diff --git a/.env.example b/.env.example
index ddfbef9c2..f6299fb56 100644
--- a/.env.example
+++ b/.env.example
@@ -1,10 +1,10 @@
-# rho daemon environment variables — copy to .env and fill in.
-# Only RHO_DAEMON_API_KEY is consumed from the environment.
-RHO_DAEMON_API_KEY=
+# decoder daemon environment variables — copy to .env and fill in.
+# Only DECODER_DAEMON_API_KEY is consumed from the environment.
+DECODER_DAEMON_API_KEY=
-# The following are NOT read by rho — setting them has no effect:
-# RHO_DAEMON_PORT / RHO_DAEMON_HOST — daemon binds 127.0.0.1:4590;
-# override with the --host / --port flags (see `rho daemon start --help`)
-# FLUX_API_KEY / FLUX_BASE_URL, HARRIER_API_KEY / HARRIER_ADDR —
+# The following are NOT read by decoder — setting them has no effect:
+# DECODER_DAEMON_PORT / DECODER_DAEMON_HOST — daemon binds 127.0.0.1:4590;
+# override with the --host / --port flags (see `decoder daemon start --help`)
+# MUX_API_KEY / MUX_BASE_URL, HARRIER_API_KEY / HARRIER_ADDR —
# consumed by sibling services, not by this binary
# See docs/user-guide/05-configuration.md for the full precedence chain.
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ddef946bb..4b863a150 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,4 +1,4 @@
-# CODEOWNERS for rho
+# CODEOWNERS for decoder
#
# These owners will be the default owners for everything in the repo. Unless
# a later match takes precedence, they will be requested for review when
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index bf5955dd4..19eef71bf 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -11,7 +11,7 @@ body:
of the form as you can — the more we know, the faster we can fix it.
Before submitting:
- - Search [existing issues](https://github.com/GrayCodeAI/rho/issues) to avoid duplicates.
+ - Search [existing issues](https://github.com/GrayCodeAI/decoder/issues) to avoid duplicates.
- If this is a security issue, please **do not** file a public issue. See `SECURITY.md`.
- type: textarea
@@ -19,7 +19,7 @@ body:
attributes:
label: What happened?
description: A clear, concise description of the bug.
- placeholder: When I run `rho ...`, I expected X but got Y.
+ placeholder: When I run `decoder ...`, I expected X but got Y.
validations:
required: true
@@ -29,7 +29,7 @@ body:
label: Steps to reproduce
description: Minimal steps that reliably reproduce the problem.
placeholder: |
- 1. Run `rho ...`
+ 1. Run `decoder ...`
2. Type `...`
3. See error `...`
validations:
@@ -44,10 +44,10 @@ body:
required: true
- type: input
- id: rho-version
+ id: decoder-version
attributes:
- label: rho version
- description: Output of `rho version` (or `rho --version`).
+ label: decoder version
+ description: Output of `decoder version` (or `decoder --version`).
placeholder: "0.1.0"
validations:
required: true
@@ -66,7 +66,7 @@ body:
attributes:
label: Go version (if building from source)
description: Output of `go version`. Skip if you installed a pre-built binary.
- placeholder: "go version go1.26.1 darwin/arm64"
+ placeholder: "go version go1.27.2 darwin/arm64"
- type: textarea
id: logs
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index a6fdeb91e..132cd351d 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,8 +1,8 @@
blank_issues_enabled: false
contact_links:
- name: Security vulnerability
- url: https://github.com/GrayCodeAI/rho/security/advisories/new
+ url: https://github.com/GrayCodeAI/decoder/security/advisories/new
about: Please report security issues privately via a GitHub Security Advisory. See SECURITY.md.
- name: Question / discussion
- url: https://github.com/GrayCodeAI/rho/discussions
+ url: https://github.com/GrayCodeAI/decoder/discussions
about: Have a question or want to discuss an idea? Open a discussion instead of an issue.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
index 992f0f913..b0bad6f34 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.yml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -1,5 +1,5 @@
name: Feature request
-description: Suggest an improvement or new capability for rho.
+description: Suggest an improvement or new capability for decoder.
title: "feat: "
labels: ["enhancement", "triage"]
@@ -7,13 +7,13 @@ body:
- type: markdown
attributes:
value: |
- Thanks for proposing a feature. rho is built **for developers first**
+ Thanks for proposing a feature. decoder is built **for developers first**
(one machine, local config, keychain credentials) — teams and enterprise
come later. We evaluate every request against: _"would a single
developer on their own machine benefit from this?"_
Before submitting:
- - Search [existing issues](https://github.com/GrayCodeAI/rho/issues) to avoid duplicates.
+ - Search [existing issues](https://github.com/GrayCodeAI/decoder/issues) to avoid duplicates.
- For large changes, consider opening a discussion first.
- type: textarea
@@ -21,7 +21,7 @@ body:
attributes:
label: What problem are you trying to solve?
description: Describe the user problem first. Solutions can come later.
- placeholder: When I'm doing X, rho makes me do Y, which is painful because Z.
+ placeholder: When I'm doing X, decoder makes me do Y, which is painful because Z.
validations:
required: true
@@ -29,7 +29,7 @@ body:
id: proposal
attributes:
label: Proposed solution
- description: How would you like rho to behave? CLI flags, output, config, etc.
+ description: How would you like decoder to behave? CLI flags, output, config, etc.
validations:
required: true
@@ -55,7 +55,7 @@ body:
id: principles
attributes:
label: Developer fit
- description: rho avoids enterprise scope for now. Confirm this feature respects that.
+ description: decoder avoids enterprise scope for now. Confirm this feature respects that.
options:
- label: Works with zero configuration (sensible defaults).
- label: Works offline / does not require a cloud account.
diff --git a/.github/actions/checkout-flux/action.yml b/.github/actions/checkout-mux/action.yml
similarity index 96%
rename from .github/actions/checkout-flux/action.yml
rename to .github/actions/checkout-mux/action.yml
index 2b1fb2c56..d47124a95 100644
--- a/.github/actions/checkout-flux/action.yml
+++ b/.github/actions/checkout-mux/action.yml
@@ -1,5 +1,5 @@
name: Checkout ecosystem
-description: Clone graycode-eco sibling repos into the workspace parent for rho's go.work
+description: Clone graycode-eco sibling repos into the workspace parent for decoder's go.work
inputs:
ref:
@@ -24,7 +24,7 @@ runs:
# ecosystem migration; downstream guards skip absent checkouts too).
ws_parent="$(cd "${GITHUB_WORKSPACE}/.." && pwd)"
while IFS= read -r repo; do
- [ "$repo" = rho ] && continue
+ [ "$repo" = decoder ] && continue
dest="${ws_parent}/${repo}"
if [ -d "$dest/.git" ]; then
echo "$repo already present at $dest"
diff --git a/.github/actions/rho/action.yml b/.github/actions/decoder/action.yml
similarity index 58%
rename from .github/actions/rho/action.yml
rename to .github/actions/decoder/action.yml
index c43ebff01..ac70519a7 100644
--- a/.github/actions/rho/action.yml
+++ b/.github/actions/decoder/action.yml
@@ -1,7 +1,7 @@
-name: Rho
+name: Decoder
description: >-
- Run the Rho coding agent headlessly in a GitHub workflow. Rho is
+ Run the Decoder coding agent headlessly in a GitHub workflow. Decoder is
model- and provider-agnostic: you supply the provider and API key as inputs.
author: GrayCodeAI
@@ -12,7 +12,7 @@ branding:
inputs:
prompt:
- description: The instruction for Rho to execute. Mutually exclusive with prompt-file.
+ description: The instruction for Decoder to execute. Mutually exclusive with prompt-file.
required: false
default: ""
prompt-file:
@@ -29,20 +29,20 @@ inputs:
api-key:
description: >-
The provider API key. Pass it from a repository or organization secret;
- it is exported only for the Rho step and never written to the log.
+ it is exported only for the Decoder step and never written to the log.
required: false
default: ""
api-key-env:
description: >-
Name of the environment variable the chosen provider reads its key from
(for example OPENAI_API_KEY or ANTHROPIC_API_KEY). When set together with
- api-key, that variable is exported only for the Rho step. Leave the action
+ api-key, that variable is exported only for the Decoder step. Leave the action
provider-agnostic by passing the env name your provider expects rather than
hardcoding one here.
required: false
default: ""
model:
- description: Model id to use for the run. Passed to `rho exec --model`.
+ description: Model id to use for the run. Passed to `decoder exec --model`.
required: false
default: ""
auto:
@@ -54,19 +54,19 @@ inputs:
default: supervised
agent:
description: >-
- Agent persona to use (from Rho user state). Maps to `rho exec --agent`.
+ Agent persona to use (from Decoder user state). Maps to `decoder exec --agent`.
required: false
default: ""
cwd:
description: >-
- Working directory override. Maps to `rho exec --cwd`.
+ Working directory override. Maps to `decoder exec --cwd`.
Defaults to the action's working-directory input.
required: false
default: ""
ephemeral:
description: >-
When true, skip session persistence. Ideal for CI runs.
- Maps to `rho exec --ephemeral`.
+ Maps to `decoder exec --ephemeral`.
required: false
default: "false"
worktree:
@@ -80,7 +80,7 @@ inputs:
default: text
post-to:
description: >-
- Optional destination for a run summary after Rho finishes: `pr-comment`
+ Optional destination for a run summary after Decoder finishes: `pr-comment`
posts to the triggering pull request, `slack` posts to slack-webhook-url,
or `none` (default) posts nowhere.
required: false
@@ -93,35 +93,35 @@ inputs:
default: ""
github-token:
description: >-
- Token used to look up the latest Rho release and, when post-to is
+ Token used to look up the latest Decoder release and, when post-to is
pr-comment, to post the PR comment. Defaults to ${{ github.token }}.
required: false
default: ${{ github.token }}
working-directory:
- description: Directory to run Rho in. Defaults to ${{ github.workspace }}.
+ description: Directory to run Decoder in. Defaults to ${{ github.workspace }}.
required: false
default: ${{ github.workspace }}
- rho-version:
+ decoder-version:
description: >-
- Rho release to install (e.g. 0.3.0 or v0.3.0), or latest. Defaults to
- the release tag this action is pinned to (uses: ...@v0.3.0); a branch or
- commit-SHA pin installs the latest release. Requires Rho v0.3.0 or later:
- earlier tags predate the rename and have no rho_* archives.
+ Decoder release to install (e.g. X.Y.Z or vX.Y.Z), or latest. Defaults to
+ the release tag this action is pinned to (uses: ...@vX.Y.Z); a branch or
+ commit-SHA pin installs the latest release. Requires a release containing Decoder archives:
+ earlier tags predate the rename and have no decoder_* archives.
required: false
default: ""
- rho-repo:
+ decoder-repo:
description: >-
- Repository to install Rho from (owner/repo). The release archive's
+ Repository to install Decoder from (owner/repo). The release archive's
cosign signature must come from that repository's release workflow.
required: false
- default: GrayCodeAI/rho
+ default: GrayCodeAI/decoder
outputs:
exit-code:
- description: The exit code Rho returned (0 success, 2 usage, 3 provider, non-zero otherwise).
+ description: The exit code Decoder returned (0 success, 2 usage, 3 provider, non-zero otherwise).
value: ${{ steps.run.outputs.exit-code }}
output-file:
- description: Path to the captured Rho stdout (the raw output-format stream).
+ description: Path to the captured Decoder stdout (the raw output-format stream).
value: ${{ steps.run.outputs.output-file }}
summary:
description: A short human-readable summary line parsed from the run, when available.
@@ -131,16 +131,16 @@ runs:
using: composite
steps:
# cosign verifies the release signature; install.sh runs with
- # RHO_REQUIRE_COSIGN=1 so an unsigned or tampered release fails the step.
+ # DECODER_REQUIRE_COSIGN=1 so an unsigned or tampered release fails the step.
- name: Install cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
- - name: Install Rho
+ - name: Install Decoder
id: install
shell: bash
env:
- RHO_REPO: ${{ inputs.rho-repo }}
- RHO_VERSION_INPUT: ${{ inputs.rho-version }}
+ DECODER_REPO: ${{ inputs.decoder-repo }}
+ DECODER_VERSION_INPUT: ${{ inputs.decoder-version }}
ACTION_REF: ${{ github.action_ref }}
ACTION_PATH: ${{ github.action_path }}
GH_TOKEN: ${{ inputs.github-token }}
@@ -148,26 +148,26 @@ runs:
run: |
set -euo pipefail
if [ "${RUNNER_OS}" = "Windows" ]; then
- echo "::error::The Rho action currently supports Linux and macOS runners only." >&2
+ echo "::error::The Decoder action currently supports Linux and macOS runners only." >&2
exit 1
fi
- if ! [[ "${RHO_REPO}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
- echo "::error::rho-repo must look like owner/repo." >&2
+ if ! [[ "${DECODER_REPO}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+ echo "::error::decoder-repo must look like owner/repo." >&2
exit 2
fi
release_re='^v?[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'
# Resolve the version: explicit input wins; otherwise the release tag
# this action is pinned to; otherwise (branch or SHA pin) the latest
- # release of rho-repo.
- version="${RHO_VERSION_INPUT}"
+ # release of decoder-repo.
+ version="${DECODER_VERSION_INPUT}"
if [ -z "${version}" ] && [[ "${ACTION_REF}" =~ ${release_re} ]]; then
version="${ACTION_REF}"
fi
if [ -z "${version}" ] || [ "${version}" = "latest" ]; then
- version="$(gh release view --repo "${RHO_REPO}" --json tagName --jq .tagName)"
+ version="$(gh release view --repo "${DECODER_REPO}" --json tagName --jq .tagName)"
fi
if ! [[ "${version}" =~ ${release_re} ]]; then
- echo "::error::rho-version must be a release version such as 0.3.0, or 'latest'." >&2
+ echo "::error::decoder-version must be a release version such as 1.2.3, or 'latest'." >&2
exit 2
fi
version="${version#v}"
@@ -175,31 +175,31 @@ runs:
# release archive and checksums.txt, verifies the cosign signature
# (required here) and the SHA-256, and installs under the prefix.
installer="$(cd "${ACTION_PATH}/../../.." && pwd)/install.sh"
- prefix="${RUNNER_TEMP}/rho"
- RHO_INSTALL_REPO="${RHO_REPO}" RHO_REQUIRE_COSIGN=1 \
+ prefix="${RUNNER_TEMP}/decoder"
+ DECODER_INSTALL_REPO="${DECODER_REPO}" DECODER_REQUIRE_COSIGN=1 \
sh "${installer}" --version "${version}" --prefix "${prefix}"
echo "${prefix}/bin" >> "${GITHUB_PATH}"
- echo "Installed Rho ${version} from ${RHO_REPO}"
+ echo "Installed Decoder ${version} from ${DECODER_REPO}"
- - name: Run Rho
+ - name: Run Decoder
id: run
shell: bash
working-directory: ${{ inputs.working-directory }}
env:
# Secrets are passed via the environment and never echoed. `set +x` and
# the absence of any `echo` of these values keep them out of the log.
- RHO_INPUT_API_KEY: ${{ inputs.api-key }}
- RHO_INPUT_API_KEY_ENV: ${{ inputs.api-key-env }}
- RHO_INPUT_PROVIDER: ${{ inputs.provider }}
- RHO_INPUT_PROMPT: ${{ inputs.prompt }}
- RHO_INPUT_PROMPT_FILE: ${{ inputs.prompt-file }}
- RHO_INPUT_MODEL: ${{ inputs.model }}
- RHO_INPUT_AUTO: ${{ inputs.auto }}
- RHO_INPUT_AGENT: ${{ inputs.agent }}
- RHO_INPUT_CWD: ${{ inputs.cwd }}
- RHO_INPUT_EPHEMERAL: ${{ inputs.ephemeral }}
- RHO_INPUT_WORKTREE: ${{ inputs.worktree }}
- RHO_INPUT_OUTPUT_FORMAT: ${{ inputs.output-format }}
+ DECODER_INPUT_API_KEY: ${{ inputs.api-key }}
+ DECODER_INPUT_API_KEY_ENV: ${{ inputs.api-key-env }}
+ DECODER_INPUT_PROVIDER: ${{ inputs.provider }}
+ DECODER_INPUT_PROMPT: ${{ inputs.prompt }}
+ DECODER_INPUT_PROMPT_FILE: ${{ inputs.prompt-file }}
+ DECODER_INPUT_MODEL: ${{ inputs.model }}
+ DECODER_INPUT_AUTO: ${{ inputs.auto }}
+ DECODER_INPUT_AGENT: ${{ inputs.agent }}
+ DECODER_INPUT_CWD: ${{ inputs.cwd }}
+ DECODER_INPUT_EPHEMERAL: ${{ inputs.ephemeral }}
+ DECODER_INPUT_WORKTREE: ${{ inputs.worktree }}
+ DECODER_INPUT_OUTPUT_FORMAT: ${{ inputs.output-format }}
ACTION_PATH: ${{ github.action_path }}
RUNNER_TEMP: ${{ runner.temp }}
run: |
@@ -208,50 +208,50 @@ runs:
# Export the provider key under the env name the provider expects. This
# keeps the action provider-agnostic: no provider->env mapping is baked
# in. The value is never printed.
- if [ -n "${RHO_INPUT_API_KEY}" ] && [ -n "${RHO_INPUT_API_KEY_ENV}" ]; then
- if ! printf '%s' "${RHO_INPUT_API_KEY_ENV}" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
+ if [ -n "${DECODER_INPUT_API_KEY}" ] && [ -n "${DECODER_INPUT_API_KEY_ENV}" ]; then
+ if ! printf '%s' "${DECODER_INPUT_API_KEY_ENV}" | grep -qE '^[A-Za-z_][A-Za-z0-9_]*$'; then
echo "::error::api-key-env must be a valid environment variable name." >&2
exit 2
fi
- export "${RHO_INPUT_API_KEY_ENV}=${RHO_INPUT_API_KEY}"
+ export "${DECODER_INPUT_API_KEY_ENV}=${DECODER_INPUT_API_KEY}"
fi
- if [ -n "${RHO_INPUT_PROVIDER}" ]; then
- export RHO_PROVIDER="${RHO_INPUT_PROVIDER}"
+ if [ -n "${DECODER_INPUT_PROVIDER}" ]; then
+ export DECODER_PROVIDER="${DECODER_INPUT_PROVIDER}"
fi
args=(exec)
- if [ -n "${RHO_INPUT_PROMPT_FILE}" ] && [ -n "${RHO_INPUT_PROMPT}" ]; then
+ if [ -n "${DECODER_INPUT_PROMPT_FILE}" ] && [ -n "${DECODER_INPUT_PROMPT}" ]; then
echo "::error::The 'prompt' and 'prompt-file' inputs are mutually exclusive." >&2
exit 2
fi
- if [ -n "${RHO_INPUT_PROMPT_FILE}" ]; then
- args+=(--file "${RHO_INPUT_PROMPT_FILE}")
- elif [ -n "${RHO_INPUT_PROMPT}" ]; then
- args+=("${RHO_INPUT_PROMPT}")
+ if [ -n "${DECODER_INPUT_PROMPT_FILE}" ]; then
+ args+=(--file "${DECODER_INPUT_PROMPT_FILE}")
+ elif [ -n "${DECODER_INPUT_PROMPT}" ]; then
+ args+=("${DECODER_INPUT_PROMPT}")
else
echo "::error::Provide either the 'prompt' or 'prompt-file' input." >&2
exit 2
fi
- [ -n "${RHO_INPUT_MODEL}" ] && args+=(--model "${RHO_INPUT_MODEL}")
- [ -n "${RHO_INPUT_AUTO}" ] && args+=(--auto "${RHO_INPUT_AUTO}")
- [ -n "${RHO_INPUT_AGENT}" ] && args+=(--agent "${RHO_INPUT_AGENT}")
- [ -n "${RHO_INPUT_CWD}" ] && args+=(--cwd "${RHO_INPUT_CWD}")
- if [ "${RHO_INPUT_EPHEMERAL}" = "true" ]; then
+ [ -n "${DECODER_INPUT_MODEL}" ] && args+=(--model "${DECODER_INPUT_MODEL}")
+ [ -n "${DECODER_INPUT_AUTO}" ] && args+=(--auto "${DECODER_INPUT_AUTO}")
+ [ -n "${DECODER_INPUT_AGENT}" ] && args+=(--agent "${DECODER_INPUT_AGENT}")
+ [ -n "${DECODER_INPUT_CWD}" ] && args+=(--cwd "${DECODER_INPUT_CWD}")
+ if [ "${DECODER_INPUT_EPHEMERAL}" = "true" ]; then
args+=(--ephemeral)
fi
- if [ "${RHO_INPUT_WORKTREE}" = "true" ]; then
+ if [ "${DECODER_INPUT_WORKTREE}" = "true" ]; then
args+=(--worktree)
fi
- [ -n "${RHO_INPUT_OUTPUT_FORMAT}" ] && args+=(--output-format "${RHO_INPUT_OUTPUT_FORMAT}")
+ [ -n "${DECODER_INPUT_OUTPUT_FORMAT}" ] && args+=(--output-format "${DECODER_INPUT_OUTPUT_FORMAT}")
- output_file="${RUNNER_TEMP}/rho-output.txt"
+ output_file="${RUNNER_TEMP}/decoder-output.txt"
- # Run Rho. Capture stdout to a file AND echo it to the log. Surface the
+ # Run Decoder. Capture stdout to a file AND echo it to the log. Surface the
# real exit code as the step's status.
set +e
- rho "${args[@]}" | tee "${output_file}"
+ decoder "${args[@]}" | tee "${output_file}"
code=${PIPESTATUS[0]}
set -e
@@ -260,14 +260,14 @@ runs:
# Best-effort one-line summary
if [ "${code}" = "0" ]; then
- summary="Rho run succeeded"
+ summary="Decoder run succeeded"
else
- summary="Rho run failed (exit ${code})"
+ summary="Decoder run failed (exit ${code})"
fi
{
- echo "summary<> "${GITHUB_OUTPUT}"
exit "${code}"
@@ -278,13 +278,13 @@ runs:
env:
GH_TOKEN: ${{ inputs.github-token }}
PR_NUMBER: ${{ github.event.pull_request.number }}
- RHO_EXIT: ${{ steps.run.outputs.exit-code }}
- RHO_SUMMARY: ${{ steps.run.outputs.summary }}
+ DECODER_EXIT: ${{ steps.run.outputs.exit-code }}
+ DECODER_SUMMARY: ${{ steps.run.outputs.summary }}
run: |
set -euo pipefail
status="succeeded"
- [ "${RHO_EXIT}" != "0" ] && status="failed (exit ${RHO_EXIT})"
- body="$(printf 'Rho run %s.\n\n%s' "${status}" "${RHO_SUMMARY}")"
+ [ "${DECODER_EXIT}" != "0" ] && status="failed (exit ${DECODER_EXIT})"
+ body="$(printf 'Decoder run %s.\n\n%s' "${status}" "${DECODER_SUMMARY}")"
gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
-f body="${body}" >/dev/null
@@ -293,14 +293,14 @@ runs:
shell: bash
env:
SLACK_WEBHOOK_URL: ${{ inputs.slack-webhook-url }}
- RHO_EXIT: ${{ steps.run.outputs.exit-code }}
- RHO_SUMMARY: ${{ steps.run.outputs.summary }}
+ DECODER_EXIT: ${{ steps.run.outputs.exit-code }}
+ DECODER_SUMMARY: ${{ steps.run.outputs.summary }}
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
set -euo pipefail
status="succeeded"
- [ "${RHO_EXIT}" != "0" ] && status="failed (exit ${RHO_EXIT})"
- text="Rho run ${status} for ${GITHUB_REPOSITORY}@${GITHUB_REF_NAME}. ${RHO_SUMMARY} ${RUN_URL}"
+ [ "${DECODER_EXIT}" != "0" ] && status="failed (exit ${DECODER_EXIT})"
+ text="Decoder run ${status} for ${GITHUB_REPOSITORY}@${GITHUB_REF_NAME}. ${DECODER_SUMMARY} ${RUN_URL}"
payload="$(jq -n --arg text "${text}" '{text: $text}')"
curl --fail --silent --show-error -X POST -H 'Content-Type: application/json' \
-d "${payload}" "${SLACK_WEBHOOK_URL}" >/dev/null || \
diff --git a/.github/actions/setup-deps/action.yml b/.github/actions/setup-deps/action.yml
index 53a187601..64abd1a9c 100644
--- a/.github/actions/setup-deps/action.yml
+++ b/.github/actions/setup-deps/action.yml
@@ -4,7 +4,7 @@ description: Clone ecosystem sibling repos with retry, setup Go, sync workspace
inputs:
go-version:
description: Go version to install
- default: '1.26.1'
+ default: '1.27.2'
token:
description: GitHub token for authenticated clones
required: true
@@ -28,7 +28,7 @@ runs:
ws_parent="$(cd "${GITHUB_WORKSPACE}/.." && pwd)"
mkdir -p "$ws_parent"
while IFS= read -r repo; do
- [ "$repo" = rho ] && continue
+ [ "$repo" = decoder ] && continue
dest="$ws_parent/$repo"
if [ -d "$dest/.git" ]; then
echo "$repo already present at $dest"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c2ca8196..1cf03c15e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,8 @@ concurrency:
cancel-in-progress: true
env:
- GO_VERSION: "1.26.6"
- # Module resolution: flux is the only GrayCodeAI module dependency and it is
+ GO_VERSION: "1.27.2"
+ # Module resolution: mux is the only GrayCodeAI module dependency and it is
# published on the public proxy. Direct-VCS fallback is retained for anything
# else.
GOPROXY: "https://proxy.golang.org,direct"
@@ -29,7 +29,7 @@ env:
# Go's reference is explicit that a committed go.work "may cause a continuous
# integration (CI) system to select and thus test the wrong versions of a
# module's dependencies" and that "CI systems should generally not be allowed to
- # use the go.work file". Because ./.github/actions/checkout-flux clones the
+ # use the go.work file". Because ./.github/actions/checkout-mux clones the
# siblings at branch HEAD into the workspace parent, workspace mode would silently
# hide version skew (e.g. a shared pin that no longer matches).
# The `module` job opts back in (GOWORK: "auto") since `go work sync` and the
@@ -37,6 +37,13 @@ env:
GOWORK: "off"
jobs:
+ version:
+ name: Canonical version metadata
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ - run: python3 scripts/sync-version.py --check
+
# -------------------------------------------------------------------------
# 1. Format — gofumpt + goimports must be clean (zero tolerance).
# -------------------------------------------------------------------------
@@ -62,7 +69,7 @@ jobs:
fi
- name: goimports
run: |
- go install golang.org/x/tools/cmd/goimports@v0.30.0
+ go install golang.org/x/tools/cmd/goimports@v0.52.0
out=$(git ls-files -- '*.go' | xargs goimports -l)
if [ -n "$out" ]; then
echo "::error::goimports would reformat:"
@@ -73,13 +80,13 @@ jobs:
run: bash ./scripts/check-ecosystem-boundaries.sh
- name: internal layer boundary guard
run: bash ./scripts/check-internal-layer-imports.sh
- - name: flux client boundary guard
- run: bash ./scripts/check-flux-client-imports.sh
- - name: flux engine facade boundary guard
- run: bash ./scripts/check-flux-engine-boundary.sh
+ - name: mux client boundary guard
+ run: bash ./scripts/check-mux-client-imports.sh
+ - name: mux engine facade boundary guard
+ run: bash ./scripts/check-mux-engine-boundary.sh
# -------------------------------------------------------------------------
- # 2. Module hygiene — tidy, verify Rho plus the sibling Go modules via go.work.
