Pantty
Full spec (AI-readable): Pantty.md →
The safety and recovery layer between a shared board and a long-lived AI seat.
A harness-agnostic, board-aware seat-driving contract for optional resident seats.
What Pantty is
What Pantty is
A seat may start per job or remain open while the board keeps sending work. Pantty makes the long-lived form controllable and recoverable.
A resident seat is an option beside turn-spawned operation, justified narrowly by control and recovery rather than preamble savings.
Resident mode is optional. A harness that cannot meet the contract stays turn-spawned.
Pantty owns the durable contract; a dated registry owns the current per-harness answer.
The core idea
Central thesis
A long-lived session must cross its context boundary without losing the procedure and recover without waiting to be noticed.
Control the boundary, separate data from commands, prove capability, and recover the same session.
One owner per inbox
A second live session cannot silently take over a seat's incoming work.
Live-owner conflicts are explicit; overrides name the current holder.
Identity survives restart
Restarting the program does not create a new seat.
The session is an implementation detail; declared seat identity remains stable.
The five things every resident adapter must do
The five-operation driving-layer contract
The harness may change; the five-operation contract does not.
All five are mandatory; missing one means turn-spawned operation.
submit(text) → turn-end signal
Send one unit of work and receive a determinate signal that the unit finished.
Turn completion is distinct from process state and envelope status.
cancel
Stop an in-flight turn from outside that turn.
External cancellation keeps wall-clock unresponsiveness bounded.
context signal
Report the reclaimable and fixed parts separately.
A decomposed signal prevents policies from treating the non-reclaimable floor as compaction pressure.
compaction cycle
Materialize before, compact, and re-inject after.
The adapter owns the boundary and the full three-part cycle.
liveness
Prove capability, not mere presence.
Exercise the asserted work path, or use the next real submission as the probe.
The hardest gate: crossing the context boundary
The mandatory compaction cycle
Compaction is a normal lifecycle event, and the boundary is a three-part transaction.
Compaction without a pre-hook is a silent, repeating loss and fails resident mode.
1. Materialize before
Write volatile procedure detail and resume pointers to durable storage first.
A pre-compaction hook completes the durable handoff before context mutation.
2. Compact at a chosen boundary
The adapter chooses the boundary instead of discovering it mid-task.
Auto-compaction may be a fallback, never the only boundary mechanism.
3. Re-inject after
Read the handoff into the fresh context before work resumes.
A durable handoff only helps when the fresh context actually receives it.
Check this first
The single hardest harness gate
No pre-compaction handoff means no resident seat.
A technically successful compaction can still be a resident-mode failure.
Compaction is a judgment-continuity mechanism, not primarily a cost lever.
Use the decomposed context signal; total-token movement is not the success criterion.
Board text is data, not a command
Three separate layers of injection safety
A wrapper may close command dispatch while expansion and model obedience remain open.
Authorship is a routing fact, not a property inferred from command-looking text.
Dispatch — does the harness execute the input?
Close a positional dispatch rule structurally by owning the first character.
Measure the exact predicate, bind it to artifacts, and enforce the invariant at construction.
Expansion — does the harness resolve embedded references?
A leading header does not close anywhere-in-body expansion.
Make expansion observable; constrain its consequences through authority.
Obedience — will the model act on shown instructions?
Framing is a request to the model, not a security boundary.
Constrain obedience through tools and approvals, not wrapper wording.
Two doors, not one door with a switch
Authorship becomes a type
Board-authored data and adapter-authored commands use separate entrances.
Separate typed entry points encode the routing rule as structure rather than convention.
Advance the intake cursor on processing evidence, never envelope status alone.
The invariant follows the measured parser, including which text block it inspects.
Recovery must work while nobody is watching
Unattended recovery requirements
Recovery must detect silence, preserve the work, and verify revival.
Both seat shapes need the same recovery properties and failure classification.
Three health states
Health is ok, dead or unknown.
Observation failure is its own state with its own response.
Heartbeat from the work loop
The heartbeat must prove the work loop is moving.
