v1.8.1 — agent peer identity + the identity map at admission
v1.8.0 shipped the canonical user peer: one deploy-time input naming the human principal. That answers "who is the human." It does not answer "which peers are legitimate agents" — so an unexpected-peer check could only say not the human, which is true of every legitimate agent self-lesson and therefore useless.
v1.8.1 adds the agent half of that expected set, plus the identity map that folds known strays into the canonical identity as they arrive.
What's new
Two optional deploy-time inputs. Both default to empty, and empty behaves exactly as before:
| Input | Meaning |
|---|---|
HONCHO_AGENT_PEER_IDS |
Comma-separated agent slugs that are legitimate peers alongside the canonical user |
HONCHO_PEER_ALIASES |
Comma-separated alias=canonical pairs (e.g. operator=user), applied at /admit |
At the governor's admission choke point, observer / observed / created_by_peer are each resolved through the alias map and classified canonical_user / known_agent / unexpected / undeclared_roster. Aliases are rewritten before anything reads the peers, so an alias never reaches storage, the dedup lookup, or a downstream event payload. Anything rewritten or unexpected emits a memory_identity event on the agent_events spine.
This is item 1 of the production backstop described in memory-system.md §18. Item 2, the periodic re-consolidation sweep, remains designed and unimplemented.
Three deliberate choices
- Report, never reject. An unexpected peer is a config smell, not an attack. Refusing the write loses the memory while the misconfiguration that produced it is still in place.
- Permissive when undeclared. No roster set means nothing is called a stray — an alert that fires on every write is an alert nobody reads.
- Fail open on bad config. A malformed alias pair is skipped rather than fatal; this runs at the write choke point. Alias resolution is one hop, so a cyclic config (
a=b,b=a) terminates instead of hanging admission.
Agent self-lessons stay exempt from the canonical-user rule and are now provably so: a declared agent observing itself classifies as known_agent and emits nothing.
Upgrading
No migrations, no behavior change on default settings. The memory-governor is off by default (memory_governor_enabled), so a default deployment is unaffected either way.
Discover the peers your deployment actually holds with pc-honcho list-peers before declaring a roster — it should describe what is really there, not what you intended.
Verification
16 new offline tests (tests/memory-governor/test_agent_identity.py); full governor suite 229 passed; 24/24 CI checks green including local-stack-smoke.
Full notes: docs/releases/v1.8.1.md