+ # 2. Module hygiene — tidy, verify Decoder plus the sibling Go modules via go.work.
# -------------------------------------------------------------------------
module:
name: module hygiene
@@ -94,7 +101,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- name: Generate ecosystem workspace
@@ -109,7 +116,7 @@ jobs:
# go mod tidy can mis-resolve workspace modules here; go work sync is
# the supported workspace hygiene step.
go work sync
- go build -mod=readonly -o /dev/null ./cmd/rho
+ go build -mod=readonly -o /dev/null ./cmd/decoder
if ! git diff --quiet -- go.mod go.sum go.work go.work.sum; then
echo "::error::go.mod / go.sum / go.work files out of date — run 'go work sync' locally and commit"
git diff -- go.mod go.sum go.work go.work.sum
@@ -121,7 +128,7 @@ jobs:
run: |
workspace_file="${GITHUB_WORKSPACE}/../go.work"
while IFS= read -r module; do
- [ "$module" = rho ] && continue
+ [ "$module" = decoder ] && continue
if ! grep -q "./${module}" "$workspace_file"; then
echo "::error::go.work must include ./${module}."
cat "$workspace_file"
@@ -145,7 +152,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -158,7 +165,7 @@ jobs:
run: |
go mod download
go mod verify
- go build -mod=readonly ./cmd/rho
+ go build -mod=readonly ./cmd/decoder
go test ./... -count=1 -timeout=300s
release-parity:
@@ -168,7 +175,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -187,7 +194,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -196,8 +203,8 @@ jobs:
cache: true
- name: go vet
run: go vet ./...
- - name: rho harness evaluation audit
- run: go run ./cmd/rho harness --out-dir .rho/harness
+ - name: decoder harness evaluation audit
+ run: go run ./cmd/decoder harness --out-dir .decoder/harness
- name: support repo coupling guard
run: bash ./scripts/check-support-repo-coupling.sh
@@ -212,7 +219,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -221,7 +228,7 @@ jobs:
cache: true
- name: Run golangci-lint
run: |
- go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.0
+ go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0
golangci-lint run --timeout=5m
# -------------------------------------------------------------------------
@@ -232,7 +239,7 @@ jobs:
runs-on: ubuntu-latest
# NOTE: depends only on `format`, deliberately NOT on `vet`.
# A `vet` (or upstream) failure must never skip the test job — that
- # historically masked real test regressions (see rho PR #155, where
+ # historically masked real test regressions (see decoder PR #155, where
# DrainAlerts code shipped with failing tests because `test` was skipped
# when `vet` failed on the trailer-strip force-push). Tests must always
# run so regressions surface instead of being hidden.
@@ -241,7 +248,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -313,7 +320,7 @@ jobs:
echo ""
echo "Policy: Every t.Skip() should have a comment linking to a GitHub issue."
echo "Example:"
- echo " // TODO: https://github.com/GrayCodeAI/rho/issues/123"
+ echo " // TODO: https://github.com/GrayCodeAI/decoder/issues/123"
echo " t.Skip(\"not yet implemented\")"
fi
@@ -328,7 +335,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -337,41 +344,22 @@ jobs:
cache: true
- name: govulncheck
run: |
- go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
- # Fail only on vulnerabilities reachable from our code (findings with a
- # non-empty call trace). Transitive advisories that our code does not
- # call are surfaced but do not block CI — they cannot be remediated
- # without an upstream fix and are not in our attack surface.
- govulncheck -json ./... > /tmp/vuln.json || true
- reachable=$(python3 - <<'PY'
- import json, sys
- n = 0
- for line in open("/tmp/vuln.json"):
- line = line.strip()
- if not line:
- continue
- try:
- o = json.loads(line)
- except json.JSONDecodeError:
- continue
- if not isinstance(o, dict):
- continue
- if o.get("module") == "finding" and o.get("trace"):
- n += 1
- print(f"REACHABLE: {o.get('osv', {}).get('id')} in {o.get('package', {}).get('path')}", file=sys.stderr)
- print(n)
- PY
- )
- echo "Reachable vulnerabilities: $reachable"
- if [ "$reachable" -gt 0 ]; then
- echo "::error::govulncheck found $reachable reachable vulnerability(ies) in our code"
- exit 1
- fi
- echo "No reachable vulnerabilities in our code."
+ go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
+ # The default symbol scan exits nonzero for reachable vulnerabilities
+ # and scanner errors. Verbose output also reports uncalled advisories.
+ govulncheck -show=verbose ./...
- name: gosec
continue-on-error: true
run: |
- go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
+ # gosec's release still pins an older Go export-data reader.
+ # Build it with Go 1.27-compatible x/tools in an isolated module.
+ tool_dir=$(mktemp -d)
+ (
+ cd "$tool_dir"
+ go mod init graycodeai.local/gosec-tool
+ go get github.com/securego/gosec/v2/cmd/gosec@v2.29.0 golang.org/x/tools@v0.52.0
+ go install github.com/securego/gosec/v2/cmd/gosec
+ )
# Advisory scan. The blocking gosec gate lives in the `lint` job
# (see .golangci.yml), which applies the repo's G301/G304
# exclusions for intentional 0755 dirs and user-supplied file
@@ -436,7 +424,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
@@ -445,7 +433,7 @@ jobs:
cache: true
- name: deadcode
run: |
- go install golang.org/x/tools/cmd/deadcode@v0.30.0
+ go install golang.org/x/tools/cmd/deadcode@v0.52.0
output=$(mktemp)
trap 'rm -f "$output"' EXIT
deadcode ./... >"$output"
@@ -491,7 +479,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -506,7 +494,7 @@ jobs:
run: go build -trimpath -v ./...
- name: Binary size budget (linux/amd64 only)
if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
- # Builds bin/rho with the release ldflags (-s -w) and fails when it
+ # Builds bin/decoder with the release ldflags (-s -w) and fails when it
# exceeds SIZE_LIMIT_MB in the Makefile — the single source of the budget.
run: make size-check
@@ -521,7 +509,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -544,7 +532,7 @@ jobs:
go test -run='^$' -fuzz=FuzzParseToolCallResult -fuzztime=60s ./internal/mcp
# -------------------------------------------------------------------------
- # 10. Smoke — build rho and verify ecosystem CLI wiring.
+ # 10. Smoke — build decoder and verify ecosystem CLI wiring.
# -------------------------------------------------------------------------
smoke:
name: smoke
@@ -554,12 +542,12 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: ${{ env.GO_VERSION }}
cache: true
- - name: smoke-rho.sh
- run: ./scripts/smoke-rho.sh
+ - name: smoke-decoder.sh
+ run: ./scripts/smoke-decoder.sh
diff --git a/.github/workflows/compatibility-matrix.yml b/.github/workflows/compatibility-matrix.yml
index ac80831db..3cac8b8cd 100644
--- a/.github/workflows/compatibility-matrix.yml
+++ b/.github/workflows/compatibility-matrix.yml
@@ -23,12 +23,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- - uses: ./.github/actions/checkout-flux
+ - uses: ./.github/actions/checkout-mux
with:
ref: ${{ github.head_ref || github.ref_name }}
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
- go-version: "1.26.6"
+ go-version: "1.27.2"
cache: true
- name: Structural validation (schema + version pins)
run: make compat-check
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa0b179ee..f2da60aee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,4 @@
-# Release workflow for rho. A maintainer pushes a v tag after the
+# Release workflow for decoder. A maintainer pushes a v tag after the
# release PR (VERSION + CHANGELOG) has merged; creating v* tags is restricted by
# the repository ruleset "protect-release-tags". See docs/RELEASING.md.
# Source of truth: .shared-templates/workflows/go-release.yml.tmpl
@@ -22,7 +22,7 @@ jobs:
runs-on: ubuntu-latest
env:
GOPROXY: "https://proxy.golang.org,direct"
- # Release builds resolve every dependency (including flux) from
+ # Release builds resolve every dependency (including mux) from
# go.mod/go.sum through the public proxy — never from sibling checkouts.
GOWORK: "off"
steps:
@@ -32,6 +32,9 @@ jobs:
fetch-depth: 0 # goreleaser needs full history for changelog
persist-credentials: false
+ - name: Verify canonical version metadata
+ run: python3 scripts/sync-version.py --check
+
# Refuses a tag that disagrees with VERSION or has no CHANGELOG section,
# and extracts that section as the release notes.
- name: Check tag against VERSION and CHANGELOG
@@ -40,7 +43,7 @@ jobs:
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
- go-version: "1.26.6"
+ go-version: "1.27.2"
cache: true
- name: Refuse local replace directives
diff --git a/.gitignore b/.gitignore
index 637ffaa90..7903bccc6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,11 +1,11 @@
# Binaries
-/rho
+/decoder
# Ignore build output in bin/, but track committed source scripts like bin/buf.
bin/*
!bin/buf
# GoReleaser output (goreleaser release --snapshot / make release).
/dist/
-rho_bin
+decoder_bin
*.exe
*.dll
*.so
@@ -14,7 +14,7 @@ rho_bin
.claude/
.codegraph/
.commandcode/
-.rho/
+.decoder/
.harrier/
.openclaude/
.pi/
@@ -49,11 +49,11 @@ go.work.sum
# Lefthook-generated git hook wrappers
.githooks/
__pycache__/
-rho_bin
+decoder_bin
# Logs
*.log
-rho-sec105b.log
+decoder-sec105b.log
# Compiled Go test binaries
*.test
@@ -63,7 +63,7 @@ rho-sec105b.log
# for tools that prefer it; keep the regenerated copy out of git.
/CLAUDE.md
-# Local module overlay for building against a sibling checkout (e.g. flux).
+# Local module overlay for building against a sibling checkout (e.g. mux).
# go.local.mod carries a `replace` directive pointing at ../; committing
# it would break CI, which builds against the pinned published module.
/go.local.mod
diff --git a/.golangci.yml b/.golangci.yml
index 2f7923bbb..4d11074b1 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -24,7 +24,7 @@ linters:
# production code with this set). Deliberately excluded floods:
# G104 — unhandled errors, already covered by errcheck
# G301/G306 — 0755/0644 perms are intentional for user-visible files
- # G304 — rho reads user-supplied file paths by design (CLI agent)
+ # G304 — decoder reads user-supplied file paths by design (CLI agent)
includes:
- G101 # hardcoded credentials
- G102 # bind to all interfaces
@@ -94,6 +94,6 @@ linters:
# Tests conventionally compare errors for exact identity (err != sentinel)
# or type-assert with a concrete type; enforcing errors.Is/As there is noise.
- errorlint
- issues:
+issues:
max-issues-per-linter: 0
max-same-issues: 0
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 783e89c25..d11598581 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,5 +1,5 @@
-# GoReleaser config for rho (the terminal AI coding agent).
-# Derived from .shared-templates/.goreleaser.yml.tmpl; rho-specific deltas are
+# GoReleaser config for decoder (the terminal AI coding agent).
+# Derived from .shared-templates/.goreleaser.yml.tmpl; decoder-specific deltas are
# commented inline. Run by .github/workflows/release.yml on a v* tag; see
# docs/RELEASING.md for the release process.
#
@@ -8,7 +8,7 @@
# goreleaser release --snapshot --clean --skip=publish,sign
version: 2
-project_name: rho
+project_name: decoder
# ---------------------------------------------------------------------------
# Pre-build hooks — verify module checksums before building anything.
@@ -23,9 +23,9 @@ before:
# rather than the build host's clock.
# ---------------------------------------------------------------------------
builds:
- - id: rho
- main: ./cmd/rho
- binary: rho
+ - id: decoder
+ main: ./cmd/decoder
+ binary: decoder
env:
- CGO_ENABLED=0
# Build strictly from go.mod/go.sum, never from a developer go.work.
@@ -48,7 +48,7 @@ builds:
# ---------------------------------------------------------------------------
# Archives — tar.gz on Unix, zip on Windows. Names are
-# rho___.; install.sh and .github/actions/rho depend
+# decoder___.; install.sh and .github/actions/decoder depend
# on this exact shape.
# ---------------------------------------------------------------------------
archives:
@@ -94,7 +94,7 @@ checksum:
# uploaded with the release as checksums.txt.sigstore.json. Verify with:
#
# cosign verify-blob --bundle checksums.txt.sigstore.json \
-# --certificate-identity "https://github.com/GrayCodeAI/rho/.github/workflows/release.yml@refs/tags/vX.Y.Z" \
+# --certificate-identity "https://github.com/GrayCodeAI/decoder/.github/workflows/release.yml@refs/tags/vX.Y.Z" \
# --certificate-oidc-issuer https://token.actions.githubusercontent.com \
# checksums.txt
# ---------------------------------------------------------------------------
@@ -164,9 +164,9 @@ release:
prerelease: auto
name_template: "v{{ .Version }}"
header: |
- ## rho v{{ .Version }}
+ ## decoder v{{ .Version }}
- Rho is the terminal AI coding agent from GrayCode (pre-1.0).
+ Decoder is the terminal AI coding agent from GrayCode (pre-1.0).
footer: |
### Verify this release
@@ -176,10 +176,10 @@ release:
```sh
cosign verify-blob --bundle checksums.txt.sigstore.json \
- --certificate-identity "https://github.com/GrayCodeAI/rho/.github/workflows/release.yml@refs/tags/{{ .Tag }}" \
+ --certificate-identity "https://github.com/GrayCodeAI/decoder/.github/workflows/release.yml@refs/tags/{{ .Tag }}" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
checksums.txt
sha256sum --ignore-missing -c checksums.txt
```
- {{ if .PreviousTag }}**Full changelog:** https://github.com/GrayCodeAI/rho/compare/{{ .PreviousTag }}...{{ .Tag }}{{ end }}
+ {{ if .PreviousTag }}**Full changelog:** https://github.com/GrayCodeAI/decoder/compare/{{ .PreviousTag }}...{{ .Tag }}{{ end }}
diff --git a/.shared-templates/.goreleaser.yml.tmpl b/.shared-templates/.goreleaser.yml.tmpl
index eec7aedf3..ae9ad4bd1 100644
--- a/.shared-templates/.goreleaser.yml.tmpl
+++ b/.shared-templates/.goreleaser.yml.tmpl
@@ -1,11 +1,11 @@
# Canonical GrayCodeAI goreleaser config for Go binary repos.
-# Source of truth: .shared-templates/.goreleaser.yml.tmpl (rho's
+# Source of truth: .shared-templates/.goreleaser.yml.tmpl (decoder's
# .goreleaser.yml is the reference rendering).
#
# Placeholders rendered per repo (ALL-CAPS, distinct from goreleaser's own
# `{{.Version}}`-style Go template fields, which are left as-is below):
-# {{NAME}} — short repo name (e.g. rho)
-# {{MAIN_PKG}} — main package path (e.g. ./ or ./cmd/rho)
+# {{NAME}} — short repo name (e.g. decoder)
+# {{MAIN_PKG}} — main package path (e.g. ./ or ./cmd/decoder)
# {{DESCRIPTION}} — short single-line description for the release header
# {{VERSION_PKG}} — Go package path holding Version vars
# (e.g. main or github.com/GrayCodeAI//internal/version)
diff --git a/.shared-templates/Makefile.binary.tmpl b/.shared-templates/Makefile.binary.tmpl
index 1646cc356..3f06b178d 100644
--- a/.shared-templates/Makefile.binary.tmpl
+++ b/.shared-templates/Makefile.binary.tmpl
@@ -2,13 +2,13 @@
# Source of truth: .shared-templates/Makefile.binary.tmpl at the eco root.
# Placeholders rendered per repo: {{NAME}}, {{MAIN_PKG}}.
#
-# rho is currently the only Go binary repo in the ecosystem, and its real
-# Makefile extends this core with rho-specific targets (workspace `setup`,
+# decoder is currently the only Go binary repo in the ecosystem, and its real
+# Makefile extends this core with decoder-specific targets (workspace `setup`,
# `compat-test`/`compat-check`, `sync-submodules`/`sync-external`,
# `build-all`/`build-static`/`size-check`, and split `*-guard` boundary
# checks instead of the single generic `boundaries` below). Treat this file
# as the floor every Go binary repo starts from, not a literal copy of
-# rho/Makefile.
+# decoder/Makefile.
# ---------------------------------------------------------------------------
# Project metadata
@@ -18,7 +18,7 @@ MAIN_PKG := {{MAIN_PKG}}
# ---------------------------------------------------------------------------
# Versioning — sourced from VERSION file; falls back to git describe.
-# See https://github.com/GrayCodeAI/rho/blob/main/docs/versioning.md.
+# See https://github.com/GrayCodeAI/decoder/blob/main/docs/versioning.md.
# ---------------------------------------------------------------------------
VERSION ?= $(shell v=$$(cat VERSION 2>/dev/null | head -n1 | tr -d '[:space:]'); if [ -n "$$v" ]; then echo "$$v"; else git describe --tags --always --dirty 2>/dev/null || echo "dev"; fi)
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "none")
@@ -139,5 +139,5 @@ hooks: ## Install git hooks via lefthook (formatting, linting, conventional comm
# ---------------------------------------------------------------------------
# Repo-specific extensions go below this line — workspace setup, submodule
# sync, cross-platform build matrices, compatibility-matrix checks, etc.
-# See rho/Makefile for the real, extended reference implementation.
+# See decoder/Makefile for the real, extended reference implementation.
# ---------------------------------------------------------------------------
diff --git a/.shared-templates/Makefile.library.tmpl b/.shared-templates/Makefile.library.tmpl
index d2b16e25a..7a8643ca7 100644
--- a/.shared-templates/Makefile.library.tmpl
+++ b/.shared-templates/Makefile.library.tmpl
@@ -9,7 +9,7 @@ NAME := {{NAME}}
# ---------------------------------------------------------------------------
# Versioning — sourced from VERSION file; falls back to git describe.
-# See https://github.com/GrayCodeAI/rho/blob/main/VERSIONING.md.
+# See https://github.com/GrayCodeAI/decoder/blob/main/VERSIONING.md.
# ---------------------------------------------------------------------------
VERSION ?= $(shell v=$$(cat VERSION 2>/dev/null | head -n1 | tr -d '[:space:]'); if [ -n "$$v" ]; then echo "$$v"; else git describe --tags --always --dirty 2>/dev/null || echo "dev"; fi)
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "none")
diff --git a/.shared-templates/Makefile.python.tmpl b/.shared-templates/Makefile.python.tmpl
index 24b1a6720..4a53beb63 100644
--- a/.shared-templates/Makefile.python.tmpl
+++ b/.shared-templates/Makefile.python.tmpl
@@ -63,7 +63,7 @@ fmt: ## Format with ruff.
vet: ## Type-check with mypy.
$(PYTHON) -m mypy src/
-boundary-guard: ## Fail if the SDK references support engines or Rho private packages.
+boundary-guard: ## Fail if the SDK references support engines or Decoder private packages.
bash ./scripts/check-consumer-boundaries.sh
lint: ## Lint with ruff.
diff --git a/.shared-templates/README.md b/.shared-templates/README.md
index bcfb91eb4..826bc41d8 100644
--- a/.shared-templates/README.md
+++ b/.shared-templates/README.md
@@ -7,17 +7,17 @@ Every graycode-ecosystem repo's `Makefile`, `lefthook.yml`, and
# Source of truth: .shared-templates/Makefile.library.tmpl at the eco root.
```
-This directory is that source of truth. It lives here, in `rho`, because
-`rho` is the one repo every consumer already depends on or references —
+This directory is that source of truth. It lives here, in `decoder`, because
+`decoder` is the one repo every consumer already depends on or references —
there is no separate monorepo at the workspace root to hold it.
-**This directory is not built or run by rho itself.** It is a template
+**This directory is not built or run by decoder itself.** It is a template
library that other graycode-ecosystem repos copy from and diff against.
## Layout
- `Makefile.library.tmpl` — Go library repos (engines, SDKs, foundation repos)
-- `Makefile.binary.tmpl` — Go binary repos (currently only `rho`)
+- `Makefile.binary.tmpl` — Go binary repos (currently only `decoder`)
- `Makefile.python.tmpl` — Python repos (`robin`)
- `lefthook.yml.tmpl` — git hooks config, identical across all Go repos
- `.goreleaser.yml.tmpl` — goreleaser config for Go binary repos
@@ -28,7 +28,7 @@ library that other graycode-ecosystem repos copy from and diff against.
- `workflows/python-release.yml.tmpl` — PyPI publish workflow (Trusted Publishing)
- `workflows/compatibility-test.yml.tmpl` — cross-repo compatibility matrix check (see `docs/compatibility.md`)
- `scripts/check-ecosystem-boundaries.sh.tmpl` — the import-boundary guard, parameterized per repo role
-- `scripts/sync-external.sh` — read-only drift report for `rho`'s `external/` submodule pins (rho-specific, not templated elsewhere)
+- `scripts/sync-external.sh` — read-only drift report for `decoder`'s `external/` submodule pins (decoder-specific, not templated elsewhere)
- `docs/coverage-matrix.md` — per-repo test coverage thresholds enforced in CI, kept in one place so they don't silently drift out of sync with each repo's `go-ci.yml`
## How repos use this
@@ -37,9 +37,9 @@ There is currently no rendering tool — repos copy a template, replace the
placeholders marked `{{LIKE_THIS}}`, and keep the "Source of truth" header
comment pointing back here. When you change a template, the repos that
copied it are now stale; update them in the same PR or file a follow-up
-per repo. `rho`'s own `Makefile`/`lefthook.yml`/CI predate this directory
+per repo. `decoder`'s own `Makefile`/`lefthook.yml`/CI predate this directory
and intentionally diverge in a few binary-specific ways (see
-`Makefile.binary.tmpl`, which documents the real deltas against `rho`'s
+`Makefile.binary.tmpl`, which documents the real deltas against `decoder`'s
Makefile).
## Boundary rule
diff --git a/.shared-templates/docs/coverage-matrix.md b/.shared-templates/docs/coverage-matrix.md
index ed283de1f..d33414b69 100644
--- a/.shared-templates/docs/coverage-matrix.md
+++ b/.shared-templates/docs/coverage-matrix.md
@@ -8,8 +8,8 @@ repo's threshold, update both the CI file and this table in the same PR.**
| Repo | Threshold | Mechanism |
|---|---|---|
-| `rho` | 65% | inline `bc` check in `ci.yml` |
-| `flux` | 60% | inline `bc` check in `ci.yml` |
+| `decoder` | 65% | inline `bc` check in `ci.yml` |
+| `mux` | 60% | inline `bc` check in `ci.yml` |
| `graycode-skills` | n/a | no Go/Python test suite (skill/content registry) |
## Why thresholds differ per repo
diff --git a/.shared-templates/scripts/check-ecosystem-boundaries.sh.tmpl b/.shared-templates/scripts/check-ecosystem-boundaries.sh.tmpl
index 2dc77a715..5beca785f 100644
--- a/.shared-templates/scripts/check-ecosystem-boundaries.sh.tmpl
+++ b/.shared-templates/scripts/check-ecosystem-boundaries.sh.tmpl
@@ -12,29 +12,29 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT_DIR"
# =============================================================================
-# VARIANT 1 — Support engine (flux, harrier, shrike, swift, kestrel, merlin).
+# VARIANT 1 — Support engine (mux, harrier, shrike, swift, kestrel, merlin).
# Engines are peers: they may depend on falcon,
-# but never on rho/internal/* or another engine.
+# but never on decoder/internal/* or another engine.
# =============================================================================
-FORBIDDEN_RHO='github\.com/GrayCodeAI/rho/internal/'
+FORBIDDEN_DECODER='github\.com/GrayCodeAI/decoder/internal/'
FORBIDDEN_ENGINES='github\.com/GrayCodeAI/(harrier|shrike|swift|kestrel|merlin)(/|")'
# ^ list every OTHER engine here — never include yourself.
exit_code=0
if command -v rg >/dev/null 2>&1; then
- violations="$(rg -n "$FORBIDDEN_RHO" --glob '*.go' . || true)"
+ violations="$(rg -n "$FORBIDDEN_DECODER" --glob '*.go' . || true)"
engine_violations="$(rg -n "$FORBIDDEN_ENGINES" --glob '*.go' . || true)"
else
- violations="$(grep -rn --include='*.go' -E "$FORBIDDEN_RHO" . || true)"
+ violations="$(grep -rn --include='*.go' -E "$FORBIDDEN_DECODER" . || true)"
engine_violations="$(grep -rn --include='*.go' -E "$FORBIDDEN_ENGINES" . || true)"
fi
if [[ -n "${violations}" ]]; then
- echo "forbidden Rho imports found:"
+ echo "forbidden Decoder imports found:"
echo "${violations}"
echo
- echo "support repos must use local contracts, not rho/internal"
+ echo "support repos must use local contracts, not decoder/internal"
exit_code=1
fi
@@ -70,19 +70,19 @@ echo "ecosystem boundary guard passed"
# echo "forbidden graycode-eco imports found in {{OWN_MODULE}}:"
# echo "${violations}"
# echo
-# echo "{{OWN_MODULE}} is a foundation repo — it must not depend on rho, engines, or any other GrayCodeAI/* package"
+# echo "{{OWN_MODULE}} is a foundation repo — it must not depend on decoder, engines, or any other GrayCodeAI/* package"
# exit 1
# fi
#
# echo "ecosystem boundary guard passed"
# =============================================================================
-# VARIANT 3 — SDK / skills consumer (graycode-skills). Consumers may depend on rho's public surfaces
-# only — never on a support engine directly, and never on rho/internal.