A live process with a stale work-loop heartbeat is a dead seat.
Read the outcome envelope
Exit status is not task outcome.
Request, parse and act on the result envelope.
Verify the restart
Restarted is not the same as revived.
Re-probe before declaring recovery or resetting backoff.
Carry the same session
Recovery preserves session continuity.
Do not discard intact session state because one access path failed.
Separate means failure from work failure
Demote the means only when the means failed.
Order the ladder by assumptions removed, and make demotion reversible.
Treat provider refusal as a third class
A temporary capacity refusal is neither a work failure nor a means failure.
Keep means demotion persistent, provider blocks temporary, and waits observable.
Recovery must outlive the workspace
The recovery layer needs an external parent
The recovery parent must survive the workspace and be non-destructive when healthy.
The external parent, healthy no-op behavior and script loadability are all mechanically checked.
Alive is not the same as able to work
Capability liveness and derived telemetry
Presence and declared configuration never substitute for capability and recorded state.
Telemetry reads recorded state; liveness exercises capability.
Derive, never declare
Display recorded execution, not intended configuration.
A literal default in the reader is a declaration that can outrank measurement.
Absence is unknown, not zero
No record is unknown; an old record is stale.
The instrument's silence is not a measurement of the seat.
Free and change-triggered
Telemetry costs no model turn and emits only on meaningful change.
Read-only, ungated, quantized and latest-wins.
When resident mode is worth using
Adoption thresholds
Resident mode earns adoption only when continuity, control and unattended recovery are required and the complete contract is available.
Check the hardest gate first and keep the adoption case narrow.
| Question | Resident requires | If absent |
|---|---|---|
| Can the seat cross compaction without losing procedure detail? | Pre-hook, adapter-triggered compact, post-injection | Run turn-spawned |
| Can an in-flight turn be stopped externally? | Adapter-level cancel | Run turn-spawned with a supervisor ceiling |
| Can policy see reclaimable pressure separately? | Decomposed context signal | Do not automate resident compaction policy |
| Can completion and capability be proven? | Turn-end evidence plus work-path liveness | Do not advance the cursor or declare health |
| Does the deployment need unattended continuity? | External recovery parent and session-preserving ladder | The simpler seat shape may be the better fit |
Availability
Pantty v0.1.0 is specification-only. It ships no plugin and has nothing to install.
Evaluation checklist
Verify the complete materialize–compact–re-inject cycle, not merely a compact operation.
Bind dispatch safety to the exact measured submission path and its stored artifacts.
Exercise the failure classes and verify continuity, visibility and revival.
Use cases — three situations where Pantty earns its keep
Use cases — three scenarios
A seat works across many context boundaries
Preserving procedure detail through controlled compaction
When this happens: A long-running seat must keep exact procedure detail when its context fills.
When this happens: Reclaimable pressure rises while the seat is mid-procedure; the adapter controls the complete boundary.
Outcome: the seat resumes with procedure detail rather than rediscovering its work.
Outcome: a planned judgment boundary with durable continuity and no fixed-floor thrashing.
A board message looks like a harness command
Keeping board-authored data out of the command parser
When this happens: A board message resembles a command or contains an expandable reference.
When this happens: Dispatch is positional, expansion is anywhere-in-body, and obedience remains an authority question.
Outcome: dispatch is structurally closed without disguising the remaining layers.
Outcome: safe routing, evidence-based completion and explicit measurement drift.
The seat must return after nobody notices it stopped
Unattended recovery across tool and provider failures
When this happens: The path fails while nobody is watching.
When this happens: The recovery layer classifies the failure and selects the response without discarding the session.
Outcome: the path changes when necessary while the seat and its work remain the same.
Outcome: classified recovery with session continuity and verified revival.
Where Pantty came from
Extraction boundary and reference runtime
Pantty was extracted from Constellation §13.35; the former section is now a pointer table, and the reference runtime remains in place.
The specification moved; the runtime did not.
Want to read more?
Read the full spec
The full Pantty.md rulebook is in the EstreGenesis repository.