Security model, files and peer tasks: what the 2026-08-30 review found and fixed
Four repairs to the pages, all from measurements rather than restatement:
- the wrapped-row scrub was documented as an accepted ceiling; it was measured and is
the MAJORITY case ((L-1)/W, so 79% for the 64-hex key at 80 columns, certain below
64), and it is closed in 0.22.1. The remaining case is an escape sequence inside the
value.
- the free-text answer is raw keyboard access and now says what that meant: it was the
one participant text that skipped stripControl, so a CR submitted claude's field and
typed the rest as a second, unattributed prompt. Plus the adversarial input set the
relay was actually driven with.
- jam-uploads/ confinement is a NAME filter, and a name filter cannot see a
filesystem: a dangling symlink carried an upload out of the directory until the write
became exclusive. And the quota is counted at grant time now, not only at write time.
- the peer result's agent-facing copy is fenced, and a result could close that fence.
Also: a result's text never reaches /peers log at all.
Plus what the invite blob is worth (nothing — every field is re-checked server-side on
every use, driven), what its address list is and is not, and the one thing a stranger
can learn pre-approval: the roster, name by name, in knock or token mode.
Files and Export: which renames sanitizing actually does
Names the four rules a sender can see happen to their file — the charset
filter, the leading dot, the length cut, and (new) trailing dots plus the
Windows device names, which are not files at all on Windows.
Pairs with claude-jam cf7118b (campaign F5).
wiki: sounds, nudges, and the upload policy that only removes the prompt
- Files-and-Export: the three upload policies in a table, the list of
protections that do NOT move with them (and the note that smoke-nudge proves
each one still refuses while the policy is auto), the 40-file/200 MB session
quota and why the fallback line exists, and export's own separate toggle.
- Hosting-a-Jam: the four new flags in the flag table; a 'Hearing what needs
you' section with the two arrival sounds, why they differ, the once-only
knock repeat, and the three toggles.
- Joining-a-Jam: /ping and /sound in the command table, and a full section on
nudges — what the addressee sees, what the room sees, why it is never queued,
the rate limit, the once-only escalation, what idle actually reports, and the
opt-in phone config with the topic warning.
- Security-Model: a new section, 'The ntfy topic stays on your machine' — the
topic is a bearer credential, it lives only in the recipient's config, their
own client posts it, and it is never in a frame, an invite link, the
protocol or a log. Plus three new entries under 'What to assume': the upload
policy is a prompt setting and not a protection, export is separate and stays
ask, and a nudge is deliberately not on the approval ladder.
wiki: the ten pages — install, agent-install, hosting, joining, remote, files, security, architecture, troubleshooting
Written against what actually shipped (README/MANUAL/SPEC 'what shipped' notes and
the real flags in the source). Everything specced but not built — LAN discovery,
sounds, nudges, upload auto-allow, guest scrollback, peer tasks, Windows — is listed
on Home under 'Not built yet' and described nowhere else.
Agent-Install is the page another person's agent is pointed at: the never-do list
first, then numbered non-interactive commands with a verification after each, the
steps that need a human called out, and a self-test whose expected output was
recorded from a real run on 2026-08-29.