+# VARIANT 3 — SDK / skills consumer (graycode-skills). Consumers may depend on decoder's public surfaces
+# only — never on a support engine directly, and never on decoder/internal.
# =============================================================================
#
-# FORBIDDEN_ENGINES='github\.com/GrayCodeAI/(flux|harrier|shrike|swift|kestrel|merlin)(/|")'
-# FORBIDDEN_INTERNAL='github\.com/GrayCodeAI/rho/internal'
+# FORBIDDEN_ENGINES='github\.com/GrayCodeAI/(mux|harrier|shrike|swift|kestrel|merlin)(/|")'
+# FORBIDDEN_INTERNAL='github\.com/GrayCodeAI/decoder/internal'
#
# (same rg/grep + report pattern as Variant 1, naming "SDKs/skills must go
-# through rho's public API, not engines directly" as the violation message)
+# through decoder's public API, not engines directly" as the violation message)
diff --git a/.shared-templates/scripts/sync-external.sh b/.shared-templates/scripts/sync-external.sh
index a911365bf..f22a0ce6b 100755
--- a/.shared-templates/scripts/sync-external.sh
+++ b/.shared-templates/scripts/sync-external.sh
@@ -5,7 +5,7 @@
# the submodule checkout), this makes no changes — it only reports.
#
# Typical drift: you commit changes in ../shrike, but forget `make
-# sync-submodules` + a commit in rho to bump the external/tok pin. This
+# sync-submodules` + a commit in decoder to bump the external/tok pin. This
# script catches that before it becomes a stale-dependency surprise in CI.
set -euo pipefail
@@ -62,7 +62,7 @@ done < <(git config -f .gitmodules --get-regexp path | awk '{print $2}')
if [[ $exit_code -ne 0 ]]; then
echo
- echo "drift detected — run 'make sync-submodules' in rho after confirming the sibling repos are what you expect, then commit the updated external/ pins"
+ echo "drift detected — run 'make sync-submodules' in decoder after confirming the sibling repos are what you expect, then commit the updated external/ pins"
fi
exit $exit_code
diff --git a/.shared-templates/workflows/compatibility-test.yml.tmpl b/.shared-templates/workflows/compatibility-test.yml.tmpl
index d53d0abbd..6df35c95b 100644
--- a/.shared-templates/workflows/compatibility-test.yml.tmpl
+++ b/.shared-templates/workflows/compatibility-test.yml.tmpl
@@ -1,7 +1,7 @@
-# Cross-repo compatibility matrix check, referenced from rho/docs/compatibility.md.
+# Cross-repo compatibility matrix check, referenced from decoder/docs/compatibility.md.
# Source of truth: .shared-templates/workflows/compatibility-test.yml.tmpl
#
-# Lives (and runs) in rho only — rho owns testdata/compatibility-matrix.json
+# Lives (and runs) in decoder only — decoder owns testdata/compatibility-matrix.json
# and the `compat-test`/`compat-check` Make targets that validate it. Other
# repos don't need a copy of this workflow; they're read as data, not as a
# workflow trigger.
@@ -36,7 +36,7 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
- go-version: "1.26.5"
+ go-version: "1.27.2"
cache: true
- name: Structural validation (schema + version pins)
run: make compat-check
diff --git a/.shared-templates/workflows/go-ci.yml.tmpl b/.shared-templates/workflows/go-ci.yml.tmpl
index f36742492..a3bd46d1e 100644
--- a/.shared-templates/workflows/go-ci.yml.tmpl
+++ b/.shared-templates/workflows/go-ci.yml.tmpl
@@ -37,7 +37,7 @@ concurrency:
cancel-in-progress: true
env:
- GO_VERSION: "1.26.5"
+ GO_VERSION: "1.27.2"
GOPROXY: "https://proxy.golang.org,direct"
GOPRIVATE: "github.com/GrayCodeAI/*"
GONOSUMDB: "github.com/GrayCodeAI/*"
@@ -86,7 +86,7 @@ jobs:
run: bash ./scripts/check-ecosystem-boundaries.sh
- uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v7.0.0
with:
- version: v2.1.0
+ version: v2.14.0
install-mode: goinstall
verify: false
args: --timeout=5m
@@ -146,11 +146,19 @@ jobs:
cache: true
- name: govulncheck
run: |
- go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+ go install golang.org/x/vuln/cmd/govulncheck@v1.8.0
govulncheck ./...
- name: gosec (advisory)
run: |
- go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
+ # gosec's release still pins an older Go export-data reader.
+ # Build it with Go 1.27-compatible x/tools in an isolated module.
+ tool_dir=$(mktemp -d)
+ (
+ cd "$tool_dir"
+ go mod init graycodeai.local/gosec-tool
+ go get github.com/securego/gosec/v2/cmd/gosec@v2.29.0 golang.org/x/tools@v0.52.0
+ go install github.com/securego/gosec/v2/cmd/gosec
+ )
gosec -exclude=G104,G301,G302,G304,G306 ./...
# -------------------------------------------------------------------------
diff --git a/.shared-templates/workflows/go-release.yml.tmpl b/.shared-templates/workflows/go-release.yml.tmpl
index d97a444b6..2e84b29e3 100644
--- a/.shared-templates/workflows/go-release.yml.tmpl
+++ b/.shared-templates/workflows/go-release.yml.tmpl
@@ -2,7 +2,7 @@
# A maintainer pushes a v tag after the release PR (VERSION +
# CHANGELOG) merges; protect v* tags with a repository ruleset.
# Source of truth: .shared-templates/workflows/go-release.yml.tmpl
-# (rho's .github/workflows/release.yml is the reference rendering).
+# (decoder's .github/workflows/release.yml is the reference rendering).
name: release
@@ -35,14 +35,14 @@ jobs:
# Refuses a tag that disagrees with VERSION or has no CHANGELOG section,
# and extracts that section as the release notes. Copy
- # scripts/check-release-tag.sh from rho.
+ # scripts/check-release-tag.sh from decoder.
- name: Check tag against VERSION and CHANGELOG
run: bash ./scripts/check-release-tag.sh --notes "${RUNNER_TEMP}/release-notes.md" "${GITHUB_REF_NAME}"
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
- go-version: "1.26.6"
+ go-version: "1.27.2"
cache: true
# GoReleaser shells out to syft for the `sboms:` stanza; the runner image
diff --git a/.shared-templates/workflows/python-ci.yml.tmpl b/.shared-templates/workflows/python-ci.yml.tmpl
index ead5a693b..2af8c8254 100644
--- a/.shared-templates/workflows/python-ci.yml.tmpl
+++ b/.shared-templates/workflows/python-ci.yml.tmpl
@@ -2,7 +2,7 @@
# Source of truth: .shared-templates/workflows/python-ci.yml.tmpl
#
# Placeholders rendered per repo:
-# {{PACKAGE}} — importable package name for --cov (e.g. rho)
+# {{PACKAGE}} — importable package name for --cov (e.g. decoder)
# {{THRESHOLD}} — minimum coverage percentage, kept in sync with
# docs/coverage-matrix.md
diff --git a/AGENTS.md b/AGENTS.md
index ead53ba9b..6258d9016 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,15 +1,15 @@
---
-description: Extending rho — how to write AGENTS.md files, custom specialists, skills, hooks, MCP servers, and plugins.
+description: Extending decoder — how to write AGENTS.md files, custom specialists, skills, hooks, MCP servers, and plugins.
globs: "*.go, *.js, *.md, *.json, *.toml, *.yaml, *.yml"
alwaysApply: false
---
-# Extending rho
+# Extending decoder
-rho is an open-source code intelligence platform. It lives in the `graycode-eco`
-workspace alongside the ecosystem repos that power it (`flux`,
+decoder is an open-source code intelligence platform. It lives in the `graycode-eco`
+workspace alongside the ecosystem repos that power it (`mux`,
`shrike`, `harrier`, `swift`, `kestrel`, `merlin`). This document describes how to extend
-rho with custom tools, skills, hooks, and integrations.
+decoder with custom tools, skills, hooks, and integrations.
## Development workflow
@@ -17,7 +17,7 @@ When starting any new work (feature, fix, refactor, chore), always create a feat
## 1. Drop a project `AGENTS.md`
-When rho starts in a directory, it looks for project-level instructions and injects them into the system prompt. The lookup walks from your current working directory **up to the nearest git root** and reads the first matching file at each level — general rules at the repo root, more specific rules in sub-trees. Files are labeled with their directory in the prompt (e.g. `## Project guidelines (services/api/AGENTS.md)`).
+When decoder starts in a directory, it looks for project-level instructions and injects them into the system prompt. The lookup walks from your current working directory **up to the nearest git root** and reads the first matching file at each level — general rules at the repo root, more specific rules in sub-trees. Files are labeled with their directory in the prompt (e.g. `## Project guidelines (services/api/AGENTS.md)`).
Accepted file names, in priority order at each level:
@@ -29,7 +29,7 @@ Accepted file names, in priority order at each level:
Matching is **case-insensitive** on the basename, so `AGENTS.md`, `Agents.md`, and `agents.md` resolve to the same file on Windows and macOS. The git-tracked filename in this repo is `AGENTS.md` — keep that on case-sensitive filesystems (Linux, the WSL filesystem, or a CI runner) to match what the loader looks for.
-Both files use the same format. YAML frontmatter is optional; the markdown body is loaded as instructions for the agent. rho reads the file once at session start, so changes take effect on the next launch — not mid-session.
+Both files use the same format. YAML frontmatter is optional; the markdown body is loaded as instructions for the agent. decoder reads the file once at session start, so changes take effect on the next launch — not mid-session.
```markdown
# Project conventions for
@@ -42,26 +42,26 @@ Both files use the same format. YAML frontmatter is optional; the markdown body
Tips:
-- Keep each file under ~8 KiB. rho caps the **total** across all matched files at 32 KiB; everything past the cap is dropped.
+- Keep each file under ~8 KiB. decoder caps the **total** across all matched files at 32 KiB; everything past the cap is dropped.
- Re-state rules in the imperative voice: "Run `make lint`", not "you should consider running the linter".
- Don't put secrets, model IDs, or environment-specific paths in `AGENTS.md`. Use config files for those.
-- In a monorepo, drop a narrower `AGENTS.md` in each sub-tree (e.g. `services/api/AGENTS.md`). rho picks those up automatically when you launch from inside the sub-tree.
+- In a monorepo, drop a narrower `AGENTS.md` in each sub-tree (e.g. `services/api/AGENTS.md`). decoder picks those up automatically when you launch from inside the sub-tree.
- A YAML frontmatter block (`---\n...\n---`) at the top is preserved verbatim in the injected prompt but is not parsed for `globs:` or `alwaysApply:` scoping today — keep the body self-contained.
### Personal guidelines, across every project
-For preferences that follow *you*, not a specific repo (tone, tooling habits, workflow), drop a `ZERO.md` in your user config directory: `~/.rho/ZERO.md` on Linux/macOS, `%AppData%\rho\ZERO.md` on Windows — the same directory as config files and your personal specialists. Same format and 8 KiB cap as the project files above, and the same case-insensitive basename match.
+For preferences that follow *you*, not a specific repo (tone, tooling habits, workflow), drop a `ZERO.md` in your user config directory: `~/.decoder/ZERO.md` on Linux/macOS, `%AppData%\decoder\ZERO.md` on Windows — the same directory as config files and your personal specialists. Same format and 8 KiB cap as the project files above, and the same case-insensitive basename match.
This file is injected as its own `## User guidelines` section, before the project's `AGENTS.md`/`ZERO.md`, and is labeled as personal preference in the prompt: project guidelines are the later, more specific instruction and take precedence over it when the two conflict.
## 2. Custom specialists
-Specialists are rho's sub-agents. Three scopes, in priority order:
+Specialists are decoder's sub-agents. Three scopes, in priority order:
| Scope | Path | Shared? |
| --- | --- | --- |
-| Built-in | compiled into rho | yes |
-| User | `~/.rho/specialists/*.md` | no — your machine only |
+| Built-in | compiled into decoder | yes |
+| User | `~/.decoder/specialists/*.md` | no — your machine only |
| Project | `./.zero/specialists/*.md` | yes — the repo team |
Project overrides user overrides built-in when names collide.
@@ -89,33 +89,33 @@ Reply with one JSON object per finding: `{"file", "line", "severity", "message",
CLI management:
```bash
-rho specialist list
-rho specialist show api-reviewer
-rho specialist create api-reviewer \
+decoder specialist list
+decoder specialist show api-reviewer
+decoder specialist create api-reviewer \
--project \
--description "Reviews API changes" \
--tools read-only,plan \
--prompt "$(cat api-reviewer.md)"
-rho specialist edit api-reviewer --project
-rho specialist delete api-reviewer --project
-rho specialist path # prints the resolved specialists directory
+decoder specialist edit api-reviewer --project
+decoder specialist delete api-reviewer --project
+decoder specialist path # prints the resolved specialists directory
```
## 3. Skills
-rho ships **no bundled skills** by default. Skills are markdown instruction
+decoder ships **no bundled skills** by default. Skills are markdown instruction
files that extend agent capabilities, sourced from the separate
`GrayCodeAI/graycode-skills` repo and installed on demand:
```bash
-rho skills search # find skills in graycode-skills
-rho skills install [skill-name] # install after user approval
-rho skills list # list installed skills
-rho skills remove
+decoder skills search # find skills in graycode-skills
+decoder skills install [skill-name] # install after user approval
+decoder skills list # list installed skills
+decoder skills remove
```
Installed skills live in user or project scope:
-- User-scoped: `~/.rho/skills/`
+- User-scoped: `~/.decoder/skills/`
- Project-scoped: `./.zero/skills/` or `./skills/`
A skill manifest:
@@ -144,56 +144,56 @@ Hooks allow custom commands to run at specific lifecycle points:
- `sessionEnd` — runs at session teardown
```bash
-rho hook add beforeReview --command "lint-check"
-rho hook remove beforeReview
-rho hook list
+decoder hook add beforeReview --command "lint-check"
+decoder hook remove beforeReview
+decoder hook list
```
## 5. MCP integration
-MCP (Model Context Protocol) servers can expose tools to rho:
+MCP (Model Context Protocol) servers can expose tools to decoder:
```bash
-rho mcp add --name server --url http://localhost:8080
-rho mcp remove server
-rho mcp list
+decoder mcp add --name server --url http://localhost:8080
+decoder mcp remove server
+decoder mcp list
```
## 6. Plugins
-Plugins extend rho with custom tools and capabilities:
+Plugins extend decoder with custom tools and capabilities:
```bash
-rho plugin add --name my-plugin --path ./my-plugin
-rho plugin remove my-plugin
-rho plugin list
+decoder plugin add --name my-plugin --path ./my-plugin
+decoder plugin remove my-plugin
+decoder plugin list
```
## 7. Verification
-rho includes a self-verification system to validate local changes before contributing:
+decoder includes a self-verification system to validate local changes before contributing:
```bash
-rho verify
-rho verify --fix
+decoder verify
+decoder verify --fix
```
## Development
```bash
make lint
-rho verify
+decoder verify
```
### Architecture note: cross-repo contracts
-Cross-repo severity and finding contracts now live in rho's `internal/contracts` (vendored from the removed `github.com/GrayCodeAI/eagle` module) — extensions and support repos must vendor the needed DTOs instead of Rho internals until a published contracts module exists.
+Cross-repo severity and finding contracts now live in decoder's `internal/contracts` (vendored from the removed `github.com/GrayCodeAI/eagle` module) — extensions and support repos must vendor the needed DTOs instead of Decoder internals until a published contracts module exists.
### Architecture note: provider ownership
Implement provider protocols, adapters, catalog metadata, credential mappings, and
-provider contract tests in `../flux` (the flux engine's repo) first. Rho consumes providers only
-through Flux's stable engine facade; Rho changes should be limited to host UX
+provider contract tests in `../mux` (the mux engine's repo) first. Decoder consumes providers only
+through Mux's stable engine facade; Decoder changes should be limited to host UX
and facade integration. Concentrate AI is a pay-as-you-go gateway implemented
with its native Responses API (`/v1/responses`) under the
`concentrate-payg` deployment.
@@ -201,7 +201,7 @@ with its native Responses API (`/v1/responses`) under the
## GitNexus — Code Intelligence
-This project is indexed by GitNexus as **rho** (97743 symbols, 322940 relationships, 300 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+This project is indexed by GitNexus as **decoder** (97743 symbols, 322940 relationships, 300 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
> Index stale? Run `node .gitnexus/run.cjs analyze` from the project root — it auto-selects an available runner. No `.gitnexus/run.cjs` yet? `npx gitnexus analyze` (npm 11 crash → `npm i -g gitnexus`; #1939).
@@ -225,10 +225,10 @@ This project is indexed by GitNexus as **rho** (97743 symbols, 322940 relationsh
| Resource | Use for |
|----------|---------|
-| `gitnexus://repo/rho/context` | Codebase overview, check index freshness |
-| `gitnexus://repo/rho/clusters` | All functional areas |
-| `gitnexus://repo/rho/processes` | All execution flows |
-| `gitnexus://repo/rho/process/{name}` | Step-by-step execution trace |
+| `gitnexus://repo/decoder/context` | Codebase overview, check index freshness |
+| `gitnexus://repo/decoder/clusters` | All functional areas |
+| `gitnexus://repo/decoder/processes` | All execution flows |
+| `gitnexus://repo/decoder/process/{name}` | Step-by-step execution trace |
## CLI
@@ -245,10 +245,10 @@ This project is indexed by GitNexus as **rho** (97743 symbols, 322940 relationsh
### Workspace workflow (sibling repos)
-rho depends on ecosystem repos (`flux`, etc.) as independent sibling repos in the `graycode-eco` workspace. Rho's `go.work` lists them as `../`, so local changes in any sibling are automatically picked up by rho. Each sibling is its own git repo, versioned and released independently.
+decoder depends on ecosystem repos (`mux`, etc.) as independent sibling repos in the `graycode-eco` workspace. Decoder's `go.work` lists them as `../`, so local changes in any sibling are automatically picked up by decoder. Each sibling is its own git repo, versioned and released independently.
-1. Edit + test in `../` — run its tests, run `make test` in rho
+1. Edit + test in `../` — run its tests, run `make test` in decoder
2. Push from the sibling: `git push origin `
3. Open a PR in the sibling repo → merge to `main`
-4. Ensure rho's `go.mod` pins a version that resolves to (or is an ancestor of) the sibling's `main` — run `make sync` to verify parity
-5. No pointer commits: rho resolves the sibling via `go.work` for local dev and via the pinned `go.mod` version for standalone/module-mode builds (Docker, released consumers)
+4. Ensure decoder's `go.mod` pins a version that resolves to (or is an ancestor of) the sibling's `main` — run `make sync` to verify parity
+5. No pointer commits: decoder resolves the sibling via `go.work` for local dev and via the pinned `go.mod` version for standalone/module-mode builds (Docker, released consumers)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c4578dfd..7d37afc5f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,14 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASING.md).
-> **Version history.** The next release, **v0.3.0**, is the first published
-> under the `rho` name and module path `github.com/GrayCodeAI/rho`. Sections
+> **Version history.** The next release, versioned by [`VERSION`](./VERSION), is the first published
+> under the `decoder` name and module path `github.com/GrayCodeAI/decoder`. Sections
> labelled `hawk` below are kept as the historical record of the project
> before the rename: `hawk 0.2.0` is the `v0.2.0` tag, which (like `v0.1.0`
> and `v0.1.1`) was built from the `github.com/GrayCodeAI/hawk` module and
> ships `hawk_*` archives; the sections marked "untagged" used an earlier
> numbering that was never tagged. Names in those sections are the names of
-> the time (for example Flux was called eyrie, and several companion repos
+> the time (for example Mux was called eyrie, and several companion repos
> have since been retired).
## [Unreleased]
@@ -23,25 +23,26 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
- **windows/arm64 release archives**: GoReleaser and the CI build matrix now cover all six linux/darwin/windows × amd64/arm64 targets.
### Changed
-- **Version 0.3.0**: `VERSION` is `0.3.0`, the first release under the rho name (the Go proxy already holds the hawk-era v0.1.0–v0.2.0), and the compatibility matrix `stable` entry pins rho 0.3.0 with flux 0.0.1.
+- The module, CLI, environment variables, state paths, integrations and packaging now use Decoder, backed by the renamed Mux module; Go 1.27.2 is required.
+- The project version resets to the value in `VERSION`. Runtime defaults embed it, and package/API metadata is generated from it with CI drift checks. Historical hawk tags remain intact; explicit tags are required for the reset series.
- **Release workflow can publish**: it installs syft for the SBOMs, signs `checksums.txt` inside GoReleaser with cosign keyless signing (`checksums.txt.sigstore.json`), re-verifies the published signature, takes the release notes from this file, builds with `GOWORK=off` and `-trimpath`, and drops the unused `packages: write` permission and sibling checkout.
- **Binary size budget enforced**: `make size-check` fails above `SIZE_LIMIT_MB` (70 MiB; linux/amd64 is 59.6 MiB today) and CI runs it instead of only warning above 98 MB.
- **`make release` no longer publishes** from a workstation; releases come only from the tag-triggered workflow.
- **npm scaffolding kept unpublished**: packages are marked `"private": true` with the correct MIT license, and assembly stamps the meta package and its `optionalDependencies` and reads GoReleaser v2's output paths. Nothing is published to npm.
-- **Dependency renamed eyrie → flux**: rho now depends on
- `github.com/GrayCodeAI/flux v0.0.1` (the provider runtime was renamed).
- All imports, env vars (`EYRIE_CONFIG_DIR` → `FLUX_CONFIG_DIR`,
- `EYRIE_MODEL_CATALOG_PATH` → `FLUX_MODEL_CATALOG_PATH`), boundary-guard
+- **Dependency renamed eyrie → mux**: decoder now depends on
+ `github.com/GrayCodeAI/mux v0.0.1` (the provider runtime was renamed).
+ All imports, env vars (`EYRIE_CONFIG_DIR` → `MUX_CONFIG_DIR`,
+ `EYRIE_MODEL_CATALOG_PATH` → `MUX_MODEL_CATALOG_PATH`), boundary-guard
scripts, ecosystem manifest entries, docs, and internal identifiers were
renamed to match. User state paths move from `~/.../eyrie/provider.json`
- to `~/.../flux/provider.json`.
+ to `~/.../mux/provider.json`.
- **Makefile lint pin matches CI**: `make lint`/`lint-fix`/`setup` install `golangci-lint@v2.1.0` (was `@latest`), the same version CI enforces.
- **Docs truth and housekeeping**: SECURITY.md/CONTRIBUTING.md now describe the actual Go toolchain (golangci-lint, go vet, govulncheck) instead of the polyglot template's ruff/mypy/pip-audit/pnpm-lock language, CONTRIBUTING documents `make setup`/`boundaries`/`test-10x`/`smoke`, and the planning docs (`SPEC_DRIVEN_PLAN.md`, `SPEC_DRIVEN_PHASE2_PLAN.md`, `internal/engine/REFACTOR_PLAN.md`) moved to `docs/plans/`.
### Security
-- **`install.sh` verifies releases fail-closed**: with cosign installed it verifies `checksums.txt.sigstore.json` against the exact release-workflow identity and aborts on a missing or invalid signature; without cosign it warns and reports the signature as not verified, and `RHO_REQUIRE_COSIGN=1` makes cosign mandatory. The SHA-256 check always runs, flags are parsed strictly (unknown flags exit 2), and releases older than v0.3.0 (hawk-era archives) are refused.
-- **GitHub Action installs signed release archives** through `install.sh` with cosign required, instead of building an unverified `curl | tar` source tarball; `rho-version` accepts `0.3.0`, `v0.3.0` or `latest`, and Go is no longer needed.
-- **systemd unit**: runs as a dedicated `rho` user with state in `StateDirectory`/`CacheDirectory` (the old `%h` paths were hidden by `ProtectHome=true`), reads the daemon API key from an `EnvironmentFile` instead of the command line, and links the troubleshooting guide instead of a dead domain.
+- **`install.sh` verifies releases fail-closed**: with cosign installed it verifies `checksums.txt.sigstore.json` against the exact release-workflow identity and aborts on a missing or invalid signature; without cosign it warns and reports the signature as not verified, and `DECODER_REQUIRE_COSIGN=1` makes cosign mandatory. The SHA-256 check always runs, flags are parsed strictly (unknown flags exit 2), and known hawk-era tags are refused.
+- **GitHub Action installs signed release archives** through `install.sh` with cosign required, instead of building an unverified `curl | tar` source tarball; `decoder-version` accepts a release version with or without `v`, or `latest`, and Go is no longer needed.
+- **systemd unit**: runs as a dedicated `decoder` user with state in `StateDirectory`/`CacheDirectory` (the old `%h` paths were hidden by `ProtectHome=true`), reads the daemon API key from an `EnvironmentFile` instead of the command line, and links the troubleshooting guide instead of a dead domain.
- **Session lock TOCTOU eliminated**: `AcquireLock`'s stat → stale-if->5min → remove → O_EXCL dance could delete a live lock on misjudged staleness and let two instances open the same session. Mutual exclusion now uses an OS advisory lock (`gofrs/flock`, promoted to a direct dependency); a crashed holder's lock is reclaimed instantly because the kernel drops the flock at process death. The lock file keeps PID/timestamps purely as diagnostics.
- **Hardened atomic writes for state files**: global settings, checkpoint file contents and restores, handovers, and named checkpoints now go through `internal/safewrite` (same 0600 mode as before, plus fsync+rename atomicity and symlink refusal at the destination).
- **Dead shell-injection surface removed**: `AssumptionTracker.VerifyCommandSucceeds` ran caller-supplied strings through `sh -c`, bypassing the permission stack; it had zero callers and is deleted. `SelfHealer.RunScript` no longer shell-evaluates the script path (double evaluation) and invokes it directly via `/bin/sh`.
@@ -54,22 +55,22 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
- **Homebrew publisher and install instructions**: the `brews` stanza (deprecated in GoReleaser v2) targeted a `GrayCodeAI/homebrew-tap` repository and token that do not exist; the README no longer offers Homebrew or npm installs.
- **`flake.nix` and its `.envrc`**: the flake depended on five deleted repositories and could not evaluate.
