its caller may not read: protocol v1's receipt tool, which nodes and readers on clones ask."
    },
    {
      "file": "src/ocx/receipt_service.cr",
      "layer": "protocol",
      "purpose": "Ask the receipt service through the launcher's inherited connection, logging only the artifact count and user, reading a typed answer within ten seconds and one MiB, and refusing an answer of other artifacts or another user."
    },
    {
      "file": "src/ocx/commands/logins.cr",
      "layer": "protocol",
      "purpose": "Approve a login someone asked for, from the link it printed, by an admin's one press: make that user holding exactly the capabilities asked, never admin or setup, with a random password the served repository keeps apart from secrets; and give that password to whoever sends the code whose key the link gave, or to a signed-in login listed in its approval. For create, approve a kept process user's password for its node, setting a new random one only when admin or setup explicitly asks; serialize its read, reset and approval beside the repository and refuse an unknown password for an existing user on another host."
    },
    {
      "file": "src/ocx/commands/send_runs.cr",
      "layer": "protocol",
      "purpose": "Let a user of the served repository send runs, by an admin's one press or command: add R to the letters it holds of its own, or take R away, in one statement that leaves every other letter as it is then, refusing Fossil's own users, and answer what it may do then, as receipt reads it."
    },
    {
      "file": "src/ocx/commands/register.cr",
      "layer": "protocol",
      "purpose": "Ask for a login from the asker's own machine: make its code and keep it, print the link to approve it, ask the server's collect for its password with the code, and keep the password in place of the code."
    },
    {
      "file": "src/ocx/commands/export.cr",
      "layer": "console",
      "purpose": "Bring the served repository's git export up to date from the command line on its host or the web page, a failed export refused with what Fossil said, and say where the export stands; a dry run lists what awaits."
    },
    {
      "file": "src/ocx/commands/project.cr",
      "layer": "console",
      "purpose": "Make an empty or git-backed repository beside the served one, ready its hook, tickets, node and run users, and answer from the page detached."
    },
    {
      "file": "src/ocx/commands/project_operations.cr",
      "layer": "console",
      "purpose": "The typed steps for making and readying a project, including the sandboxed git path, empty Fossil path, private credentials and daemon entry."
    },
    {
      "file": "src/ocx/projects.cr",
      "layer": "console",
      "purpose": "Keep projects under way, discard what a failed one left, and report their status."
    },
    {
      "file": "src/ocx/projects_detached.cr",
      "layer": "console",
      "purpose": "Run a web page project request detached and log its outcome."
    },
    {
      "file": "src/ocx/fossil/pulls.cr",
      "layer": "fossil",
      "purpose": "Pull a clone completely through a named remote within a bound, and read its receipt intervals; push verdicts and sync shares without changing its default remote."
    },
    {
      "file": "src/ocx/server/pages.cr",
      "layer": "protocol",
      "purpose": "Wake on Fossil chat messages and post reports through Fossil's forum and ticket pages as the node user."
    },
    {
      "file": "src/ocx/completion.cr",
      "layer": "workspace",
      "purpose": "Publish a clone's completion number by rename and notify its watchers through inotify."
    },
    {
      "file": "src/ocx/daemon.cr",
      "layer": "workspace",
      "purpose": "Pull each node clone whole, decide its open runs and hand watchers once per machine, under the host service manager."
    },
    {
      "file": "src/ocx/commands/daemon.cr",
      "layer": "protocol",
      "purpose": "Set up the approved node clones and run the machine's daemon from its command line."
    },
    {
      "file": "src/ocx/watcher/state.cr",
      "layer": "workspace",
      "purpose": "Keep each run's taken, ending or done state by durable rename under its lock and let the next watcher read it without launching the run twice."
    },
    {
      "file": "src/ocx/watcher/giving.cr",
      "layer": "workspace",
      "purpose": "Give a clone session each delivery after its run once in server order on completed pulls, retrying unknown check-in receipts from the run, skipping lines with no inbox room, and stop it for an authorized stop."
    },
    {
      "file": "src/ocx/watcher/reports.cr",
      "layer": "workspace",
      "purpose": "Post a watcher's reports under its run lock, retrying on completed pulls and checking the server's receipt before repeating a post."
    },
    {
      "file": "src/ocx/watcher/process.cr",
      "layer": "workspace",
      "purpose": "Launch and wait for a run's process and keep its logs and ending, including sessions that launch once per delivery."
    },
    {
      "file": "src/ocx/commands/watch.cr",
      "layer": "workspace",
      "purpose": "Watch one run on the node's clone, reached from the command line with an explicit server and credentials, answering its reports through Fossil's pages."
    },
    {
      "file": "src/ocx/fossil/cards.cr",
      "layer": "fossil",
      "purpose": "Read selected indexed columns for cards from Fossil repositories, yielding no items when an optional table or ticket column is absent."
    },
    {
      "file": "src/ocx/commands/cards.cr",
      "layer": "console",
      "purpose": "Read card definitions from wiki pages and answer one card or summarize all cards across named repositories, without writing."
    },
    {
      "file": "src/ocx/publication.cr",
      "layer": "workspace",
      "purpose": "Keep and repeat completed run publications under the run lock."
    },
    {
      "file": "src/ocx/commands/create_destination.cr",
      "layer": "protocol",
      "purpose": "Resolve create's destination and prepare its write before any process account is made, reset or approved."
    },
    {
      "file": "src/ocx/history.cr",
      "layer": "protocol",
      "purpose": "Read version 1 evidence only for recorded verdicts and questions, including their runs and starts, without admitting it to actors."
    },
    {
      "file": "src/ocx/commands/release_read.cr",
      "layer": "release",
      "purpose": "Read accepted release inventories and listed file bytes for signed-in setup logins and owner-listed builders, without writing."
    }
  ]
}