- **ast-grep configuration** (`sgconfig.yaml`, `rules/`, lefthook hook): ast-grep never discovered the config and CI never ran it.
-- **BREAKING — `rho credentials migrate` removed**: the subcommand, its man page entry, and the `MigrateEnvFileCredentials` wrappers are gone, and `rho path` no longer reports legacy `~/.rho/env` / `~/.rho/.env` files. Save keys through `/config`.
-- **BREAKING — settings model/provider migration removed**: `LoadSettings` no longer moves `model`/`provider` from `settings.json` into Flux's `provider.json`, and `SetActiveSelection` is deleted. Stale `model`/`provider` values left in `settings.json` are now ignored on load (Flux's selection wins; `--settings` overrides still apply); select the model in `/config`.
-- **BREAKING — startup provider-secrets migration removed**: print/REPL/watch/TUI startup no longer calls `MigrateProviderSecrets`, and the method is dropped from the gateway `CatalogMaintenance` interface. `rho path` still fails when `provider.json` holds secrets; remove those fields manually.
-- **BREAKING — `shared/types` guards removed**: `scripts/check-shared-types-imports.sh`, the `contracts-guard` make target, its lefthook and CI steps, and the matching testaudit checks are deleted because the package no longer exists. The ecosystem boundary guards still block `rho/internal` imports.
+- **BREAKING — `decoder credentials migrate` removed**: the subcommand, its man page entry, and the `MigrateEnvFileCredentials` wrappers are gone, and `decoder path` no longer reports legacy `~/.decoder/env` / `~/.decoder/.env` files. Save keys through `/config`.
+- **BREAKING — settings model/provider migration removed**: `LoadSettings` no longer moves `model`/`provider` from `settings.json` into Mux's `provider.json`, and `SetActiveSelection` is deleted. Stale `model`/`provider` values left in `settings.json` are now ignored on load (Mux's selection wins; `--settings` overrides still apply); select the model in `/config`.
+- **BREAKING — startup provider-secrets migration removed**: print/REPL/watch/TUI startup no longer calls `MigrateProviderSecrets`, and the method is dropped from the gateway `CatalogMaintenance` interface. `decoder path` still fails when `provider.json` holds secrets; remove those fields manually.
+- **BREAKING — `shared/types` guards removed**: `scripts/check-shared-types-imports.sh`, the `contracts-guard` make target, its lefthook and CI steps, and the matching testaudit checks are deleted because the package no longer exists. The ecosystem boundary guards still block `decoder/internal` imports.
## [hawk 0.2.0] — 2026-07-13
### Changed
-- **Rho/Flux production boundary completed**: Rho owns the product face,
- sessions, tools, permissions, and public schemas while Flux v0.2.1 (then
- named eyrie; flux itself has only tagged v0.0.1) owns
+- **Decoder/Mux production boundary completed**: Decoder owns the product face,
+ sessions, tools, permissions, and public schemas while Mux v0.2.1 (then
+ named eyrie; mux itself has only tagged v0.0.1) owns
credentials, catalog resolution, provider transport, resilience, and usage
- telemetry behind the stable `flux/engine` facade.
+ telemetry behind the stable `mux/engine` facade.
- **Provider routing and usage attribution hardened**: resolved route changes,
continuation segments, and terminal usage are propagated without duplicate
- accounting, and production Flux calls use exactly one resilience layer.
+ accounting, and production Mux calls use exactly one resilience layer.
- **Daemon conversations are durable**: JSON and SSE chat requests create or
resume persisted sessions, expose stable session IDs, preserve metadata, and
distinguish invalid, missing, and corrupt state.
@@ -80,18 +81,18 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
- **Permission system unified into two independent axes**: the old `PermissionMode` (`default`/`acceptEdits`/`bypassPermissions`/`dontAsk`/`plan`) is removed. `/autonomy` now controls the 5-tier trust ladder (`Always Ask`/`Scout`/`Builder`/`Operator`/`Autonomous`, bare `/autonomy` opens a picker), and `/spec` controls an independent, orthogonal spec-driven workflow gate (`Specify → Plan → Tasks → ApproveImplementation`, bare `/spec` opens a picker) that blocks Write/Edit/Bash regardless of trust tier — including at Autonomous. Fixes a real bug where the old Plan Mode's write-block could be silently bypassed at high autonomy tiers, since tier and mode were checked independently with no ordering guarantee.
- **Fixed `PermissionService.SetAutonomy`/`Autonomy()`**: previously wrote to/read from a shadow field the permission engine's `CheckTool` never consulted, meaning autonomy tier changes may not have reliably taken effect. Now both read/write the same `PermissionEngine.Autonomy` field the check logic uses.
- **`--permission-mode` CLI flag removed**; `--dangerously-skip-permissions` unchanged (now maps to the Autonomous tier). New `--dry-run` flag added as an unconditional kill switch (deny every tool call, regardless of tier or spec stage) — replaces `dontAsk`'s hard-lockout role.
-- **Version re-baselined to `0.1.0`** across `cmd/rho/main.go`, `cmd/daemon.go`,
- `flake.nix`, `.github/workflows/release.yml`, and the `update`/daemon test suites, aligning rho
- with the rest of the GrayCodeAI ecosystem (`flux`, `shrike`, `harrier`, `kestrel`, `merlin`).
-- **Architecture boundary hardening**: Rho now owns runtime request/response DTOs, transport config/provider seams, and review/verification product-boundary contracts, with `flux/client` usage restricted to internal adapters and guarded in CI.
-- **`shared/types` removed**: Rho no longer ships the old shared type path, and local boundary checks now block any attempt to reintroduce it.
+- **Version re-baselined to `0.1.0`** across `cmd/decoder/main.go`, `cmd/daemon.go`,
+ `flake.nix`, `.github/workflows/release.yml`, and the `update`/daemon test suites, aligning decoder
+ with the rest of the GrayCodeAI ecosystem (`mux`, `shrike`, `harrier`, `kestrel`, `merlin`).
+- **Architecture boundary hardening**: Decoder now owns runtime request/response DTOs, transport config/provider seams, and review/verification product-boundary contracts, with `mux/client` usage restricted to internal adapters and guarded in CI.
+- **`shared/types` removed**: Decoder no longer ships the old shared type path, and local boundary checks now block any attempt to reintroduce it.
### Added
-- **Spec-driven workflow (`/spec`)**: independent, orthogonal permission gate that walks the model through `Specify → Plan → Tasks`, writing real `spec.md`/`plan.md`/`tasks.md` files to `.rho/specs//`, and requires explicit `ApproveImplementation` approval (always prompts, at any trust tier) before Write/Edit/Bash unlock. The approval prompt shows the actual written content, not a blind yes/no.
+- **Spec-driven workflow (`/spec`)**: independent, orthogonal permission gate that walks the model through `Specify → Plan → Tasks`, writing real `spec.md`/`plan.md`/`tasks.md` files to `.decoder/specs//`, and requires explicit `ApproveImplementation` approval (always prompts, at any trust tier) before Write/Edit/Bash unlock. The approval prompt shows the actual written content, not a blind yes/no.
- **`/autonomy` and `/spec` picker overlays**: bare `/autonomy` or `/spec` opens an arrow-key-navigable, filterable picker (Esc/Enter) instead of requiring subcommand syntax; typed subcommands (`/autonomy tier scout`, `/spec status`, etc.) still work.
- **Watch mode (`--watch`)**: file-watcher loop that acts on `AI!` (do-now) and `AI?` (answer) code comments. Off by default.
-- **GitHub Action** (`.github/actions/rho`): interactive mode on `@rho` mentions, automation mode on labeled issues/PRs, and skill dispatch for `/`-prefixed prompts.
-- **Messaging gateways**: opt-in Telegram, Discord, and Slack gateways on the daemon for chatting with rho from messaging apps.
+- **GitHub Action** (`.github/actions/decoder`): interactive mode on `@decoder` mentions, automation mode on labeled issues/PRs, and skill dispatch for `/`-prefixed prompts.
+- **Messaging gateways**: opt-in Telegram, Discord, and Slack gateways on the daemon for chatting with decoder from messaging apps.
- **AST repo-map** (`internal/context/repomap`): structural repository map for richer model context.
- **Auto codebase analysis on first run** (`internal/autoinit`): opt-in seeding of project context.
- **Auto-lint / auto-fix cycle**: runs the matching linter after edits and iterates on fixes with bounded retries (opt-in).
@@ -113,7 +114,7 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
### Added — Round 2 ecosystem improvements (2026-06-01)
- **Cavecrew personas** (`internal/multiagent/agents`): three new
- built-in personas built into GrayCode Rho
+ built-in personas built into GrayCode Decoder
(`cavecrew-investigator`, `cavecrew-builder`, `cavecrew-reviewer`).
Each enforces a strict output format so downstream agents can parse
outputs mechanically:
@@ -152,7 +153,7 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
and a command label. API: `Record`, `AggregateForSession`,
`ListForSession`, `PruneForSession`. Scoped to a single session so
callers can selectively compact their own history. Companion to
- shrike's `internal/tracking.Tracker` (shrike tracks globally, rho tracks
+ shrike's `internal/tracking.Tracker` (shrike tracks globally, decoder tracks
per-session).
### Added — Production Hardening (top-50 OSS parity)
@@ -187,16 +188,16 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
## [hawk 0.4.0, untagged] — 2026-05-05
### Added
-- **Exec Subcommand**: `rho exec "prompt"` — full engine non-interactive mode with `--output-format json`, `--auto` autonomy levels, `--worktree` isolation, `--agent` personas, `--session-id` resume, stdin piping
-- **Daemon Server**: `rho daemon start/stop/status` — background HTTP server with JSON + SSE streaming on `/v1/chat`, `/v1/health`, `/v1/sessions`
-- **Mission Mode**: `rho mission "prompt"` — multi-agent orchestration decomposing work into parallel features executed in isolated git worktrees. `--dry-run` for planning only
-- **Session Search**: `rho search "query"` — full-text search across all saved sessions with `--json` output
-- **Custom Agents**: `rho agent list/create/show/remove` — markdown persona definitions in `~/.rho/agents/` with YAML frontmatter (name, description, model)
-- **Snapshot System**: Shadow git tracking of every file change. `rho snapshot list/restore/diff` + `/snapshot` slash command. Auto-snapshots on every Write/Edit tool call
+- **Exec Subcommand**: `decoder exec "prompt"` — full engine non-interactive mode with `--output-format json`, `--auto` autonomy levels, `--worktree` isolation, `--agent` personas, `--session-id` resume, stdin piping
+- **Daemon Server**: `decoder daemon start/stop/status` — background HTTP server with JSON + SSE streaming on `/v1/chat`, `/v1/health`, `/v1/sessions`
+- **Mission Mode**: `decoder mission "prompt"` — multi-agent orchestration decomposing work into parallel features executed in isolated git worktrees. `--dry-run` for planning only
+- **Session Search**: `decoder search "query"` — full-text search across all saved sessions with `--json` output
+- **Custom Agents**: `decoder agent list/create/show/remove` — markdown persona definitions in `~/.decoder/agents/` with YAML frontmatter (name, description, model)
+- **Snapshot System**: Shadow git tracking of every file change. `decoder snapshot list/restore/diff` + `/snapshot` slash command. Auto-snapshots on every Write/Edit tool call
- **Waza Workflows**: `/think` (plan before code), `/hunt` (root-cause diagnosis), `/check` (pre-ship review with auto-fix), `/design` (screenshot-driven UI iteration)
- **Structured Compaction**: Summary template with Goal/Constraints/Progress/Files/Decisions/Errors/Instructions/Next sections for better intent preservation
- **Doom Loop Detection**: Lowered threshold to 3 (from 4). Two-tier escalation: first detection injects redirect prompt, doom loop hard-stops with "ask user for help"
-- **Session Persistence for exec**: All exec runs saved to `~/.rho/sessions/` and searchable via `rho search`
+- **Session Persistence for exec**: All exec runs saved to `~/.decoder/sessions/` and searchable via `decoder search`
### Packages Added
- `mission/` — Multi-agent orchestration with worktree-based parallel workers
@@ -271,5 +272,5 @@ Releases are cut by hand from a release PR; see [docs/RELEASING.md](docs/RELEASI
### Added
- Project scaffold with cobra CLI and Bubbletea TUI
- Interactive chat REPL with textarea input, spinner, lipgloss styling
-- flux wired as LLM provider dependency
+- mux wired as LLM provider dependency
- GitHub Actions CI
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index e4bb52a8b..c9fd22d4e 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -2,7 +2,7 @@
## Our pledge
-We — the maintainers and contributors of the rho project — pledge to
+We — the maintainers and contributors of the decoder project — pledge to
make participation in our community a harassment-free experience for everyone,
regardless of age, body size, visible or invisible disability, ethnicity, sex
characteristics, gender identity and expression, level of experience,
@@ -45,7 +45,7 @@ offensive, or harmful.
Instances of abusive, harassing, or otherwise unacceptable behaviour may be
reported to the maintainers via the contact in `SECURITY.md` or by opening a
confidential GitHub Security Advisory at
-. All
+. All
complaints will be reviewed and investigated promptly and fairly.
All community leaders are obligated to respect the privacy and security of
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 085d7633a..91c056b74 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,8 +1,8 @@
-# Contributing to rho
+# Contributing to decoder
Thanks for your interest! This guide covers the conventions used across the
GrayCodeAI repositories. The shared standards (versioning, release tooling, repo layout)
-are defined in .
+are defined in .
## Quick start
@@ -141,8 +141,8 @@ Before requesting review:
## Reporting bugs
-Open an issue using the bug-report template. Include the `rho`
-version (`rho --version` for binaries, `rho.Version` for
+Open an issue using the bug-report template. Include the `decoder`
+version (`decoder --version` for binaries, `decoder.Version` for
libraries — see this repo's `VERSION` file), reproduction steps, expected
behaviour, and actual behaviour.
diff --git a/Makefile b/Makefile
index 266adec94..88c137c84 100644
--- a/Makefile
+++ b/Makefile
@@ -1,18 +1,18 @@
# Canonical GrayCodeAI Makefile for Go binary repos.
# Source of truth: .shared-templates/Makefile.binary.tmpl at the eco root.
-# Placeholders rendered per repo: rho, ..
+# Placeholders rendered per repo: decoder, ..
# ---------------------------------------------------------------------------
# Project metadata
# ---------------------------------------------------------------------------
-NAME := rho
-MAIN_PKG := ./cmd/rho
+NAME := decoder
+MAIN_PKG := ./cmd/decoder
# ---------------------------------------------------------------------------
-# Versioning — sourced from VERSION file; falls back to git describe.
-# See https://github.com/GrayCodeAI/rho/blob/main/docs/versioning.md.
+# Versioning — sourced only from VERSION.
+# See https://github.com/GrayCodeAI/decoder/blob/main/docs/versioning.md.
# ---------------------------------------------------------------------------
-VERSION ?= $(shell v=$$(cat VERSION 2>/dev/null | head -n1 | tr -d '[:space:]'); if [ -n "$$v" ]; then echo "$$v"; else git describe --tags --always --dirty 2>/dev/null || echo "dev"; fi)
+VERSION := $(shell tr -d '[:space:]' < VERSION)
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "none")
DATE := $(shell date -u '+%Y-%m-%dT%H:%M:%SZ')
@@ -27,7 +27,7 @@ LDFLAGS := -s -w \
GOBIN_DIR := $(shell go env GOPATH)/bin
GOLANGCI := $(GOBIN_DIR)/golangci-lint
# Keep in sync with the pin in .github/workflows/ci.yml (lint job).
-GOLANGCI_VERSION := v2.1.0
+GOLANGCI_VERSION := v2.14.0
GOFUMPT := $(GOBIN_DIR)/gofumpt
GOIMPORTS := $(GOBIN_DIR)/goimports
GOVULNCHECK := $(GOBIN_DIR)/govulncheck
@@ -35,7 +35,7 @@ GOVULNCHECK := $(GOBIN_DIR)/govulncheck
# ---------------------------------------------------------------------------
# Phony declarations (alphabetical).
# ---------------------------------------------------------------------------
-.PHONY: all bench boundaries build check-replace ci clean ecosystem-guard feature-boundaries-guard flux-client-guard flux-engine-guard manifest-guard peer-guard internal-layers-guard package-boundaries-guard release-parity cover cover-new fmt help install lint lint-fix \
+.PHONY: all bench boundaries build check-replace ci clean ecosystem-guard feature-boundaries-guard mux-client-guard mux-engine-guard manifest-guard peer-guard internal-layers-guard package-boundaries-guard release-parity cover cover-new fmt help install lint lint-fix \
release release-check release-snapshot security setup smoke path sync test test-10x test-live test-new test-race tidy version vet api-docs api-validate workspace
check-replace: ## Fail if go.mod has local replace directives (run before tagging)
@@ -49,7 +49,7 @@ all: lint test build ## Default — lint, test, build.
# ---------------------------------------------------------------------------
# Build / install / release.
# ---------------------------------------------------------------------------
-build: ## Build the binary into bin/$(NAME).
+build: version-sync ## Build the binary into bin/$(NAME).
CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o bin/$(NAME) $(MAIN_PKG)
install: ## Install the binary to $GOBIN.
@@ -132,19 +132,19 @@ fmt-check: ## Verify formatting without rewriting files (CI-safe).
vet: ## Run go vet.
go vet ./...
-ecosystem-guard: ## Fail if external ecosystem repos import rho/internal.
+ecosystem-guard: ## Fail if external ecosystem repos import decoder/internal.
bash ./scripts/check-ecosystem-boundaries.sh
-flux-client-guard: ## Fail on any production flux/client import.
- bash ./scripts/check-flux-client-imports.sh
+mux-client-guard: ## Fail on any production mux/client import.
+ bash ./scripts/check-mux-client-imports.sh
-flux-engine-guard: ## Require all production Flux imports to use the stable engine facade.
- bash ./scripts/check-flux-engine-boundary.sh
+mux-engine-guard: ## Require all production Mux imports to use the stable engine facade.
+ bash ./scripts/check-mux-engine-boundary.sh
-peer-guard: ## Fail if support engines import each other instead of depending only on Rho contracts.
+peer-guard: ## Fail if support engines import each other instead of depending only on Decoder contracts.
bash ./scripts/check-support-repo-coupling.sh
-internal-layers-guard: ## Enforce one-way dependencies across stable Rho internal layers.
+internal-layers-guard: ## Enforce one-way dependencies across stable Decoder internal layers.
bash ./scripts/check-internal-layer-imports.sh
package-boundaries-guard: ## Enforce AST/package-graph boundaries with file/line diagnostics.
@@ -153,7 +153,7 @@ package-boundaries-guard: ## Enforce AST/package-graph boundaries with file/line
feature-boundaries-guard: ## Prevent feature packages from importing delivery or sibling features.
bash ./scripts/check-feature-boundaries.sh
-boundaries: manifest-guard check-replace ecosystem-guard feature-boundaries-guard flux-client-guard flux-engine-guard peer-guard internal-layers-guard package-boundaries-guard ## Alias for all boundary guards (matches `make boundaries` in engine repos).
+boundaries: manifest-guard check-replace ecosystem-guard feature-boundaries-guard mux-client-guard mux-engine-guard peer-guard internal-layers-guard package-boundaries-guard ## Alias for all boundary guards (matches `make boundaries` in engine repos).
release-parity: ## Verify every go.mod ecosystem version resolves to a reachable remote commit.
bash ./scripts/check-module-release-parity.sh
@@ -177,11 +177,11 @@ tidy: ## Sync workspace modules and verify checksums.
# ---------------------------------------------------------------------------
# Composite gate used by CI and pre-push.
# ---------------------------------------------------------------------------
-ci: tidy fmt-check vet boundaries lint test-race security api-validate ## Run everything CI runs.
+ci: version-check tidy fmt-check vet boundaries lint test-race security api-validate ## Run everything CI runs.
@echo "All CI checks passed."
smoke: ## Quick build + doctor + ecosystem verification.
- ./scripts/smoke-rho.sh
+ ./scripts/smoke-decoder.sh
path: ## Verify developer path (setup, security, milestone tests).
./scripts/verify-developer-path.sh
@@ -205,7 +205,7 @@ workspace: ## Regenerate the ecosystem root go.work from ecosystem.yaml.
@bash ./scripts/generate-workspace.sh
setup: workspace ## Set up local development environment and development tools.
- @echo "=== Setting up rho development environment ==="
+ @echo "=== Setting up decoder development environment ==="
@echo "✓ go.work generated and synced from ecosystem.yaml"
@echo ""
@echo "=== Environment check ==="
@@ -231,7 +231,7 @@ help: ## Show this help.
@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-15s\033[0m %s\n", $$1, $$2}'
# ---------------------------------------------------------------------------
-# Compatibility matrix (rho-specific extension to the canonical template).
+# Compatibility matrix (decoder-specific extension to the canonical template).
# Validates compatibility-matrix.json and reports the resolved versions for
# a chosen matrix entry. Wired into the compatibility-test workflow.
# ---------------------------------------------------------------------------
@@ -243,7 +243,7 @@ compat-test: ## Validate testdata/compatibility-matrix.json and report the 'next
compat-check: ## Strict validation — non-zero exit if any component lacks a version.
@go run ./cmd/compat-test -matrix=next -strict -file=testdata/compatibility-matrix.json
-compat-drift: ## Advisory: report pin drift between Rho and sibling repositories. Never fails.
+compat-drift: ## Advisory: report pin drift between Decoder and sibling repositories. Never fails.
@go run ./cmd/compat-test -check-external -file=testdata/compatibility-matrix.json
.PHONY: hooks sync
@@ -284,3 +284,10 @@ size-check: build ## Fail if bin/$(NAME) (release ldflags) exceeds SIZE_LIMIT_MB
echo "::error::Binary size $$(( size / 1048576 )) MiB exceeds the $(SIZE_LIMIT_MB) MiB budget (Makefile SIZE_LIMIT_MB)"; \
exit 1; \
fi
+
+.PHONY: version-sync version-check
+version-sync: ## Regenerate package/API metadata from VERSION.
+ python3 scripts/sync-version.py
+
+version-check: ## Reject stale generated version metadata.
+ python3 scripts/sync-version.py --check
diff --git a/README.md b/README.md
index 221bc2d0a..5291938f8 100644
--- a/README.md
+++ b/README.md
@@ -5,11 +5,11 @@
-# rho Architecture
+# decoder Architecture
**AI Coding Agent for Your Terminal**
-[](https://go.dev/)
+[](https://go.dev/)
[](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)
[](https://swagger.io/specification/)
@@ -14,19 +14,19 @@
## Overview
-rho is an AI-powered coding agent for the terminal. It reads codebases, writes and edits files, runs tests, and manages git — all through natural language. Zero CGO, single static binary for linux/darwin/windows on amd64/arm64.
+decoder is an AI-powered coding agent for the terminal. It reads codebases, writes and edits files, runs tests, and manages git — all through natural language. Zero CGO, single static binary for linux/darwin/windows on amd64/arm64.
-Detailed planning docs for the Rho product architecture live in [`docs/architecture/`](architecture/README.md).
+Detailed planning docs for the Decoder product architecture live in [`docs/architecture/`](architecture/README.md).
---
## Layered Architecture
```
-rho/
+decoder/
├── api/openapi.yaml Daemon REST API contract (OpenAPI 3.1)
├── cmd/ Cobra CLI commands (200+ files)
-│ ├── rho/main.go Entry point — calls cmd.Execute()
+│ ├── decoder/main.go Entry point — calls cmd.Execute()
│ ├── root.go Root command, flag definitions
│ ├── daemon.go Daemon start/stop/status
│ ├── chat.go Interactive TUI chat
@@ -61,8 +61,8 @@ rho/
| | |
|---|---|
| **Contract** | [`api/openapi.yaml`](../api/openapi.yaml) |
-| **Port** | `:4590` (default). Override: `RHO_DAEMON_PORT` |
-| **Auth** | Bearer token or `X-API-Key`. Set via `RHO_DAEMON_API_KEY` |
+| **Port** | `:4590` (default). Override: `DECODER_DAEMON_PORT` |
+| **Auth** | Bearer token or `X-API-Key`. Set via `DECODER_DAEMON_API_KEY` |
Endpoint Summary
@@ -86,7 +86,7 @@ rho/
| Service | Role | Connection |
|---------|------|------------|
-| **flux** | LLM provider runtime | Library — all LLM calls routed through its engine facade |
+| **mux** | LLM provider runtime | Library — all LLM calls routed through its engine facade |
| **token** | Token optimization | Embedded — counting, compression, secrets, usage tracking |
### Client SDKs
@@ -99,7 +99,7 @@ rho/
All three SDKs share types from **eagle** and consume the daemon REST API (:4590).
-> **rho never talks to LLM APIs directly** — all calls go through flux.
+> **decoder never talks to LLM APIs directly** — all calls go through mux.
---
@@ -117,9 +117,9 @@ Tool Call → ` — persisted Rho session;
-- `rho/task-request//` — user task request, content represented by
+- `decoder/session/` — persisted Decoder session;
+- `decoder/task-request//` — user task request, content represented by
SHA-256 only;
-- `rho/task/` — structured task;
-- `rho/runtime-task/` — background agent, shell, or monitor task;
-- `rho/tool-call//` — tool invocation metadata;
-- `rho/policy/` — permission verdict;
-- `rho/verification/` — neutral verification result;
-- `flux/route/` and `flux/generation/` — model route and
+- `decoder/task/` — structured task;
+- `decoder/runtime-task/` — background agent, shell, or monitor task;
+- `decoder/tool-call//` — tool invocation metadata;
+- `decoder/policy/` — permission verdict;
+- `decoder/verification/` — neutral verification result;
+- `mux/route/` and `mux/generation/` — model route and
normalized generation operations.
Edges:
@@ -120,15 +120,15 @@ The export deliberately excludes:
Where correlation is useful, sensitive values are represented by SHA-256
digests. Every node declares `data_classification=metadata_only`.
-Rho writes runtime observations to a per-session append-only JSONL journal.
-The journal is stored with mode `0600` under Rho's state directory and contains
+Decoder writes runtime observations to a per-session append-only JSONL journal.
+The journal is stored with mode `0600` under Decoder's state directory and contains
only verdict metadata, aggregate verification counts, and SHA-256 digests. A
journal failure is logged and never changes a permission, approval, or tool
result.
Mission-mode graph execution persists a separate `mission-graph.json` artifact
beside `mission.json` in the mission directory. The artifact uses the same
-portable `rho.graph/v1` envelope, but it is mission-scoped rather than
+portable `decoder.graph/v1` envelope, but it is mission-scoped rather than
session-scoped: mission node, feature nodes, and wave-join operations nodes are
rewritten after each mission run or wave join using only metadata and SHA-256
digests.
@@ -136,7 +136,7 @@ digests.
## CLI
```bash
-rho graph export [session-id]
+decoder graph export [session-id]
--repository
```
@@ -155,18 +155,18 @@ GET /v1/sessions/{id}/graph
The endpoint uses the daemon's normal Bearer or `X-API-Key` authentication,
validates session and repository inputs before projection, and
-returns the typed `rho.graph/v1` envelope. The handler owns transport concerns
-only; the Rho composition root injects the existing graph builder, so CLI,
+returns the typed `decoder.graph/v1` envelope. The handler owns transport concerns
+only; the Decoder composition root injects the existing graph builder, so CLI,
Cloud sync, and HTTP projections share one construction path.
The Go, Python sync/async, and TypeScript SDK clients expose this endpoint and
validate the returned graph topology before returning it to callers.
-After connecting a project with `rho cloud login` or `rho cloud connect`, a
+After connecting a project with `decoder cloud login` or `decoder cloud connect`, a
completed session snapshot can be uploaded explicitly:
```bash
-rho cloud graph sync [session-id]
+decoder cloud graph sync [session-id]
--repository
```
@@ -175,18 +175,18 @@ keys to `*_sha256`, enforces the 250-node/500-edge/500-event/900-total-fact and
1 MiB limits, and derives the sync ID from the prepared graph. Repeating the
same completed snapshot is therefore idempotent. Upload errors are reported to
the explicit command, but cloud availability never affects local execution.
-Rho does not upload prompt bodies, response bodies, tool arguments, tool
+Decoder does not upload prompt bodies, response bodies, tool arguments, tool
results, or other large artifacts.
Mission-scoped graph artifacts can use the same explicit path without being
-pretended to be a Rho session:
+pretended to be a Decoder session:
```bash
-rho graph export --mission-dir
-rho cloud graph sync --mission-dir
+decoder graph export --mission-dir
+decoder cloud graph sync --mission-dir
```
-The CLI reads only `mission-graph.json`, validates its `rho.graph/v1` schema
+The CLI reads only `mission-graph.json`, validates its `decoder.graph/v1` schema
and all edge/event references, then applies the same privacy normalization and
Cloud limits. Mission graphs intentionally omit `sessionId`; they are durable
mission facts, not Cloud session telemetry.
@@ -202,15 +202,15 @@ The central tool-execution seam automatically records:
- secret matches removed from persisted-session responses;
- token usage summaries and budget decisions emitted from the central,
deduplicated provider-accounting seam;
-- Flux model route and usage reported for persisted-session turns.
+- Mux model route and usage reported for persisted-session turns.
Mission execution now also persists a portable graph artifact for local mission
-runs. Plain `rho mission` runs emit mission and feature execution nodes; the
-graph-driven `rho mission --from-tasks` path additionally emits operations
+runs. Plain `decoder mission` runs emit mission and feature execution nodes; the
+graph-driven `decoder mission --from-tasks` path additionally emits operations
nodes for each deterministic wave join, including bounded completion, failure,
and blocked-downstream counts.
The embedded token-pipeline tracker contributes hourly, daily, session, and cost
-limits to the pre-turn guard. Existing Rho cost accounting and limits remain
+limits to the pre-turn guard. Existing Decoder cost accounting and limits remain
authoritative and are updated first; the tracker observes the same deduplicated
request usage and provides the additional token-window decision.
diff --git a/docs/architecture/frontend-contract.md b/docs/architecture/frontend-contract.md
index 526c1cef6..a2fa4d170 100644
--- a/docs/architecture/frontend-contract.md
+++ b/docs/architecture/frontend-contract.md
@@ -1,6 +1,6 @@
# Frontend contract
-Rho has one agent brain and several frontends. They meet at a single typed
+Decoder has one agent brain and several frontends. They meet at a single typed
channel: `engine.StreamEvent`. This document defines that boundary so the TUI,
daemon, ACP server, and print mode stay swappable — the discipline Tau calls
"events are the contract."
diff --git a/docs/architecture/graycode-ecosystem-summary.md b/docs/architecture/graycode-ecosystem-summary.md
index e1725dca5..ffc3c0c0f 100644
--- a/docs/architecture/graycode-ecosystem-summary.md
+++ b/docs/architecture/graycode-ecosystem-summary.md
@@ -1,12 +1,12 @@
# GrayCode Ecosystem Summary
> **Historical.** This document describes the pre-2026-09 multi-engine
-> ecosystem. Rho now depends only on `flux` and embeds its own token engine;
+> ecosystem. Decoder now depends only on `mux` and embeds its own token engine;
> the harrier, kestrel, merlin, shrike, and swift integrations have been
> removed. Kept for record.
-`graycode-eco` is only a local parent folder. `rho` is the main CLI and the
-only primary Rho product; the other repositories provide capabilities,
+`graycode-eco` is only a local parent folder. `decoder` is the main CLI and the
+only primary Decoder product; the other repositories provide capabilities,
contracts, integrations, tooling, or optional platform services.
## Repository layers
@@ -15,18 +15,18 @@ contracts, integrations, tooling, or optional platform services.
API consumers/extensions
sparrow robin wren starling
\ | | /
- rho
+ decoder
(main CLI and daemon)
|
Support engines
- flux harrier shrike swift kestrel merlin
+ mux harrier shrike swift kestrel merlin
|
Foundations
eagle falcon
Outside the Go runtime graph
owl architecture tooling
- graycode-platform web, BFF, and Rho Cloud Worker
+ graycode-platform web, BFF, and Decoder Cloud Worker
```
Product labels map to directories as follows: `harrier`/Harrier, `shrike`/Shrike,
@@ -35,42 +35,42 @@ Product labels map to directories as follows: `harrier`/Harrier, `shrike`/Shrike
## Dependency direction
```text
-rho -> flux / harrier / shrike / swift / kestrel / merlin / eagle
+decoder -> mux / harrier / shrike / swift / kestrel / merlin / eagle
engines -> eagle # when shared contracts are needed
harrier / kestrel / merlin -> falcon
-sparrow / robin / wren -> Rho daemon API
-starling -> Rho skill/plugin API
+sparrow / robin / wren -> Decoder daemon API
+starling -> Decoder skill/plugin API
```
-Forbidden edges are engine-to-engine, engine-to-Rho-internal, SDK-to-engine,
+Forbidden edges are engine-to-engine, engine-to-Decoder-internal, SDK-to-engine,
skills-to-engine, and any Go-module dependency on GrayCode Platform.
## Runtime and hosted plane
```text
-Rho main CLI
- ├── Flux provider execution
+Decoder main CLI
+ ├── Mux provider execution
├── Harrier memory
├── Shrike token/context management
├── Swift swift/provenance
├── Kestrel review
└── Merlin verification
-rho ── optional authenticated HTTP ──> graycode-platform/apps/worker
+decoder ── optional authenticated HTTP ──> graycode-platform/apps/worker
web ──> graycode-platform/apps/bff ── private Service Binding ──> worker
worker ──> control-plane D1 + usage Queue + R2
```
The Worker is deployed as `graycode-cloud`, but that is an application name,
-not a repository. GrayCode Platform remains outside the Rho Go module graph.
-Rho's cloud usage path is fail-open; graph synchronization is explicit.
+not a repository. GrayCode Platform remains outside the Decoder Go module graph.
+Decoder's cloud usage path is fail-open; graph synchronization is explicit.
## Repository roles
| Repository | Role | Direct dependency rule |
|---|---|---|
-| `rho` | Main CLI, daemon, orchestration, policy | Integrates engines and contracts |
-| `flux` | Provider runtime | Uses Eagle contracts; exposes `engine` |
+| `decoder` | Main CLI, daemon, orchestration, policy | Integrates engines and contracts |
+| `mux` | Provider runtime | Uses Eagle contracts; exposes `engine` |
| `harrier` | Harrier memory | Uses Eagle/Falcon where required |
| `shrike` | Shrike context engine | Uses Eagle where required |
| `swift` | Swift/provenance | Uses Eagle where required |
@@ -78,10 +78,10 @@ Rho's cloud usage path is fail-open; graph synchronization is explicit.
| `merlin` | Merlin verification | Uses Eagle and Falcon |
| `eagle` | Neutral shared contracts | Leaf module |
| `falcon` | MCP kit | Upstream MCP library only |
-| `sparrow` | Go SDK | Rho API contract |
-| `robin` | Python SDK | Rho API contract |
-| `wren` | TypeScript SDK | Rho API contract |
-| `starling` | Skills/extensions | Rho skill surface |
+| `sparrow` | Go SDK | Decoder API contract |
+| `robin` | Python SDK | Decoder API contract |
+| `wren` | TypeScript SDK | Decoder API contract |
+| `starling` | Skills/extensions | Decoder skill surface |
| `owl` | Architecture explorer | Generated read-only projection |
| `graycode-platform` | Web/BFF/cloud | HTTP and Service Binding only |
@@ -90,6 +90,6 @@ Rho's cloud usage path is fail-open; graph synchronization is explicit.
The repository-level target is implemented: independent Git repositories,
canonical manifest, generated Owl inventory, sibling Go workspace, Eagle parity,
and dependency boundary checks are all present. Remaining work is to publish
-the Eagle-compatible Flux revision, remove the transitional
-`rho-core-contracts` dependency from the standalone graph, and decide whether
-Rho's graph/projection packages need additional engine-owned facades.
+the Eagle-compatible Mux revision, remove the transitional
+`decoder-core-contracts` dependency from the standalone graph, and decide whether
+Decoder's graph/projection packages need additional engine-owned facades.
diff --git a/docs/architecture/plan.md b/docs/architecture/plan.md
index ac343cf3f..31daab6c3 100644
--- a/docs/architecture/plan.md
+++ b/docs/architecture/plan.md
@@ -1,8 +1,8 @@
-# Rho Architecture - Technical Plan
+# Decoder Architecture - Technical Plan
## Overview
-This plan defines the technical approach for implementing the rho architecture specification. The architecture is already largely implemented; this plan documents the existing design decisions and identifies gaps.
+This plan defines the technical approach for implementing the decoder architecture specification. The architecture is already largely implemented; this plan documents the existing design decisions and identifies gaps.
## Architecture Decisions
@@ -151,7 +151,7 @@ services; it is not a claim that those fields have already moved.
## Dependencies
-- **flux:** LLM provider engine behind `flux/engine` (workspace sibling)
+- **mux:** LLM provider engine behind `mux/engine` (workspace sibling)
- **harrier:** Graph-based persistent memory (workspace sibling)
- **shrike:** Tokenizer, compression (workspace sibling)
- **eagle:** Shared types (workspace sibling)
diff --git a/docs/architecture/spec.md b/docs/architecture/spec.md
index 420952949..6296bbcea 100644
--- a/docs/architecture/spec.md
+++ b/docs/architecture/spec.md
@@ -1,8 +1,8 @@
-# Rho Architecture Specification
+# Decoder Architecture Specification
## Problem Statement
-Rho is an AI-powered coding agent for the terminal. This specification defines the complete architecture: repository structure, agent loop, agile workflow, feedback loops, and edge case handling. It serves as the authoritative reference for how rho works.
+Decoder is an AI-powered coding agent for the terminal. This specification defines the complete architecture: repository structure, agent loop, agile workflow, feedback loops, and edge case handling. It serves as the authoritative reference for how decoder works.
## Scope
@@ -20,15 +20,15 @@ Rho is an AI-powered coding agent for the terminal. This specification defines t
### REQ-1: Repository Structure
-Rho SHALL be organized as a Go repository and workspace entry point within a
-multi-repository ecosystem. The Rho repository has the following top-level
+Decoder SHALL be organized as a Go repository and workspace entry point within a
+multi-repository ecosystem. The Decoder repository has the following top-level
layout:
| Directory | Purpose |
|-----------|---------|
| `cmd/` | CLI entry point (Cobra) and TUI (Bubble Tea) |
| `internal/` | Private Go packages (not importable by external repos) |
-| Parent `go.work` | Resolves the nine local Go siblings: rho, eagle, falcon, flux, harrier (Harrier), shrike (Shrike), swift (Swift), kestrel (Kestrel), and merlin (Merlin) |
+| Parent `go.work` | Resolves the nine local Go siblings: decoder, eagle, falcon, mux, harrier (Harrier), shrike (Shrike), swift (Swift), kestrel (Kestrel), and merlin (Merlin) |
| `spec/` | OpenSpec schema consumed by `internal/spec` |
| `docs/` | Architecture docs, design docs, plans |
| `rules/` | User-defined rules |
@@ -44,7 +44,7 @@ The `internal/` directory SHALL contain the following packages:
| `tool/` | 40+ built-in tools (file edit, git, codegen, spec tools, etc.) |
| `permissions/` | Guardian, rules DSL, boundary checker |
| `plugin/` | Skills loader, registry, auto-skill, marketplace install |
-| `config/` | Product settings, Flux composition, state migration |
+| `config/` | Product settings, Mux composition, state migration |
| `session/` | SQLite persistence, search, export, replay |
| `hooks/` | Event-driven plugin system |
| `mcp/` | Model Context Protocol client/server |
@@ -73,7 +73,7 @@ The `internal/engine/` package SHALL contain the following sub-systems:
|------------|---------|
| `stream.go` | The agent loop (agentLoop) - main orchestration |
| `session.go` | Session struct and sub-services |
-| `chat_service.go` | Rho ChatClient port, engine adapter coordination, compact |
+| `chat_service.go` | Decoder ChatClient port, engine adapter coordination, compact |
| `safety/` | Permission engine, trust tiers, spec gate |
| `compact/` | Context compaction (collapse, micro, smart, truncate) |
| `ctxmgr/` | Context providers, packing, visualization |
@@ -93,17 +93,17 @@ The `internal/engine/` package SHALL contain the following sub-systems:
Provider boundary invariant:
```text
-Rho CLI/TUI + conversation + tools
+Decoder CLI/TUI + conversation + tools
|
- Rho-owned ports/DTOs
+ Decoder-owned ports/DTOs
|
v
- flux/engine
+ mux/engine
credentials -> catalog -> routing -> generate/stream
```
-No production Rho package may import a lower Flux package. Custom gateways
-are supplied per Engine instance, and Flux DTOs are not Rho persistence or
+No production Decoder package may import a lower Mux package. Custom gateways
+are supplied per Engine instance, and Mux DTOs are not Decoder persistence or
CLI output schemas.
### REQ-4: Agent Loop Lifecycle
@@ -128,7 +128,7 @@ The agent loop in `stream.go` SHALL execute the following phases:
6. Refresh Harrier memories
7. Build LLM ChatOptions (system prompt, tools, model)
8. Inject ephemeral context (beliefs, matched skills, spec stage)
-9. Execute the LLM call via `ChatService.Stream()` and the `flux/engine` adapter
+9. Execute the LLM call via `ChatService.Stream()` and the `mux/engine` adapter
10. Process response (tool calls, messages, cost tracking)
11. Check termination conditions
diff --git a/docs/architecture/tasks.md b/docs/architecture/tasks.md
index 0a5193e6e..21ff441b3 100644
--- a/docs/architecture/tasks.md
+++ b/docs/architecture/tasks.md
@@ -1,7 +1,7 @@
-# Rho Architecture - Implementation Tasks
+# Decoder Architecture - Implementation Tasks
> **Historical.** This was the initial architecture implementation checklist.
-> It is superseded by `rho-architecture-v1-definition-of-done.md`, which
+> It is superseded by `decoder-architecture-v1-definition-of-done.md`, which
> reflects the current shipping bar. Kept for record; do not use as a
> current TODO list.
diff --git a/docs/compatibility.md b/docs/compatibility.md
index ccc9e627e..5f675e689 100644
--- a/docs/compatibility.md
+++ b/docs/compatibility.md
@@ -12,19 +12,20 @@ Platform/provider capability metadata is separate: [`platform-capabilities.json`
```jsonc
{
- "components": ["rho", "flux", ...], // canonical eco roster
- "dependencies": { "rho": ["flux", ...] }, // who depends on who
+ "components": ["decoder", "mux", ...], // canonical eco roster
+ "dependencies": { "decoder": ["mux", ...] }, // who depends on who
"matrices": [
- { "name": "stable", "components": { "rho": "0.1.0", "flux": "0.1.0", ... } },
- { "name": "next", "components": { "rho": "main", "flux": "main", ... } }
+ { "name": "stable", "components": { "decoder": "0.1.0", "mux": "0.1.0", ... } },
+ { "name": "next", "components": { "decoder": "main", "mux": "main", ... } }
]
}
```
-Two named matrices:
+Supported matrix names:
-- **`stable`** — the most recent combination of released versions that has
- been tested end-to-end. New users getting "the eco" install these versions.
+- **`stable`** — reserved for the most recent combination of released versions
+ tested end-to-end. It is currently omitted because the existing tags declare
+ different module paths; add it after both renamed modules have releases.
- **`next`** — the bleeding edge: the latest commit on each repo's `main`
branch. CI runs the integration tests against this matrix on every PR to
any eco repo.
@@ -48,7 +49,7 @@ existing consumers.
`.shared-templates/workflows/compatibility-test.yml.tmpl` is a reusable
workflow that:
-1. Reads `testdata/compatibility-matrix.json` from the rho repo.
+1. Reads `testdata/compatibility-matrix.json` from the decoder repo.
2. Checks out each component at the version listed in the named matrix.
3. Builds + tests the cross-repo integration scenarios.
@@ -59,7 +60,7 @@ It runs on:
## Why bother
-- **Bug reports become triageable.** "I ran rho 0.4 with flux 0.2" — you
+- **Bug reports become triageable.** "I ran decoder 0.4 with mux 0.2" — you
immediately know whether that combination was ever tested.
- **Consumers can pin reliably.** Downstream projects that vendor multiple
eco packages can pin to a known-good stable matrix instead of guessing.
@@ -70,17 +71,17 @@ It runs on:
## Pin freshness (advisory)
-Separate from the matrix above: `rho`'s own `go.mod` directly pins shared
+Separate from the matrix above: `decoder`'s own `go.mod` directly pins shared
leaf dependencies, and sibling-repository consumers can pin the *same*
dependencies independently in their own `go.mod`. Go's minimal version
-selection means whatever `rho` pins wins in `rho`'s own build — but if a
+selection means whatever `decoder` pins wins in `decoder`'s own build — but if a
consumer's own pin is older, that consumer's CI has never actually tested the
version that ships. This is exactly the kind of drift that let a real bug
through in July 2026 (a stale goreleaser pin sat unnoticed until the first
tag push exercised it).
`make compat-drift` (wired into this workflow as an advisory, non-blocking
-step) reports any such mismatch by comparing `rho/go.mod` against each
+step) reports any such mismatch by comparing `decoder/go.mod` against each
`..//go.mod`:
```bash
@@ -89,7 +90,7 @@ make compat-drift
This **never fails the build** — it's a signal for humans to notice and
re-pin the consumer, not a gate. It checks sibling repositories when they are
-present; a Rho-only checkout simply reports no local consumers to compare.
+present; a Decoder-only checkout simply reports no local consumers to compare.
## Validating the file
diff --git a/docs/design/RHO-CLOUD-SAAS.md b/docs/design/DECODER-CLOUD-SAAS.md
similarity index 89%
rename from docs/design/RHO-CLOUD-SAAS.md
rename to docs/design/DECODER-CLOUD-SAAS.md
index ba1ce97cf..1342310c2 100644
--- a/docs/design/RHO-CLOUD-SAAS.md
+++ b/docs/design/DECODER-CLOUD-SAAS.md
@@ -1,4 +1,4 @@
-# Rho Cloud — Hosted Execution Plane (Design Doc)
+# Decoder Cloud — Hosted Execution Plane (Design Doc)
**Status:** Draft / Proposal
**Author:** Platform team
@@ -9,17 +9,17 @@
## 1. Overview & Competitive Context
-Rho today is a terminal-native, single-user, privacy-first Go binary. The daemon
-(`rho/internal/daemon/daemon.go`) exposes a small HTTP API — `POST /v1/chat`
+Decoder today is a terminal-native, single-user, privacy-first Go binary. The daemon
+(`decoder/internal/daemon/daemon.go`) exposes a small HTTP API — `POST /v1/chat`
with optional SSE streaming, plus session CRUD — bound to loopback
(`netutil.LoopbackHost`, port `4590` by default) and protected by a single
optional shared API key (`Server.apiKey`, compared in `daemon.go:185-205`). There
is no notion of a user, an org, a tenant, a credit balance, or remote isolated
-execution. Rho does not provide a container or OS sandbox runtime; commands
+execution. Decoder does not provide a container or OS sandbox runtime; commands
run on the host behind the permission engine and tool-level path guards.
-This doc designs **Rho Cloud**: a hosted, multi-tenant execution plane that runs
-the rho agent as a managed service, authenticated by OAuth and API keys, metered
+This doc designs **Decoder Cloud**: a hosted, multi-tenant execution plane that runs
+the decoder agent as a managed service, authenticated by OAuth and API keys, metered
and billed by credits, organized into team workspaces with org RBAC, and backed by
cloud sandboxed execution (E2B-/Daytona-style microVMs) instead of the user's
local Docker. It also covers the two surfaces that depend on this plane: a
@@ -28,7 +28,7 @@ browser/web chat-editing UI served from the daemon, and IDE extensions
### Which Top-20 repos ship this
-From `TOP20_COMPARISON.md`, the rho P0 table (lines 27-37) and P2 table
+From `TOP20_COMPARISON.md`, the decoder P0 table (lines 27-37) and P2 table
(lines 70-86) name these directly:
| Capability | Top-20 repos that ship it | Comparison ref |
@@ -43,11 +43,11 @@ From `TOP20_COMPARISON.md`, the rho P0 table (lines 27-37) and P2 table
The comparison doc is blunt that this is a **fundamental product-tier gap**
(`TOP20_COMPARISON.md:33`) — the single largest item in the report — and that org
RBAC "requires a multi-tenant SaaS backend ... beyond the current single-user
-token store at `/rho/internal/auth/auth.go`" (`TOP20_COMPARISON.md:72`).
+token store at `/decoder/internal/auth/auth.go`" (`TOP20_COMPARISON.md:72`).
-The flux side of the house has the parallel gaps: a LiteLLM-compatible proxy
+The mux side of the house has the parallel gaps: a LiteLLM-compatible proxy
endpoint and "multi-tenant team/project management with SSO/RBAC" with per-key
-budgets (`TOP20_COMPARISON.md:95-96`). Rho Cloud and flux multi-tenancy share
+budgets (`TOP20_COMPARISON.md:95-96`). Decoder Cloud and mux multi-tenancy share
the same identity, billing, and RBAC substrate; this doc designs that substrate
once and shows how both consume it.
@@ -68,13 +68,13 @@ once and shows how both consume it.
`sync.Map` (`daemon.go:35`). Net-new: a routing layer that maps tenant → session
→ execution worker.
4. **Billing / credit system.** Meter token spend and sandbox-minutes per tenant,
- price normalized usage with Rho Cloud's versioned server catalog, enforce
+ price normalized usage with Decoder Cloud's versioned server catalog, enforce
hard limits, and bill from the authoritative cloud ledger.
5. **Team workspaces & conversation sharing.** Shared, permissioned session state;
read-only and continue-able shares.
6. **Org RBAC** with Member / Admin / Owner tiers, invitations, and org-scoped
credit pools and provider config.
-7. **Cloud-isolated execution.** Keep local rho host-native and, if this
+7. **Cloud-isolated execution.** Keep local decoder host-native and, if this
proposal is implemented, run cloud workers in on-demand isolated microVMs
(E2B/Daytona/Firecracker) behind a new cloud-only boundary.
8. **Browser/web UI** for chat-driven editing, served from the plane, consuming
@@ -83,14 +83,14 @@ once and shows how both consume it.
### Non-Goals
-- **Not** replacing the local/offline single-binary mode. Local rho remains
+- **Not** replacing the local/offline single-binary mode. Local decoder remains
fully functional with zero cloud dependency; cloud is strictly additive. The
privacy-first posture (`TOP20_COMPARISON.md:20`) is preserved — cloud is opt-in.
- **Not** building our own microVM hypervisor. We integrate E2B/Daytona (build-vs-buy
in §6), not write Firecracker orchestration from scratch.
-- **Not** an LLM gateway rewrite. Flux remains the provider engine behind
- Rho's `flux/engine` integration; the plane calls a Rho agent worker, which
- composes Flux. The plane does not re-implement routing, caching, or provider
+- **Not** an LLM gateway rewrite. Mux remains the provider engine behind
+ Decoder's `mux/engine` integration; the plane calls a Decoder agent worker, which
+ composes Mux. The plane does not re-implement routing, caching, or provider
adapters.
- **Not** SSO/SAML in P0 (deferred to P2; OIDC social login + API keys first).
- **Not** on-prem/self-hosted enterprise distribution in P0 (P2).
@@ -104,7 +104,7 @@ once and shows how both consume it.
```
┌────────────────────────────────────────┐
- Browser UI ──┐ │ Rho Cloud │
+ Browser UI ──┐ │ Decoder Cloud │
IDE (ACP) ──┼──TLS──▶│ │
CLI (token)──┘ │ ┌──────────────┐ ┌────────────────┐ │
│ │ Edge / API │ │ Identity svc │ │
@@ -122,7 +122,7 @@ once and shows how both consume it.
│ │ │
│ ▼ │
│ ┌──────────────┐ ┌─────────────┐ │
- │ │ Agent Worker │─────▶│ flux │ │
+ │ │ Agent Worker │─────▶│ mux │ │
│ │ (engine. │ │ (model │ │
│ │ Session) │ │ runtime) │ │
│ └──────┬───────┘ └─────────────┘ │
@@ -144,8 +144,8 @@ middleware (`daemon.go:185`) and `routes()` table (`daemon.go:174-183`).
Net-new. Wraps/extends `internal/auth` (see §4).
**Billing service** — credit ledger, metering ingestion, server-side pricing,
-hard-limit enforcement, and invoicing. Rho Cloud owns this authority; Flux
-supplies normalized model and token usage through Rho's Engine boundary.
+hard-limit enforcement, and invoicing. Decoder Cloud owns this authority; Mux
+supplies normalized model and token usage through Decoder's Engine boundary.
**Workspace service** — workspace membership, shared session state, share links,
permission checks for view/continue.
@@ -156,13 +156,13 @@ of the daemon's `sessions sync.Map` (`daemon.go:35`).
**Agent Worker** — a process (or pod) running `engine.NewSessionWithClient(...)`
(`internal/engine/session.go:137`) and driving `Session.Stream(ctx)`
-(`internal/engine/stream.go:20`). This is the existing rho agent loop, unchanged,
+(`internal/engine/stream.go:20`). This is the existing decoder agent loop, unchanged,
running server-side. One worker handles one active session at a time (worktree-per-
session isolation), matching the existing single-user model — we scale by running
many workers, not by making one worker multi-tenant.
**Cloud execution provider** — a future `CloudSandbox` boundary backed by
-E2B/Daytona. This is intentionally net-new cloud code; local rho has no
+E2B/Daytona. This is intentionally net-new cloud code; local decoder has no
container executor or sandbox backend to reuse.
### 3.2 Data Model
@@ -197,11 +197,11 @@ credit_ledger(id, org_id, ts, delta_credits, reason, ref_session_id, ref_meter_i
meter_events(id, org_id, workspace_id, session_id, ts, kind,
tokens_in, tokens_out, model, sandbox_ms, cost_usd, credits,
pricing_catalog_version)
- -- kind ∈ {llm, sandbox}; cost_usd is priced by Rho Cloud
+ -- kind ∈ {llm, sandbox}; cost_usd is priced by Decoder Cloud
```
`meter_events.cost_usd` is computed from normalized model/token dimensions by
-Rho Cloud's versioned pricing catalog. Client-side estimates may be displayed
+Decoder Cloud's versioned pricing catalog. Client-side estimates may be displayed
or audited, but never affect credits or invoices.
### 3.3 API Surface
@@ -257,7 +257,7 @@ Edge: check credit balance(org) > floor [Billing svc] ← rejec
Edge → Router: route(org, ws, user, session_id?)
Router → Worker: acquire/lease Agent Worker (+ Sandbox)
Worker: engine.Session.Stream(ctx) [stream.go:20]
-Worker → flux: Chat/StreamChat with ctx carrying virtual key
+Worker → mux: Chat/StreamChat with ctx carrying virtual key
(WithVirtualKey, budget_provider.go:23)
Worker → Edge: SSE content events (daemon.go:321-337, reused verbatim)
Edge → Client: SSE relay
@@ -268,9 +268,9 @@ Billing: append credit_ledger debit; if balance ≤ 0 → signal Worker
**B. OAuth login (browser UI / IDE)**
PKCE authorization-code grant for the web UI; **device grant for the CLI/IDE** —
-rho already implements RFC 8628 device flow end-to-end
+decoder already implements RFC 8628 device flow end-to-end
(`internal/auth/device_flow.go`: `RequestCode`, `PollForToken`,
-`exchangeCode`). Rho Cloud stands up the *server* side of these grants; the
+`exchangeCode`). Decoder Cloud stands up the *server* side of these grants; the
client side is largely present.
**C. Share a conversation**
@@ -304,7 +304,7 @@ This is the crux: **what is reusable today vs. net-new.**
### Reusable today (high leverage)
-| Existing asset | File | How Rho Cloud reuses it |
+| Existing asset | File | How Decoder Cloud reuses it |
|---|---|---|
| Engine session + agent loop | `internal/engine/session.go:42,132,137`, `internal/engine/stream.go:20` | The Agent Worker *is* `engine.Session.Stream`. No change to the agent loop — it already runs headless with a `SessionFactory` (`daemon.go:27`). |
| HTTP daemon + routes + SSE | `internal/daemon/daemon.go:174-183, 315-337` | The Edge/API gateway is the daemon's `routes()`/`handleChat` generalized. SSE framing (per-line `data:` escaping, `daemon.go:326-329`) is correct and reused verbatim. |
@@ -312,10 +312,10 @@ This is the crux: **what is reusable today vs. net-new.**
| Autonomy / permission gating | `daemon.go:286-298` (`PresetConfig`, `NeedsPermission`) | Server-side auto-approval policy already exists for non-interactive runs; cloud reuses it per-workspace policy. |
| Auth primitives | `internal/auth/auth.go` (`TokenStore`, `SecureStorage`), `device_flow.go` (full RFC 8628) | Device-grant **client** is done. `SecureStorage` (macOS keychain + file fallback, `auth.go:54-121`) stays for local credential caching of cloud tokens. `GenerateNonce` (`auth.go:124`) for OAuth state/PKCE. |
| Constant-time key compare | `daemon.go:207-224` | API-key verification logic carries over (but keys move to hashed storage; see net-new). |
-| Flux normalized usage | `flux/engine` response and stream usage DTOs through Rho's adapter | Reuse model/token dimensions as metering input. Do not import lower Flux packages or trust client-computed prices for billing. |
+| Mux normalized usage | `mux/engine` response and stream usage DTOs through Decoder's adapter | Reuse model/token dimensions as metering input. Do not import lower Mux packages or trust client-computed prices for billing. |
| Remote execution interface | Planned cloud execution boundary | A future `CloudSandbox` would be isolated from the local host runtime behind an explicit provider interface. |
-| Sandbox lifecycle manager | Net-new cloud component | E2B/Daytona pause/resume/snapshot semantics should be designed at the cloud boundary; local rho has no sandbox lifecycle manager. |
-| Messaging gateways | `internal/daemon/gateway.go`, `telegram.go`, `discord.go`, `slack.go` | Already forward to `/v1/chat` via `forwardToRho` (`gateway.go:17`) with bearer auth. In cloud they forward to the tenant-scoped chat endpoint with the org's key — minimal change. |
+| Sandbox lifecycle manager | Net-new cloud component | E2B/Daytona pause/resume/snapshot semantics should be designed at the cloud boundary; local decoder has no sandbox lifecycle manager. |
+| Messaging gateways | `internal/daemon/gateway.go`, `telegram.go`, `discord.go`, `slack.go` | Already forward to `/v1/chat` via `forwardToDecoder` (`gateway.go:17`) with bearer auth. In cloud they forward to the tenant-scoped chat endpoint with the org's key — minimal change. |
| Cron engine | (not yet implemented) | Cloud scheduled runs (Routines) are planned, per `TOP20_COMPARISON.md:48`. Out of scope here but shares the worker plane. |
### Net-new (must build)
@@ -340,7 +340,7 @@ This is the crux: **what is reusable today vs. net-new.**
in-process engine. Net-new control loop.
6. **`CloudSandbox`** — E2B/Daytona-backed cloud-only execution provider.
The interface and call sites exist; the cloud backend does not.
-7. **Billing/credit ledger + invoicing + Stripe integration** — flux gives
+7. **Billing/credit ledger + invoicing + Stripe integration** — mux gives
enforcement and cost math; the ledger, top-ups, plans, and payment processor are
net-new.
8. **Workspace sharing** — `session_shares` and the share/continue flows.
@@ -363,11 +363,11 @@ This is the crux: **what is reusable today vs. net-new.**
- **M0.5** Single-region Agent Worker pool (1 session/worker, worktree isolation).
- **M0.6** `CloudSandbox` (E2B *or* Daytona — pick one) implementing `containerExecutor` (`container.go:18`).
- **M0.7** Metering: ingest normalized model/token dimensions, price them with
- the versioned Rho Cloud catalog, persist the Postgres credit ledger, and
+ the versioned Decoder Cloud catalog, persist the Postgres credit ledger, and
return HTTP 402 at the hard credit floor.
- **M0.8** Minimal web UI (single `go:embed` page) for chat + diff view.
-**Exit criteria:** a paying single team can log in via OAuth, run rho against a
+**Exit criteria:** a paying single team can log in via OAuth, run decoder against a
cloud sandbox, see streamed output and diffs in the browser, and get cut off when
credits hit zero.
@@ -386,7 +386,7 @@ credits hit zero.
- **M2.1** SSO/SAML + SCIM provisioning.
- **M2.2** Multi-region worker pools + autoscaling; second sandbox provider for redundancy.
- **M2.3** JetBrains extension (ACP).
-- **M2.4** Org-scoped provider config (BYO keys / BYO model endpoints), aligning with flux multi-tenant proxy (`TOP20_COMPARISON.md:96`).
+- **M2.4** Org-scoped provider config (BYO keys / BYO model endpoints), aligning with mux multi-tenant proxy (`TOP20_COMPARISON.md:96`).
- **M2.5** Audit logging, IT-managed policy tiers, self-hosted/on-prem distribution.
- **M2.6** Cloud Routines (scheduled/triggered runs) on the worker plane (`TOP20_COMPARISON.md:48`).
@@ -398,9 +398,9 @@ credits hit zero.
|---|---|---|
| MicroVM sandboxing | **Buy/integrate** E2B (P0) + Daytona (P2 redundancy) | Building Firecracker orchestration is a multi-quarter effort orthogonal to product value. E2B SDK is open source (Apache-2.0/MIT family); Daytona is Apache-2.0. Both have hosted offerings; we can also self-host E2B later. The `containerExecutor` seam (`container.go:18`) keeps us provider-agnostic. |
| Identity / OAuth server | **Buy** (Ory Hydra/Kratos, Auth0, or WorkOS) for P0; revisit P2 | Writing a compliant OAuth2/OIDC AS is risky. Ory is Apache-2.0 (self-hostable, privacy-aligned). WorkOS/Auth0 are SaaS — faster but introduce a third party in the auth path (weigh against privacy posture). Prefer **Ory self-hosted** to keep the privacy-first promise. |
-| Billing / payments | **Buy** Stripe for payment + invoicing; **build** the credit ledger | Never build a card processor. The ledger and metering are ours (and partly exist in flux). Stripe SDK is permissive. |
+| Billing / payments | **Buy** Stripe for payment + invoicing; **build** the credit ledger | Never build a card processor. The ledger and metering are ours (and partly exist in mux). Stripe SDK is permissive. |
| Database | **Buy** managed Postgres | Standard. |
-| Metering enforcement | **Build in Rho Cloud** on normalized Engine usage | Billing authority must be server-owned and versioned; lower Flux packages remain engine implementation details. |
+| Metering enforcement | **Build in Decoder Cloud** on normalized Engine usage | Billing authority must be server-owned and versioned; lower Mux packages remain engine implementation details. |
| Web UI framework | **Build** small React SPA, `go:embed` served (Aider/OpenHands pattern) | Keeps deployment a single binary; matches `TOP20_COMPARISON.md:31`. |
| IDE protocol | **Adopt** ACP (Agent Client Protocol) | Industry trajectory (Gemini CLI, Zed, JetBrains), `TOP20_COMPARISON.md:32,36`. Avoid bespoke per-IDE protocols. |
@@ -416,14 +416,14 @@ service, so AGPL deps would create source-disclosure obligations — avoid them.
These repos are privacy-first (`TOP20_COMPARISON.md:20`); the cloud plane must not
erode that.
-1. **Cloud is opt-in and isolated from local mode.** Local rho never phones home;
+1. **Cloud is opt-in and isolated from local mode.** Local decoder never phones home;
nothing in `internal/engine` gains a cloud dependency. The
plane is a separate deployable.
2. **Tenant isolation by construction.** One session ↔ one Agent Worker ↔ one
microVM; no shared filesystem or process between tenants. Worktree-per-session
- (already rho's isolation model) carries over. Cloud microVMs should default to
+ (already decoder's isolation model) carries over. Cloud microVMs should default to
no network egress unless a workspace explicitly grants it through a cloud-owned
- allowlist. Local host execution remains governed by rho's permission and path
+ allowlist. Local host execution remains governed by decoder's permission and path
policies, not by this cloud design.
3. **Secrets never stored raw.** API keys stored as hashes only (the constant-time
compare in `daemon.go:207` becomes hash-compare). OAuth refresh tokens encrypted
@@ -431,7 +431,7 @@ erode that.
4. **Per-line SSE escaping is a real injection defense** already present
(`daemon.go:324-329`) and must be preserved in the relay path — LLM output can
contain newlines that would otherwise forge SSE events.
-5. **Credit enforcement is a DoS control too.** Hard floors (HTTP 402) via flux
+5. **Credit enforcement is a DoS control too.** Hard floors (HTTP 402) via mux
`CheckBudget` (`budget_provider.go:181`) bound runaway agent spend per tenant.
6. **Code privacy.** Customer code lives only in the ephemeral microVM and the
session store; offer per-org data-retention controls and a "no-retention" mode
@@ -455,13 +455,13 @@ erode that.
single-user — `daemon.go` keys one `apiKey`, sessions share a process). Leaning
process/pod-per-session for isolation; needs a cost model.
2. **Sandbox provider:** E2B vs. Daytona for P0. E2B = fastest microVM cold start;
- Daytona = richer dev-environment model. Which maps better onto rho's
+ Daytona = richer dev-environment model. Which maps better onto decoder's
pause/resume/snapshot (`snapshot_sandbox.go`)?
3. **Credit unit:** bill in $-equivalent credits (1 credit = $0.01?) covering both
server-priced LLM usage and sandbox-minutes — what's the blended margin?
4. **BYO keys vs. managed keys:** if an org brings its own provider keys, do their
LLM tokens still consume credits (we only charge sandbox/orchestration), or run
- free? Affects flux provider-config plumbing (`TOP20_COMPARISON.md:96`).
+ free? Affects mux provider-config plumbing (`TOP20_COMPARISON.md:96`).
5. **Identity build-vs-buy:** Ory self-hosted (privacy, ops burden) vs. WorkOS/Auth0
(speed, third party in auth path). Privacy posture argues for Ory.
6. **Session store backend:** Postgres for everything vs. Postgres (metadata) +
@@ -498,7 +498,7 @@ Assumes a small senior team (3-4 engineers). Estimates are for engineering only
with P0 a hard ~8-10 calendar weeks for a usable single-team beta.**
Leverage note: the agent loop, SSE, sandbox interface, device-flow client, and
-flux budget machinery are **already built** — they collapse what would otherwise
+mux budget machinery are **already built** — they collapse what would otherwise
be the most expensive parts (the agent runtime and the metering enforcement engine)
into integration work. The genuinely greenfield cost is identity/multi-tenancy,
worker orchestration, and the cloud sandbox backend.
diff --git a/docs/design/ECOSYSTEM-MARKETPLACE.md b/docs/design/ECOSYSTEM-MARKETPLACE.md
index be88c788b..12c0d52aa 100644
--- a/docs/design/ECOSYSTEM-MARKETPLACE.md
+++ b/docs/design/ECOSYSTEM-MARKETPLACE.md
@@ -3,7 +3,7 @@
**Status:** Draft
**Author:** Ecosystem / DX working group
**Last updated:** 2026-06-06
-**Scope:** Multi-month effort spanning all 5 repos (rho, flux, harrier, shrike, swift) + a new gallery web property + a unified docs site.
+**Scope:** Multi-month effort spanning all 5 repos (decoder, mux, harrier, shrike, swift) + a new gallery web property + a unified docs site.
> This is a design a team executes against, not a code-session deliverable. It grounds every claim in the actual graycode-eco codebase (cited as `path:line`) and reuses what already exists rather than greenfielding.
@@ -13,7 +13,7 @@
Two adjacent gaps from `TOP20_COMPARISON.md` are addressed together because they share infrastructure (a registry index, a content format, a web property):
-1. **Centralized extension gallery / plugin marketplace** — `TOP20_COMPARISON.md:65` (rho P1) and `TOP20_COMPARISON.md:227` (cross-cutting P1).
+1. **Centralized extension gallery / plugin marketplace** — `TOP20_COMPARISON.md:65` (decoder P1) and `TOP20_COMPARISON.md:227` (cross-cutting P1).
2. **Documentation site (Docusaurus/Mintlify) for the graycode-eco ecosystem** — `TOP20_COMPARISON.md:232` (cross-cutting P1).
### Who ships this in the Top 20
@@ -29,14 +29,14 @@ Two adjacent gaps from `TOP20_COMPARISON.md` are addressed together because they
graycode-eco is **not** starting from zero. A large fraction of the marketplace already exists as working Go and a populated registry:
-- **A populated registry already ships.** `starling/registry.json` is a 4.3 MB JSON array of skill entries with `name`, `description`, `category`, `tags`, `path`, `file_count`, `has_scripts` (see file head). It is served raw from GitHub and consumed by rho at `rho/internal/plugin/registry.go:18` (`defaultIndexURL = https://raw.githubusercontent.com/GrayCodeAI/starling/main/registry.json`).
-- **A registry client already works.** `rho/internal/plugin/registry.go` defines `SkillEntry`/`SkillIndex` (`:21`, `:36`), `FetchIndex` with a 1-hour cache (`:60`), and `Install/Remove/InstalledSkillInfo` (`:196`, `:289`, `:309`).
-- **CLI surface already exists.** `rho skills {list,search,install,remove,info,trending,audit}` is wired in `rho/cmd/skills_cmd.go:16-211`.
+- **A populated registry already ships.** `starling/registry.json` is a 4.3 MB JSON array of skill entries with `name`, `description`, `category`, `tags`, `path`, `file_count`, `has_scripts` (see file head). It is served raw from GitHub and consumed by decoder at `decoder/internal/plugin/registry.go:18` (`defaultIndexURL = https://raw.githubusercontent.com/GrayCodeAI/starling/main/registry.json`).
+- **A registry client already works.** `decoder/internal/plugin/registry.go` defines `SkillEntry`/`SkillIndex` (`:21`, `:36`), `FetchIndex` with a 1-hour cache (`:60`), and `Install/Remove/InstalledSkillInfo` (`:196`, `:289`, `:309`).
+- **CLI surface already exists.** `decoder skills {list,search,install,remove,info,trending,audit}` is wired in `decoder/cmd/skills_cmd.go:16-211`.
- **The extension format is partially standardized.** `SKILL.md` files carry YAML frontmatter (`name`, `description`, `license`, `tags`, `version`) — see `starling/api/openapi.yaml` `x-skill-format` and `categories/testing/ab-test-setup/SKILL.md` frontmatter.
-- **A V2 manifest already supports MCP-adjacent bundles.** `rho/internal/plugin/manifest_v2.go:11` (`ManifestV2`) carries `Tools`, `Permissions`, `Hooks` (`:32` `ManifestHook` with `Event`/`Command`/`Priority`), `Config`, `Dependencies`, `Mode` (subprocess/daemon).
-- **Trust scaffolding already exists.** `rho/internal/plugin/malware_check.go:19` blocks `eval()`, pipe-to-shell, reverse shells; `rho/internal/plugin/audit.go` flags hidden-Unicode / homoglyph attacks (`rho skills audit`).
+- **A V2 manifest already supports MCP-adjacent bundles.** `decoder/internal/plugin/manifest_v2.go:11` (`ManifestV2`) carries `Tools`, `Permissions`, `Hooks` (`:32` `ManifestHook` with `Event`/`Command`/`Priority`), `Config`, `Dependencies`, `Mode` (subprocess/daemon).
+- **Trust scaffolding already exists.** `decoder/internal/plugin/malware_check.go:19` blocks `eval()`, pipe-to-shell, reverse shells; `decoder/internal/plugin/audit.go` flags hidden-Unicode / homoglyph attacks (`decoder skills audit`).
-The gap is therefore **consolidation and elevation**, not invention: (a) a *standardized, multi-asset* extension format (today's registry is skills-only); (b) a *browsable web gallery*; (c) a *trust/signing* story beyond static malware regexes; and (d) a *unified docs site* that today is five disconnected `README.md`/`ARCHITECTURE.md` trees (`rho/docs/`, `flux/docs/`, `harrier/`, `shrike/docs/`, `swift/docs/`).
+The gap is therefore **consolidation and elevation**, not invention: (a) a *standardized, multi-asset* extension format (today's registry is skills-only); (b) a *browsable web gallery*; (c) a *trust/signing* story beyond static malware regexes; and (d) a *unified docs site* that today is five disconnected `README.md`/`ARCHITECTURE.md` trees (`decoder/docs/`, `mux/docs/`, `harrier/`, `shrike/docs/`, `swift/docs/`).
---
@@ -44,9 +44,9 @@ The gap is therefore **consolidation and elevation**, not invention: (a) a *stan
### Goals
-- **G1.** A single standardized **Rho Extension** format: a directory with `extension.yaml` (or extended `SKILL.md` frontmatter) that can bundle any subset of: MCP servers, slash commands, prompts, hooks, themes, sub-agents (personas), and skills.
-- **G2.** A **browsable gallery** (rhoskills.dev-style) generated from the registry index, with search, categories, per-extension detail pages, and copy-paste install commands.
-- **G3.** A versioned, machine-readable **registry index format** (v2) that is a superset of today's `registry.json` and remains backward compatible with `rho/internal/plugin/registry.go`.
+- **G1.** A single standardized **Decoder Extension** format: a directory with `extension.yaml` (or extended `SKILL.md` frontmatter) that can bundle any subset of: MCP servers, slash commands, prompts, hooks, themes, sub-agents (personas), and skills.
+- **G2.** A **browsable gallery** (decoderskills.dev-style) generated from the registry index, with search, categories, per-extension detail pages, and copy-paste install commands.
+- **G3.** A versioned, machine-readable **registry index format** (v2) that is a superset of today's `registry.json` and remains backward compatible with `decoder/internal/plugin/registry.go`.
- **G4.** An **install / update / remove flow** with **signing & trust verification** (provenance + signature check, not just regex malware scan).
- **G5.** A **unified documentation site** spanning all 5 repos: getting-started, per-repo API reference, architecture diagrams, cookbook recipes, and the competitor comparison tables — with the gallery either embedded in or cross-linked from it.
- **G6.** Privacy-first throughout: no telemetry-by-default, no account required to browse/install, install is auditable and offline-capable.
@@ -56,7 +56,7 @@ The gap is therefore **consolidation and elevation**, not invention: (a) a *stan
- **NG1.** A hosted, multi-tenant SaaS backend with accounts, billing, or org RBAC (those are separate P0/P2 gaps at `TOP20_COMPARISON.md:33`, `:72`). The gallery is a **static, build-time-generated site backed by a git repo**, not a dynamic app server.
- **NG2.** Paid/commercial extensions, license-key enforcement, or DRM.
- **NG3.** Replacing per-repo deep-dive docs; the unified site **aggregates and cross-links**, it does not fork content.
-- **NG4.** A new package manager. We reuse `git clone`-based install (`registry.go:215`) and the `~/.rho/skills` / `.rho/skills` layout (`registry.go:201-203`).
+- **NG4.** A new package manager. We reuse `git clone`-based install (`registry.go:215`) and the `~/.decoder/skills` / `.decoder/skills` layout (`registry.go:201-203`).
- **NG5.** Runtime arbitrary-code execution in the browser gallery (it renders metadata only; nothing executes client-side).
---
@@ -78,10 +78,10 @@ The gap is therefore **consolidation and elevation**, not invention: (a) a *stan
│ raw.githubusercontent (index + sigs) │ build inputs
▼ ▼
┌───────────────────────────────┐ ┌──────────────────────────────┐
-│ rho CLI (Go) │ │ Gallery + Docs site (static) │
+│ decoder CLI (Go) │ │ Gallery + Docs site (static) │
│ internal/plugin/registry.go │ │ Docusaurus or Mintlify │
│ + new: trust.go, extman.go │ │ - /extensions (gallery) │
-│ cmd/skills_cmd.go (+ ext cmd)│ │ - /docs/{rho,flux,...} │
+│ cmd/skills_cmd.go (+ ext cmd)│ │ - /docs/{decoder,mux,...} │
│ internal/plugin/manifest_v2 │ │ - generated from registry.v2 │
└───────────────────────────────┘ └──────────────────────────────┘
```
@@ -91,22 +91,22 @@ The gap is therefore **consolidation and elevation**, not invention: (a) a *stan
Two interoperable representations, chosen so we **do not break** today's skills-only registry:
**(a) Minimal — extended `SKILL.md` frontmatter** (for single-asset skills, unchanged path):
-Already parsed at `rho/internal/plugin/skill_loader.go:51` (`parseSkillFrontMatter`) and discovered at `rho/internal/tool/skill.go:62` (`discoverSkills`). We keep this working verbatim.
+Already parsed at `decoder/internal/plugin/skill_loader.go:51` (`parseSkillFrontMatter`) and discovered at `decoder/internal/tool/skill.go:62` (`discoverSkills`). We keep this working verbatim.
**(b) Full — `extension.yaml`** (new, for multi-asset bundles):
```yaml
-apiVersion: rho.extension/v1
+apiVersion: decoder.extension/v1
kind: Extension
name: terraform-pro
version: 1.4.0
description: Terraform authoring — skills, an MCP server, slash commands, and a theme.
license: MIT
author: { name: GrayCode AI, url: https://github.com/GrayCodeAI }
-homepage: https://rhoskills.dev/extensions/terraform-pro
+homepage: https://decoderskills.dev/extensions/terraform-pro
keywords: [terraform, iac, devops]
compat:
- minRhoVersion: "1.2.0" # maps to ManifestV2.MinRhoVersion (manifest_v2.go:20)
+ minDecoderVersion: "1.2.0" # maps to ManifestV2.MinDecoderVersion (manifest_v2.go:20)
provides:
skills: [ ./SKILL.md ]
commands: [ ./commands/plan.md, ./commands/apply.md ] # slash commands
@@ -121,11 +121,11 @@ provides:
subagents: [ ./agents/iac-reviewer.md ] # personas (internal/multiagent)
permissions: [ run_shell, network ] # ManifestV2.Permissions
signing:
- publisher: "rho"
+ publisher: "decoder"
signature: "signatures/terraform-pro.sig"
```
-The `provides` block is intentionally a **strict superset of the existing assets rho already loads**: skills (`tool/skill.go`), hooks (`manifest_v2.go:32`), MCP servers (`internal/mcp/mcp.go`), and personas/sub-agents (`internal/multiagent/agents/`, cited at `TOP20_COMPARISON.md:62`). No new runtime concept is invented — `extension.yaml` is a *bundling manifest* over existing loaders.
+The `provides` block is intentionally a **strict superset of the existing assets decoder already loads**: skills (`tool/skill.go`), hooks (`manifest_v2.go:32`), MCP servers (`internal/mcp/mcp.go`), and personas/sub-agents (`internal/multiagent/agents/`, cited at `TOP20_COMPARISON.md:62`). No new runtime concept is invented — `extension.yaml` is a *bundling manifest* over existing loaders.
### 3.3 Registry index format v2 (G3)
@@ -149,7 +149,7 @@ Today's `SkillEntry` (`registry.go:21`) already has most fields. v2 adds a `kind
"repo": "GrayCodeAI/starling",
"provides": { "skills":1, "commands":2, "hooks":1, "mcpServers":1, "themes":1, "subagents":1 },
"signed": true,
- "publisher": "rho",
+ "publisher": "decoder",
"installs": 0,
"updated_at": "..."
}
@@ -157,16 +157,16 @@ Today's `SkillEntry` (`registry.go:21`) already has most fields. v2 adds a `kind
}
```
-Backward compatibility: `registry.go`'s `SkillIndex.Skills` (`:36`) keeps reading `registry.json`. A small shim maps v2 `extensions[]` → `SkillEntry` so older rho binaries keep working; new binaries prefer `registry.v2.json` and fall back. The existing `tools/update_registry.py` / `tools/registry_schema.py` generators (in `starling/tools/`) are extended to emit both.
+Backward compatibility: `registry.go`'s `SkillIndex.Skills` (`:36`) keeps reading `registry.json`. A small shim maps v2 `extensions[]` → `SkillEntry` so older decoder binaries keep working; new binaries prefer `registry.v2.json` and fall back. The existing `tools/update_registry.py` / `tools/registry_schema.py` generators (in `starling/tools/`) are extended to emit both.
### 3.4 API surface
The marketplace has **no HTTP API server** (per NG1). Its "API" is:
1. **The static index files** over `raw.githubusercontent.com` (already the contract — `registry.go:18`).
-2. **The rho CLI**, extended:
- - Existing: `rho skills {list,search,install,remove,info,trending,audit}` (`cmd/skills_cmd.go`).
- - New: `rho ext {search,install,update,verify,info,publish}` for multi-asset extensions, plus `rho ext install --verify` (signature-checked by default).
+2. **The decoder CLI**, extended:
+ - Existing: `decoder skills {list,search,install,remove,info,trending,audit}` (`cmd/skills_cmd.go`).
+ - New: `decoder ext {search,install,update,verify,info,publish}` for multi-asset extensions, plus `decoder ext install --verify` (signature-checked by default).
3. **The gallery's generated JSON** (`/extensions/index.json`) for the site's client-side search (build-time, no server).
### 3.5 Key flows (sequences)
@@ -174,7 +174,7 @@ The marketplace has **no HTTP API server** (per NG1). Its "API" is:
**Flow A — Install with trust verification**
```
-user: rho ext install GrayCodeAI/starling terraform-pro
+user: decoder ext install GrayCodeAI/starling terraform-pro
→ RegistryClient.FetchIndex() registry.go:60 (cache <1h)
→ resolve entry, get repo+path+publisher+signature
→ git clone --depth 1 (existing) registry.go:215
@@ -184,7 +184,7 @@ user: rho ext install GrayCodeAI/starling terraform-pro
→ audit.go (hidden-unicode) + malware_check.go (regex) on every file
blocked pattern → abort malware_check.go:19
→ parse extension.yaml → ManifestV2 manifest_v2.go:42
- → copy assets to ~/.rho/skills/ (and commands/hooks/mcp dirs)
+ → copy assets to ~/.decoder/skills/ (and commands/hooks/mcp dirs)
scope user|project registry.go:201-203
→ inject source-tracking metadata registry.go (injectSourceMetadata)
→ print: installed N assets (skills, 1 mcp, 1 theme, ...)
@@ -192,18 +192,18 @@ user: rho ext install GrayCodeAI/starling terraform-pro
**Flow B — Gallery browse & install (no account, no server)**
```
-browser → rhoskills.dev/extensions (static Docusaurus/Mintlify page)
+browser → decoderskills.dev/extensions (static Docusaurus/Mintlify page)
→ client loads /extensions/index.json (generated from registry.v2.json)
→ user filters by category/tag/capability badge (skills, MCP, hooks, theme)
→ detail page renders extension.yaml metadata + README + capability list
- → "Install" shows: rho ext install (copy button)
+ → "Install" shows: decoder ext install (copy button)
→ nothing executes in browser; install happens locally via CLI
```
**Flow C — Docs build (unified site, all 5 repos)**
```
CI (docs repo) →
- pull README.md / ARCHITECTURE.md / docs/** from each of rho, flux,
+ pull README.md / ARCHITECTURE.md / docs/** from each of decoder, mux,
harrier (Harrier), shrike (Shrike), swift (Swift) (independent checkouts or sparse checkout)
→ transform: inject sidebars, rewrite intra-repo links
→ generate /extensions/* from registry.v2.json
@@ -219,36 +219,36 @@ Concrete reuse map — what is *already there* and what each piece becomes:
| New capability | Reuse today | File:line |
|---|---|---|
-| Registry fetch + 1h cache | `RegistryClient.FetchIndex` | `rho/internal/plugin/registry.go:60` |
+| Registry fetch + 1h cache | `RegistryClient.FetchIndex` | `decoder/internal/plugin/registry.go:60` |
| Index URL contract | `defaultIndexURL` | `registry.go:18` |
| Entry/index schema | `SkillEntry`, `SkillIndex` | `registry.go:21`, `:36` |
| git-clone install + scopes | `RegistryClient.Install` | `registry.go:196-215`, `:201-203` |
| Remove / info | `Remove`, `InstalledSkillInfo` | `registry.go:289`, `:309` |
-| CLI command tree | `skillsCmd` + subcommands | `rho/cmd/skills_cmd.go:16-211` |
-| Skill discovery roots | `discoverSkills`, `skillRoots` | `rho/internal/tool/skill.go:62`, `:91` |
-| Frontmatter parsing | `parseSkillFrontMatter` | `rho/internal/plugin/skill_loader.go:51` |
-| Multi-asset manifest | `ManifestV2` (+`Hooks`,`Config`,`Dependencies`,`Mode`) | `rho/internal/plugin/manifest_v2.go:11`, `:32` |
+| CLI command tree | `skillsCmd` + subcommands | `decoder/cmd/skills_cmd.go:16-211` |
+| Skill discovery roots | `discoverSkills`, `skillRoots` | `decoder/internal/tool/skill.go:62`, `:91` |
+| Frontmatter parsing | `parseSkillFrontMatter` | `decoder/internal/plugin/skill_loader.go:51` |
+| Multi-asset manifest | `ManifestV2` (+`Hooks`,`Config`,`Dependencies`,`Mode`) | `decoder/internal/plugin/manifest_v2.go:11`, `:32` |
| Hook bundling | `ManifestHook{Event,Command,Priority}` | `manifest_v2.go:32` |
-| MCP server bundling | MCP client/loader | `rho/internal/mcp/mcp.go`, `rho/internal/tool/mcp_tool.go` |
-| Sub-agent bundling | Persona system (YAML frontmatter MD) | `rho/internal/multiagent/agents/` (cf. `TOP20_COMPARISON.md:62`) |
-| Rule/skill discovery precedence | `DefaultRuleSources`, `RuleDiscoverer` | `rho/internal/plugin/` rule discovery |
-| Trust — static scan | `malware_check.go` (blocked/suspicious regex) | `rho/internal/plugin/malware_check.go:19` |
-| Trust — unicode/homoglyph | `audit.go` (`AuditFinding`, severities) | `rho/internal/plugin/audit.go:12-22` |
+| MCP server bundling | MCP client/loader | `decoder/internal/mcp/mcp.go`, `decoder/internal/tool/mcp_tool.go` |
+| Sub-agent bundling | Persona system (YAML frontmatter MD) | `decoder/internal/multiagent/agents/` (cf. `TOP20_COMPARISON.md:62`) |
+| Rule/skill discovery precedence | `DefaultRuleSources`, `RuleDiscoverer` | `decoder/internal/plugin/` rule discovery |
+| Trust — static scan | `malware_check.go` (blocked/suspicious regex) | `decoder/internal/plugin/malware_check.go:19` |
+| Trust — unicode/homoglyph | `audit.go` (`AuditFinding`, severities) | `decoder/internal/plugin/audit.go:12-22` |
| Registry generators/validators | Python tooling | `starling/tools/{update_registry,registry_schema,validate_skill,package_skill,sync_marketplace}.py` |
| Format reference | OpenAPI skill-format spec | `starling/api/openapi.yaml` (`x-skill-format`) |
| IDE/agent plugin manifests | `.claude-plugin/{plugin,marketplace}.json` | `starling/.claude-plugin/` |
**Net-new Go (small, additive):**
-- `rho/internal/plugin/trust.go` — signature verification (Flow A) and a `trustdb` of publisher public keys.
-- `rho/internal/plugin/extension.go` — parse `extension.yaml`, expand `provides` into the existing loaders.
-- `rho/cmd/ext_cmd.go` — `rho ext` command tree mirroring `skills_cmd.go`.
+- `decoder/internal/plugin/trust.go` — signature verification (Flow A) and a `trustdb` of publisher public keys.
+- `decoder/internal/plugin/extension.go` — parse `extension.yaml`, expand `provides` into the existing loaders.
+- `decoder/cmd/ext_cmd.go` — `decoder ext` command tree mirroring `skills_cmd.go`.
- Extend `manifest_v2.go` with a `Signing` struct and a `Provides` map (or a thin adapter from `extension.yaml`).
**Net-new outside Go:**
- `registry.v2.json` generator (extend `tools/update_registry.py`).
-- The gallery + docs site (new repo, e.g. `rho-docs`).
+- The gallery + docs site (new repo, e.g. `decoder-docs`).
-The discovery-precedence engine (`rules.go:20` `DefaultRuleSources`, walk-up + local/global/distance/priority sort at `rules.go:97-108`) is reused unchanged for *where* installed extension assets are found — installed extensions land in `.rho/skills` / `~/.rho/skills` (project then user), exactly the precedence `RuleDiscoverer` already honors.
+The discovery-precedence engine (`rules.go:20` `DefaultRuleSources`, walk-up + local/global/distance/priority sort at `rules.go:97-108`) is reused unchanged for *where* installed extension assets are found — installed extensions land in `.decoder/skills` / `~/.decoder/skills` (project then user), exactly the precedence `RuleDiscoverer` already honors.
---
@@ -257,22 +257,22 @@ The discovery-precedence engine (`rules.go:20` `DefaultRuleSources`, walk-up + l
### P0 — Foundation (format + index + trust core)
- **M0.1** Specify and freeze the `extension.yaml` schema; publish as `x-extension-format` alongside the existing `x-skill-format` in `starling/api/openapi.yaml`.
- **M0.2** `registry.v2.json` generator in `tools/update_registry.py`; emit both v1 and v2; v1 stays the default `defaultIndexURL` consumer for older binaries.
-- **M0.3** `extension.go` parser + adapter into `ManifestV2`; `rho ext install` reuses `registry.go:196` clone path; multi-asset copy (skills/commands/hooks/mcp/themes/subagents).
-- **M0.4** Trust v1: detached **minisign/cosign** signatures (`signatures/.sig`), publisher pubkey bundled in rho; `--allow-unsigned` escape hatch; wire `malware_check.go` + `audit.go` into the install path as hard gates.
-- **Exit:** `rho ext install` works for at least 5 multi-asset extensions, signature-verified, on a v2 index.
+- **M0.3** `extension.go` parser + adapter into `ManifestV2`; `decoder ext install` reuses `registry.go:196` clone path; multi-asset copy (skills/commands/hooks/mcp/themes/subagents).
+- **M0.4** Trust v1: detached **minisign/cosign** signatures (`signatures/.sig`), publisher pubkey bundled in decoder; `--allow-unsigned` escape hatch; wire `malware_check.go` + `audit.go` into the install path as hard gates.
+- **Exit:** `decoder ext install` works for at least 5 multi-asset extensions, signature-verified, on a v2 index.
### P1 — Gallery + Docs site (the visible surface)
-- **M1.1** Stand up the static site (decision in §6). Pages: `/extensions` (gallery), per-extension detail, `/docs/{rho,flux,harrier,shrike,swift}` (getting-started + API ref + architecture), `/comparison` (rendered from `TOP20_COMPARISON.md`).
+- **M1.1** Stand up the static site (decision in §6). Pages: `/extensions` (gallery), per-extension detail, `/docs/{decoder,mux,harrier,shrike,swift}` (getting-started + API ref + architecture), `/comparison` (rendered from `TOP20_COMPARISON.md`).
- **M1.2** Build-time generation of `/extensions/index.json` from `registry.v2.json`; client-side fuzzy search, category + capability-badge filters.
- **M1.3** Aggregate the 5 independent repositories' docs via checkout or sparse checkout in CI (Flow C); link-rewriting + unified sidebar.
-- **M1.4** `rho ext update` (diff installed version vs index, re-verify, atomic replace) and `rho ext verify ` (re-check signature/audit of an installed extension).
-- **Exit:** rhoskills.dev (or chosen domain) live; gallery browseable; one-line install copy works; docs cover all 5 repos with getting-started + API ref.
+- **M1.4** `decoder ext update` (diff installed version vs index, re-verify, atomic replace) and `decoder ext verify ` (re-check signature/audit of an installed extension).
+- **Exit:** decoderskills.dev (or chosen domain) live; gallery browseable; one-line install copy works; docs cover all 5 repos with getting-started + API ref.
### P2 — Ecosystem maturity & publisher self-service
-- **M2.1** `rho ext publish` — scaffolds `extension.yaml`, runs validators (`tools/validate_skill.py` extended), signs locally, opens a PR to `starling`.
-- **M2.2** Publisher trust tiers: verified-publisher badge (key in rho's bundled trust DB) vs community (signed but unverified) vs unsigned.
+- **M2.1** `decoder ext publish` — scaffolds `extension.yaml`, runs validators (`tools/validate_skill.py` extended), signs locally, opens a PR to `starling`.
+- **M2.2** Publisher trust tiers: verified-publisher badge (key in decoder's bundled trust DB) vs community (signed but unverified) vs unsigned.
- **M2.3** Trending/installs analytics — privacy-preserving (aggregate counts from PR-based opt-in pings or GitHub stars only; **no per-user tracking**, see §7).
-- **M2.4** Cross-repo extension kinds: flux provider plug-ins, shrike compression profiles (`TOP20_COMPARISON.md:181` team profiles), swift exporters — registered through the same `extension.yaml` `provides` mechanism with new `kind`s.
+- **M2.4** Cross-repo extension kinds: mux provider plug-ins, shrike compression profiles (`TOP20_COMPARISON.md:181` team profiles), swift exporters — registered through the same `extension.yaml` `provides` mechanism with new `kind`s.
- **Exit:** External contributors can publish a verified, multi-asset extension end-to-end; gallery shows mixed-kind extensions across the ecosystem.
---
@@ -297,13 +297,13 @@ The discovery-precedence engine (`rules.go:20` `DefaultRuleSources`, walk-up + l
minisign is the lighter P0 choice (single keypair, no external infra). cosign/sigstore is the P2 upgrade if we want keyless, transparency-log-backed provenance (which also dovetails with the SBOM/Cosign work at `TOP20_COMPARISON.md:240`).
-### New runtime dependencies for rho
+### New runtime dependencies for decoder
- A minisign/Ed25519 verify path: Go stdlib `crypto/ed25519` is sufficient — **no new dependency** for verification; only key management is new.
- No new dependency for install: `git` is already required (`registry.go:215`).
### Licensing implications
- Every extension's `extension.yaml` **must** carry a `license` field (already required for skills — `openapi.yaml` `required_frontmatter`). The gallery surfaces it; the validator rejects missing/unknown licenses.
-- The community repo is **MIT** (`starling/LICENSE`). Contributed extensions retain their own license but must be OSI-approved; a CI check (extend `tools/validate_skill.py`) flags GPL/AGPL bundled binaries that would conflict with rho's distribution model (mirrors `TOP20_COMPARISON.md:241`).
+- The community repo is **MIT** (`starling/LICENSE`). Contributed extensions retain their own license but must be OSI-approved; a CI check (extend `tools/validate_skill.py`) flags GPL/AGPL bundled binaries that would conflict with decoder's distribution model (mirrors `TOP20_COMPARISON.md:241`).
- Docusaurus (MIT) and minisign (ISC) impose no copyleft obligations.
---
@@ -316,24 +316,24 @@ These repos are privacy-first; the marketplace must not regress that.
- **Supply-chain trust (the core new risk).** Installing an extension means importing executable assets (hooks `manifest_v2.go:32`, MCP server binaries, scripts). Mitigations, in order of enforcement at install time (Flow A):
1. **Signature verification** (`trust.go`): detached signature over the extension tree hash, verified against a bundled/known publisher key. Unsigned → blocked unless `--allow-unsigned`.
2. **Static malware scan** (`malware_check.go:19`): blocks `eval(`, pipe-to-shell, base64-to-shell, reverse shells, netcat `-e`.
- 3. **Hidden-Unicode / homoglyph audit** (`audit.go`): catches prompt-injection-via-invisible-characters in `SKILL.md`/prompts (already `rho skills audit`).
+ 3. **Hidden-Unicode / homoglyph audit** (`audit.go`): catches prompt-injection-via-invisible-characters in `SKILL.md`/prompts (already `decoder skills audit`).
4. **Permission disclosure:** `extension.yaml` `permissions` (mapped to `ManifestV2.Permissions`, `manifest_v2.go:18`) are shown to the user before install; `run_shell`/`network` require explicit confirmation.
- **MCP server execution is the highest-risk asset.** Bundled MCP servers run as subprocesses. P0 ships them as **opt-in** (the extension installs the *definition*; the user must explicitly enable the server), and prefers `stdio` transport with no inbound network surface.
- **Prompt-injection through extension content.** Skills/prompts are injected into the system prompt via the same path as rules (`rules.go`). The audit (3) plus the existing HTML-comment-stripping concern (`TOP20_COMPARISON.md:74`) apply; the validator strips/flags suspicious frontmatter.
- **Offline/air-gapped install.** Because install is `git clone` + local copy with local signature verification, an org can mirror `starling` internally and point `defaultIndexURL`/`--index` at it — no call to GitHub required.
- **No third-party doc analytics.** Self-hosted Docusaurus (§6) avoids shipping user reading data to a SaaS. Any "installs" metric (P2) is aggregate-only and opt-in.
-- **Signing key custody.** Verified-publisher keys ship in rho's binary; rotation requires a rho release. P2 cosign/sigstore would move trust to a transparency log, reducing reliance on bundled keys.
+- **Signing key custody.** Verified-publisher keys ship in decoder's binary; rotation requires a decoder release. P2 cosign/sigstore would move trust to a transparency log, reducing reliance on bundled keys.
---
## 8. Open Questions
1. **Signing backend:** minisign (simple, key-in-binary) for P0, or go straight to sigstore/cosign keyless (transparency log, no key custody) and align with the SBOM effort (`TOP20_COMPARISON.md:240`)? Tradeoff: operational simplicity now vs. provenance rigor later.
-2. **One repo or two?** Keep gallery + docs in `starling`, or split docs into a new `rho-docs` repo with the 5 repos as submodules? (Submodules complicate contributor flow but isolate doc build from skill content.)
-3. **Cross-repo extension kinds (P2):** do flux/shrike/swift assets (provider plugins, compression profiles, exporters) belong in the *same* `starling` registry, or a per-repo registry federated into one gallery index?
-4. **Versioning & compat matrix:** `compat.minRhoVersion` exists (`manifest_v2.go:20`), but do we also need per-asset compat (e.g., an MCP server needing a specific transport rho supports)? Tie-in to the tri-modal MCP transport gap (`TOP20_COMPARISON.md:83`).
-5. **Install integrity for non-skill assets:** today install only copies `SKILL.md` trees (`registry.go` discovers `SKILL.md`); multi-asset copy (commands/hooks/mcp/themes/subagents) needs a defined on-disk layout under `~/.rho/`. What are the canonical install dirs for each asset kind?
-6. **Domain & hosting:** confirm `rhoskills.dev` (referenced `TOP20_COMPARISON.md:65`) ownership and Pages target (GitHub vs Cloudflare).
+2. **One repo or two?** Keep gallery + docs in `starling`, or split docs into a new `decoder-docs` repo with the 5 repos as submodules? (Submodules complicate contributor flow but isolate doc build from skill content.)
+3. **Cross-repo extension kinds (P2):** do mux/shrike/swift assets (provider plugins, compression profiles, exporters) belong in the *same* `starling` registry, or a per-repo registry federated into one gallery index?
+4. **Versioning & compat matrix:** `compat.minDecoderVersion` exists (`manifest_v2.go:20`), but do we also need per-asset compat (e.g., an MCP server needing a specific transport decoder supports)? Tie-in to the tri-modal MCP transport gap (`TOP20_COMPARISON.md:83`).
+5. **Install integrity for non-skill assets:** today install only copies `SKILL.md` trees (`registry.go` discovers `SKILL.md`); multi-asset copy (commands/hooks/mcp/themes/subagents) needs a defined on-disk layout under `~/.decoder/`. What are the canonical install dirs for each asset kind?
+6. **Domain & hosting:** confirm `decoderskills.dev` (referenced `TOP20_COMPARISON.md:65`) ownership and Pages target (GitHub vs Cloudflare).
7. **Docs source of truth:** auto-aggregate from each repo's `README.md`/`ARCHITECTURE.md` (drift-free but messy formatting) vs. hand-curated landing pages that link into per-repo docs (cleaner but duplicative)?
---
@@ -342,14 +342,14 @@ These repos are privacy-first; the marketplace must not regress that.
| Workstream | Scope | Est. |
|---|---|---|
-| **P0 — format + index v2** | `extension.yaml` spec, v2 generator in `tools/`, `extension.go` parser + `ManifestV2` adapter, multi-asset install layout, `rho ext` command tree | **4–5 ew** |
+| **P0 — format + index v2** | `extension.yaml` spec, v2 generator in `tools/`, `extension.go` parser + `ManifestV2` adapter, multi-asset install layout, `decoder ext` command tree | **4–5 ew** |
| **P0 — trust core** | `trust.go` (Ed25519/minisign verify), publisher key bundling, wire `malware_check`/`audit` as install gates, permission-disclosure UX | **3–4 ew** |
| **P1 — gallery** | Docusaurus setup, `/extensions` React route, build-time `index.json`, search + filters + detail pages | **4–5 ew** |
| **P1 — unified docs** | Aggregate 5 independent repositories (checkout/sparse-checkout CI), sidebars + link rewrite, getting-started + API-ref scaffolding per repo, comparison tables from `TOP20_COMPARISON.md` | **5–7 ew** |
-| **P1 — CLI update/verify** | `rho ext update`, `rho ext verify`, atomic replace | **2 ew** |
-| **P2 — publisher self-service** | `rho ext publish` scaffolder + validators, PR automation | **3 ew** |
+| **P1 — CLI update/verify** | `decoder ext update`, `decoder ext verify`, atomic replace | **2 ew** |
+| **P2 — publisher self-service** | `decoder ext publish` scaffolder + validators, PR automation | **3 ew** |
| **P2 — trust tiers + sigstore upgrade** | verified-publisher badges, optional cosign/sigstore keyless + transparency log | **3–4 ew** |
-| **P2 — cross-repo kinds** | flux/shrike/swift extension kinds + federated index | **3–4 ew** |
+| **P2 — cross-repo kinds** | mux/shrike/swift extension kinds + federated index | **3–4 ew** |
| **Cross-cutting** | docs writing (content, not framework), security review, CI, design iteration | **4–6 ew** |
| **Total** | | **≈ 31–44 eng-weeks** (~7.5–11 eng-months; 2 engineers ~4–5 calendar months) |
@@ -360,13 +360,13 @@ The estimate is bounded on the low side because the hardest plumbing — the reg
### Appendix: grounding index (real files cited)
- `starling/registry.json`, `registry.json` head (schema), `tools/*.py`, `api/openapi.yaml`, `.claude-plugin/{plugin,marketplace}.json`, `categories/testing/ab-test-setup/SKILL.md`, `LICENSE`
-- `rho/internal/plugin/registry.go:18,21,36,60,196,201,215,289,309`
-- `rho/internal/plugin/manifest_v2.go:11,18,20,32,42`
-- `rho/internal/plugin/skill_loader.go:51`
-- `rho/internal/plugin/malware_check.go:19`
-- `rho/internal/plugin/audit.go:12`
-- `rho/internal/tool/skill.go:62,91`
-- `rho/internal/plugin/` rule discovery
-- `rho/cmd/skills_cmd.go:16-211`
-- `rho/internal/mcp/mcp.go`, `rho/internal/tool/mcp_tool.go`
+- `decoder/internal/plugin/registry.go:18,21,36,60,196,201,215,289,309`
+- `decoder/internal/plugin/manifest_v2.go:11,18,20,32,42`
+- `decoder/internal/plugin/skill_loader.go:51`
+- `decoder/internal/plugin/malware_check.go:19`
+- `decoder/internal/plugin/audit.go:12`
+- `decoder/internal/tool/skill.go:62,91`
+- `decoder/internal/plugin/` rule discovery
+- `decoder/cmd/skills_cmd.go:16-211`
+- `decoder/internal/mcp/mcp.go`, `decoder/internal/tool/mcp_tool.go`
- `TOP20_COMPARISON.md:65,74,83,181,227,232,240,241`
diff --git a/docs/design/three-repo-architecture.md b/docs/design/three-repo-architecture.md
index 290fd04d8..f0bb84e6e 100644
--- a/docs/design/three-repo-architecture.md
+++ b/docs/design/three-repo-architecture.md
@@ -8,12 +8,12 @@ proposal. See also `gateway-architecture.md` (human-readable version),
```mermaid
flowchart LR
- subgraph CLI["rho"]
+ subgraph CLI["decoder"]
TUI["chat · exec · review\nagent loop · sessions"]
- ENG["flux engine\n(compiled in)"]
+ ENG["mux engine\n(compiled in)"]
end
- subgraph ROUTER["flux"]
+ subgraph ROUTER["mux"]
LIB["engine library\n(router, adapters)"]
SRV["HTTP server (skeleton)\ninternal/api + openapi.yaml"]
end
@@ -32,18 +32,18 @@ Wires, with evidence:
| From → To | Mechanism | Evidence |
|---|---|---|
-| CLI → Router | Go module dep, in-process construction | `go.mod` requires `github.com/GrayCodeAI/flux`; `internal/provider/gateway/gateway.go` is the sole importer |
+| CLI → Router | Go module dep, in-process construction | `go.mod` requires `github.com/GrayCodeAI/mux`; `internal/provider/gateway/gateway.go` is the sole importer |
| CLI → Platform | Opt-in HTTPS (login, usage, graph sync) | `internal/platform/cloud/client.go`; `Enabled()` requires endpoint + token; no default URL |
-| Router → CLI | none | router `go.mod`/`go.sum` contain zero rho refs |
+| Router → CLI | none | router `go.mod`/`go.sum` contain zero decoder refs |
| Router ↔ Platform | none | no imports, package deps, or API calls either direction |
## Target state (proposal)
```mermaid
flowchart LR
- CLI2["rho\n(default: in-process)"] -. "opt-in --model-gateway" .-> GW
+ CLI2["decoder\n(default: in-process)"] -. "opt-in --model-gateway" .-> GW
WEB2["platform web/BFF"] -->|per-user keys| GW
- subgraph GW["flux: common service"]
+ subgraph GW["mux: common service"]
API["OpenAI-compatible API\n/v1/chat/completions + SSE"]
POL["routing · retry · guardrails\nspend tracking"]
end
diff --git a/docs/ecosystem-message-flow.md b/docs/ecosystem-message-flow.md
index 43bf54819..963387331 100644
--- a/docs/ecosystem-message-flow.md
+++ b/docs/ecosystem-message-flow.md
@@ -1,11 +1,11 @@
-# Message flow (flux + embedded token engine)
+# Message flow (mux + embedded token engine)
-How one user message travels through rho.
+How one user message travels through decoder.
## Overview
```
-User prompt (TUI or rho exec)
+User prompt (TUI or decoder exec)
│
▼
┌───────────────────┐
@@ -14,7 +14,7 @@ User prompt (TUI or rho exec)
│
▼
┌───────────────────┐ ┌─────────────┐
-│ local memory │◄────│ ~/.rho/ │ conventions, decisions, lessons
+│ local memory │◄────│ ~/.decoder/ │ conventions, decisions, lessons
│ recall │ │ memories │
└─────────┬─────────┘ └─────────────┘
│
@@ -26,7 +26,7 @@ User prompt (TUI or rho exec)
│
▼
┌───────────────────┐ ┌─────────────┐
-│ Rho ChatClient │────►│ flux/engine│ catalog, credentials, routing
+│ Decoder ChatClient │────►│ mux/engine│ catalog, credentials, routing
│ port + adapter │ │ generate/ │────► provider API
└─────────┬─────────┘ │ stream │
└─────────────┘
@@ -40,27 +40,27 @@ User prompt (TUI or rho exec)
▼ (when context grows)
┌───────────────────┐
│ token Compress │ fast path before LLM summarization
-│ + flux compact │
+│ + mux compact │
└───────────────────┘
```
## Step by step
-### 1. Session start (`rho` or `rho exec`)
+### 1. Session start (`decoder` or `decoder exec`)
-- **flux**: The Rho composition root creates an `flux/engine.Engine` with
- Flux-owned state paths, an injected secret store, and per-engine custom
+- **mux**: The Decoder composition root creates an `mux/engine.Engine` with
+ Mux-owned state paths, an injected secret store, and per-engine custom
gateway metadata. The engine loads provider state and the model catalog, then
- builds transport behind Rho's `ChatClient` port.
+ builds transport behind Decoder's `ChatClient` port.
- **memory**: `configureSession` initializes the local memory manager
(core, auto, evolving, zen, retrieval metrics, continuity). If the state
- directory is unavailable, rho runs without persistent memory.
+ directory is unavailable, decoder runs without persistent memory.
- **token**: No startup step — embedded at compile time.
### 2. System prompt assembly
-- Rho templates (`internal/prompts/templates/*.md`) define behavior, tools, and practices.
-- Project `AGENTS.md` is appended via `rhoconfig.BuildContextWithDirs`.
+- Decoder templates (`internal/prompts/templates/*.md`) define behavior, tools, and practices.
+- Project `AGENTS.md` is appended via `decoderconfig.BuildContextWithDirs`.
- **memory**: `Memory.Recall` injects relevant stored memories into the system prompt.
### 3. User message → agent loop (`internal/engine/stream.go`)
@@ -68,8 +68,8 @@ User prompt (TUI or rho exec)
Each turn:
1. **memory** — recall memories matching the latest user message (token budget ~2000).
-2. **flux** — Rho's adapter calls engine generate/stream with Rho-owned tool
- definitions; Flux normalizes provider events and tool requests.
+2. **mux** — Decoder's adapter calls engine generate/stream with Decoder-owned tool
+ definitions; Mux normalizes provider events and tool requests.
3. Tools run with the session's memory service in context.
4. **memory** — post-session bookkeeping records the session goal and outcome.
@@ -78,7 +78,7 @@ Each turn:
When messages exceed limits (`internal/engine/compact.go`):
1. **token** — `token.Compress()` tries a fast compression path for summaries.
-2. **flux** — if token reduction is insufficient, rho calls the LLM to summarize, then keeps recent messages.
+2. **mux** — if token reduction is insufficient, decoder calls the LLM to summarize, then keeps recent messages.
### 5. Token accounting
@@ -88,21 +88,21 @@ When messages exceed limits (`internal/engine/compact.go`):
## Verify locally
```bash
-rho doctor # ecosystem panel + flux preflight
-./scripts/smoke-rho.sh # build + quick tests
+decoder doctor # ecosystem panel + mux preflight
+./scripts/smoke-decoder.sh # build + quick tests
```
## Module layout
-| Module | Role in rho | Required? |
+| Module | Role in decoder | Required? |
|--------|----------------|-----------|
-| **flux** | LLM APIs, catalog, credentials, routing | Yes |
+| **mux** | LLM APIs, catalog, credentials, routing | Yes |
| **internal/token** | Token estimate + context compression + secrets + usage | Yes (embedded, no config) |
-`flux` is an independent sibling checkout; the parent `go.work` wires the
+`mux` is an independent sibling checkout; the parent `go.work` wires the
local Go workspace.
-Production Rho code imports Flux only through `flux/engine`. Conversation
-history, WAL/resume, permissions, tool execution, and memory remain in Rho;
+Production Decoder code imports Mux only through `mux/engine`. Conversation
+history, WAL/resume, permissions, tool execution, and memory remain in Decoder;
provider credentials, discovery, selection, transport, resilience, and
-normalized streaming remain in Flux.
\ No newline at end of file
+normalized streaming remain in Mux.
\ No newline at end of file
diff --git a/docs/ecosystem-remediation-plan.md b/docs/ecosystem-remediation-plan.md
index e594bc66f..78454dc46 100644
--- a/docs/ecosystem-remediation-plan.md
+++ b/docs/ecosystem-remediation-plan.md
@@ -4,21 +4,21 @@ This document captures the improvement recommendations from the 2026-07-11
full-ecosystem audit that require significant refactoring and are documented
here for scheduled execution rather than immediate implementation.
-## 1. charmbracelet v1/v2 Dependency Duplication (rho + swift)
+## 1. charmbracelet v1/v2 Dependency Duplication (decoder + swift)
**Status:** ✅ Done (2026-07-11)
-**Impact:** High — contributed ~20-30MB to rho binary size
+**Impact:** High — contributed ~20-30MB to decoder binary size
### Outcome
-- Rho and Swift imports migrated to `charm.land/*/v2` (`bubbles`, `bubbletea`,
+- Decoder and Swift imports migrated to `charm.land/*/v2` (`bubbles`, `bubbletea`,
`lipgloss`, `huh`, `glamour`).
- Direct `github.com/charmbracelet/{bubbles,bubbletea,lipgloss}` requires removed
- from rho/swift `go.mod`.
+ from decoder/swift `go.mod`.
- Binary size gate tightened: **110MB → 80MB** (`make size-check`).
-- Verified build: rho binary **~75 MB** (under gate) after migration.
+- Verified build: decoder binary **~75 MB** (under gate) after migration.
-Commits (rho): `2890c74` (migrate), `ccfa286` (API fixups), `7a42c1e` (size gate).
+Commits (decoder): `2890c74` (migrate), `ccfa286` (API fixups), `7a42c1e` (size gate).
### Residual notes
@@ -38,13 +38,13 @@ Commits (rho): `2890c74` (migrate), `ccfa286` (API fixups), `7a42c1e` (size gate
(`replace github.com/GrayCodeAI/harrier => ../..`).
- Core `github.com/GrayCodeAI/harrier` no longer requires
`charmbracelet/{bubbles,bubbletea,lipgloss}`.
-- Rho embeds only the library packages (`engine`, `storage`, `graph`, …), so
- the default rho binary does not pull the demo TUI module.
+- Decoder embeds only the library packages (`engine`, `storage`, `graph`, …), so
+ the default decoder binary does not pull the demo TUI module.
- Verify: `cd harrier && go test ./...`; `cd harrier/cmd/harrier-tui && go test ./...`.
### Residual notes
-- The local `harrier` (Harrier) checkout and Rho's `go.mod` must resolve to a
+- The local `harrier` (Harrier) checkout and Decoder's `go.mod` must resolve to a
published matching commit. **Publish Harrier before** relying on
`GOWORK=off` / module-release parity (the Go proxy must see the commit for
sumdb download).
@@ -98,13 +98,13 @@ large diffs and bloats the repo.
`.gitignore`.
2. **Generate at build/publish time:** Run `python tools/update_registry.py`
in CI before publishing artifacts.
-3. **Runtime fetch:** Have `rho` fetch the registry from a CDN or GitHub
+3. **Runtime fetch:** Have `decoder` fetch the registry from a CDN or GitHub
raw URL rather than embedding it.
### Risk
-If `registry.json` is read offline by rho, removing it requires adding a
-fetch-or-cache mechanism. Verify how rho consumes the registry before
+If `registry.json` is read offline by decoder, removing it requires adding a
+fetch-or-cache mechanism. Verify how decoder consumes the registry before
removing from git.
---
diff --git a/docs/intelligent-cli.md b/docs/intelligent-cli.md
index 46f0a55c2..06f29ad2c 100644
--- a/docs/intelligent-cli.md
+++ b/docs/intelligent-cli.md
@@ -1,6 +1,6 @@
# Intelligent CLI capabilities
-Rho keeps the startup tool schema small while making the full capability
+Decoder keeps the startup tool schema small while making the full capability
surface discoverable on demand. The registry currently contains core tools,
lazy tools, and MCP tools; intent routing promotes only the tools relevant to
the current request.
@@ -37,8 +37,8 @@ Dependency and GitHub operations are network-gated and read-only by default.
## Inspecting the registry
```bash
-rho tools
-rho tools --json
+decoder tools
+decoder tools --json
```
The JSON form includes risk level, read-only status, aliases, and intent
diff --git a/docs/mcp-servers.md b/docs/mcp-servers.md
index 18f47b390..f606cd49a 100644
--- a/docs/mcp-servers.md
+++ b/docs/mcp-servers.md
@@ -1,10 +1,10 @@
# MCP Server Configuration
-rho supports connecting to external MCP (Model Context Protocol) servers to extend its capabilities with additional tools, resources, and prompts.
+decoder supports connecting to external MCP (Model Context Protocol) servers to extend its capabilities with additional tools, resources, and prompts.
## Configuration
-MCP servers are configured in `settings.json` (global: `~/.rho/settings.json`, project: `.rho/settings.json`).
+MCP servers are configured in `settings.json` (global: `~/.decoder/settings.json`, project: `.decoder/settings.json`).
```json
{
@@ -42,7 +42,7 @@ My-Jogyo provides 12 MCP tools for scientific research workflows, including Pyth
# Install My-Jogyo
npm install -g my-jogyo
-# Add to rho settings
+# Add to decoder settings
```
**settings.json:**
@@ -78,16 +78,16 @@ npm install -g my-jogyo
```bash
# Add an MCP server
-rho mcp add [args...]
+decoder mcp add [args...]
# List configured servers
-rho mcp list
+decoder mcp list
# Remove a server
-rho mcp remove
+decoder mcp remove
# Test a server connection
-rho mcp test
+decoder mcp test
```
## Troubleshooting
@@ -98,8 +98,8 @@ rho mcp test
- Run the command manually to check for errors
**Tools not appearing:**
-- Restart rho after adding a new server
-- Check `rho mcp test ` for connection errors
+- Restart decoder after adding a new server
+- Check `decoder mcp test ` for connection errors
- Verify the server's tools/list response is valid JSON-RPC
**Timeout errors:**
diff --git a/docs/monitoring-guide.md b/docs/monitoring-guide.md
index 5f6499051..478170c3a 100644
--- a/docs/monitoring-guide.md
+++ b/docs/monitoring-guide.md
@@ -1,6 +1,6 @@
# Monitoring Guide
-This guide covers how to monitor rho's daemon and CLI for production health,
+This guide covers how to monitor decoder's daemon and CLI for production health,
performance, and security.
## 1. Daemon Health & Readiness
@@ -18,7 +18,7 @@ curl -sf http://localhost:4590/v1/health
### `GET /v1/ready` — Readiness probe
Returns 200 when the daemon is fully ready to serve traffic (session factory
-configured, Flux preflight checks pass). Returns 503 with the failed
+configured, Mux preflight checks pass). Returns 503 with the failed
dependency during startup or when dependencies are unavailable.
```bash
@@ -31,7 +31,7 @@ Returns aggregated usage statistics (sessions, messages, tool calls, cost)
for the last N days (default 30, `?days=30`).
```bash
-curl -H "X-API-Key: $RHO_DAEMON_API_KEY" \
+curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" \
http://localhost:4590/v1/stats
```
@@ -43,7 +43,7 @@ The daemon exposes metrics in Prometheus text exposition format at
`GET /v1/metrics`. This endpoint requires authentication.
```bash
-curl -H "X-API-Key: $RHO_DAEMON_API_KEY" \
+curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" \
http://localhost:4590/v1/metrics
```
@@ -51,9 +51,9 @@ Available metrics:
| Metric | Type | Description |
|--------|------|-------------|
-| `rho_daemon_active_sessions` | gauge | Number of active daemon sessions |
-| `rho_daemon_chat_concurrency_used` | gauge | Number of in-use chat concurrency slots |
-| `rho_daemon_uptime_seconds` | gauge | Daemon uptime in seconds |
+| `decoder_daemon_active_sessions` | gauge | Number of active daemon sessions |
+| `decoder_daemon_chat_concurrency_used` | gauge | Number of in-use chat concurrency slots |
+| `decoder_daemon_uptime_seconds` | gauge | Daemon uptime in seconds |
| `http_requests_total` | counter | Total HTTP requests received |
| `http_request_duration_ms` | histogram | HTTP request duration in milliseconds |
| `http_rate_limited_total` | counter | Number of requests rejected by rate limiter |
@@ -70,9 +70,9 @@ text format.
Telemetry is **opt-in**. Enable it by setting:
```bash
-export RHO_ENABLE_TELEMETRY=1
+export DECODER_ENABLE_TELEMETRY=1
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
-rho daemon start
+decoder daemon start
```
The daemon will automatically:
@@ -80,31 +80,31 @@ The daemon will automatically:
- Initialize the OTel SDK with a batch span processor (5s batch interval).
- Export traces to the OTLP endpoint (`OTEL_EXPORTER_OTLP_ENDPOINT`).
- Send trace headers from `OTEL_EXPORTER_OTLP_HEADERS`.
-- Set the service name (default: `rho`) and version.
+- Set the service name (default: `decoder`) and version.
### Configuration
| Environment Variable | Default | Description |
|---------------------|---------|-------------|
-| `RHO_ENABLE_TELEMETRY` | `0` | Set to `1` to enable OTP telemetry |
+| `DECODER_ENABLE_TELEMETRY` | `0` | Set to `1` to enable OTP telemetry |
| `OTEL_EXPORTER_OTLP_ENDPOINT` | _(empty)_ | OTLP collector endpoint |
| `OTEL_EXPORTER_OTLP_PROTOCOL` | `http/protobuf` | OTLP transport protocol |
| `OTEL_EXPORTER_OTLP_HEADERS` | _(empty)_ | Comma-separated `key=value` headers |
-| `RHO_OTEL_SHUTDOWN_TIMEOUT_MS` | `2000` | Shutdown timeout in milliseconds |
+| `DECODER_OTEL_SHUTDOWN_TIMEOUT_MS` | `2000` | Shutdown timeout in milliseconds |
### OTel Conventions
-rho follows the OpenTelemetry semantic conventions for traces. See
+decoder follows the OpenTelemetry semantic conventions for traces. See
[docs/OTEL-CONVENTIONS.md](OTEL-CONVENTIONS.md) for span naming and attribute
details.
## 4. Structured Logging
-The daemon writes structured SLOG logs to `~/.rho/state/daemon.log` by
+The daemon writes structured SLOG logs to `~/.decoder/state/daemon.log` by
default. Control the log level via:
```bash
-rho daemon start --log-level DEBUG
+decoder daemon start --log-level DEBUG
```
Or via environment variable:
@@ -127,13 +127,13 @@ All daemon log entries include:
### Audit log
Security-relevant events (auth failures, tool executions) are written to a
-tamper-evident log at `~/.rho/state/securitylog/security_events.jsonl`.
+tamper-evident log at `~/.decoder/state/securitylog/security_events.jsonl`.
Verify the audit log integrity:
```bash
# The securitylog package provides a verify command
-go run ./cmd/rho securitylog verify
+go run ./cmd/decoder securitylog verify
```
## 5. Prometheus Scraping
@@ -144,14 +144,14 @@ go run ./cmd/rho securitylog verify
apiVersion: v1
kind: Service
metadata:
- name: rho-daemon
+ name: decoder-daemon
annotations:
prometheus.io/scrape: "true"
prometheus.io/port: "4590"
prometheus.io/path: "/v1/metrics"
spec:
selector:
- app: rho-daemon
+ app: decoder-daemon
ports:
- port: 4590
targetPort: 4590
@@ -159,18 +159,18 @@ spec:
apiVersion: apps/v1
kind: Deployment
metadata:
- name: rho-daemon
+ name: decoder-daemon
spec:
template:
spec:
containers:
- - name: rho
- image: ghcr.io/graycodeai/rho-daemon:latest
+ - name: decoder
+ image: ghcr.io/graycodeai/decoder-daemon:latest
env:
- - name: RHO_DAEMON_API_KEY
+ - name: DECODER_DAEMON_API_KEY
valueFrom:
secretKeyRef:
- name: rho-secret
+ name: decoder-secret
key: api-key
ports:
- containerPort: 4590
@@ -192,26 +192,26 @@ spec:
| Alert | Condition | Severity |
|-------|-----------|----------|
-| Daemon down | `rho_daemon_uptime_seconds` does not increase for 2+ minutes | critical |
+| Daemon down | `decoder_daemon_uptime_seconds` does not increase for 2+ minutes | critical |
| High request latency | `histogram_quantile(0.95, http_request_duration_ms)` > 10000ms for 5 minutes | warning |
| Rate limit saturation | `rate(http_rate_limited_total[5m])` > 10/s | warning |
| Auth failures | `rate(auth_denied_total[5m])` > 5/s | critical (possible brute force) |
-| High concurrency | `rho_daemon_chat_concurrency_used` sustained at max for 5+ minutes | warning |
-| No active sessions | `rho_daemon_active_sessions` = 0 during business hours | warning |
+| High concurrency | `decoder_daemon_chat_concurrency_used` sustained at max for 5+ minutes | warning |
+| No active sessions | `decoder_daemon_active_sessions` = 0 during business hours | warning |
## 7. Systemd Logging
When running under systemd, logs from stderr/stdout are captured by journald:
```bash
-journalctl -u rho-daemon -f
+journalctl -u decoder-daemon -f
```
The daemon also writes its own structured log to
-`~/.rho/state/daemon.log`:
+`~/.decoder/state/daemon.log`:
```bash
-tail -f ~/.rho/state/daemon.log
+tail -f ~/.decoder/state/daemon.log
```
## 8. Feature Flags
@@ -220,7 +220,7 @@ Feature flags allow runtime configuration without restarts. They are
controlled via environment variables:
```bash
-export RHO_FEATURE_=1
+export DECODER_FEATURE_=1
```
| Flag | Default | Description |
@@ -234,5 +234,5 @@ export RHO_FEATURE_=1
List all registered flags:
```bash
-rho features
+decoder features
```
diff --git a/docs/operations-checklist.md b/docs/operations-checklist.md
index c979c7089..5d9c931ac 100644
--- a/docs/operations-checklist.md
+++ b/docs/operations-checklist.md
@@ -1,22 +1,22 @@
# Production Operations Checklist
-Use this checklist when deploying or upgrading rho in a production
+Use this checklist when deploying or upgrading decoder in a production
environment. Each item links to the relevant configuration option or
documentation section.
## Pre-Deployment
-- [ ] **API key is set** — `RHO_DAEMON_API_KEY` environment variable is
+- [ ] **API key is set** — `DECODER_DAEMON_API_KEY` environment variable is
configured to a cryptographically random value (≥ 32 bytes). Do **not**
rely on the auto-generated key for production.
```bash
- export RHO_DAEMON_API_KEY=$(openssl rand -base64 32)
+ export DECODER_DAEMON_API_KEY=$(openssl rand -base64 32)
```
- [ ] **Bind address** — Daemon binds to `0.0.0.0` (not just loopback) only
when remote access is needed. A non-loopback bind requires an API key and
native TLS; otherwise startup fails closed.
- [ ] **TLS configured** — Enable native TLS with `--tls-cert` / `--tls-key`
- flags. If a reverse proxy terminates TLS, keep Rho bound to loopback or
+ flags. If a reverse proxy terminates TLS, keep Decoder bound to loopback or
an internal-only interface and restrict that network path at the firewall;
the daemon does not treat `X-Forwarded-Proto` as transport encryption.
- [ ] **CORS configured** — If serving browser-based clients, set
@@ -24,14 +24,14 @@ documentation section.
trusted origins only. Use `--cors '*'` only for development.
- [ ] **Rate limits reviewed** — Default: 10 req/min for general API, 30 req/min
for chat, 4 concurrent chat sessions. Tune via
- `RHO_DAEMON_MAX_CONCURRENT`.
+ `DECODER_DAEMON_MAX_CONCURRENT`.
- [ ] **Resource limits set** — Configure CPU/memory limits in systemd
(`MemoryMax`, `CPUQuota`) or Kubernetes. Defaults in the systemd unit file:
`MemoryMax=4G`, `CPUQuota=200%`.
-- [ ] **Log retention** — Daemon logs at `~/.rho/state/daemon.log`.
+- [ ] **Log retention** — Daemon logs at `~/.decoder/state/daemon.log`.
Configure log rotation (logrotate, journald retention) to prevent disk
exhaustion.
-- [ ] **State directory backed up** — The `~/.rho/state/` directory contains
+- [ ] **State directory backed up** — The `~/.decoder/state/` directory contains
the PID file, API key pin file, audit log, and session state. Back up the
audit log key (`securitylog/sel.key`) — **losing it makes all historical
audit entries unverifiable**.
@@ -40,17 +40,17 @@ documentation section.
## Observability
-- [ ] **Telemetry enabled (optional)** — Set `RHO_ENABLE_TELEMETRY=1`
+- [ ] **Telemetry enabled (optional)** — Set `DECODER_ENABLE_TELEMETRY=1`
and configure `OTEL_EXPORTER_OTLP_ENDPOINT` to send traces to your OTLP
collector. Telemetry is opt-in by default.
- [ ] **Prometheus scraping** — If using Prometheus, configure a scrape
target for `http://:4590/v1/metrics` with authentication:
```yaml
scrape_configs:
- - job_name: 'rho-daemon'
- bearer_token: ''
+ - job_name: 'decoder-daemon'
+ bearer_token: ''
static_configs:
- - targets: ['rho-daemon:4590']
+ - targets: ['decoder-daemon:4590']
metrics_path: '/v1/metrics'
```
- [ ] **Health/readiness probes** — Configure in your orchestrator:
@@ -62,24 +62,24 @@ documentation section.
## Security Hardening
- [ ] **API key rotated** — The API key is written to a pinned file at
- `~/.rho/state/daemon.key` for convenience. **Remove this file in
+ `~/.decoder/state/daemon.key` for convenience. **Remove this file in
production** or ensure it has `0600` permissions and is not world-readable.
- [ ] **Audit log verification** — Periodically verify the audit log
integrity:
```bash
# The Verify function checks the HMAC chain
- go run ./cmd/rho securitylog verify
+ go run ./cmd/decoder securitylog verify
```
- [ ] **Security headers** — Verify `X-Content-Type-Options`,
`X-Frame-Options`, and `Content-Security-Policy` headers are present
(enabled by default via the `security-headers` feature flag).
-- [x] **Execution model** — Rho runs tools directly on the host under its
+- [x] **Execution model** — Decoder runs tools directly on the host under its
permission, path-safety, trust, and worktree controls. Docker/Podman is not
required and is not an execution backend for the CLI.
- [ ] **No CGO** — The binary is built with `CGO_ENABLED=0` for a static binary.
Verify the deployed binary has no dynamic library dependencies:
```bash
- ldd /usr/local/bin/rho # should say "not a dynamic executable"
+ ldd /usr/local/bin/decoder # should say "not a dynamic executable"
```
## Post-Deployment
@@ -97,7 +97,7 @@ documentation section.
```
- [ ] **Metrics test** — Verify the metrics endpoint:
```bash
- curl -H "X-API-Key: $RHO_DAEMON_API_KEY" http://localhost:4590/v1/metrics
+ curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" http://localhost:4590/v1/metrics
```
- [ ] **Version check** — Verify the deployed version matches expectations:
```bash
@@ -106,10 +106,10 @@ documentation section.
## Upgrade Procedure
-1. **Back up state** — Copy `~/.rho/state/` to a safe location.
+1. **Back up state** — Copy `~/.decoder/state/` to a safe location.
2. **Drain traffic** — Remove the daemon from load balancer rotation or
stop sending new requests.
-3. **Install new binary** — Replace the binary and run `rho daemon start`
+3. **Install new binary** — Replace the binary and run `decoder daemon start`
with the same configuration.
4. **Verify health** — Check `GET /v1/health` and `GET /v1/ready`.
5. **Verify metrics** — Check `GET /v1/metrics` for expected counters.
diff --git a/docs/plans/FULL-GROK-ECO-TO-RHO-ECO-PORT-PLAN.md b/docs/plans/FULL-GROK-ECO-TO-DECODER-ECO-PORT-PLAN.md
similarity index 74%
rename from docs/plans/FULL-GROK-ECO-TO-RHO-ECO-PORT-PLAN.md
rename to docs/plans/FULL-GROK-ECO-TO-DECODER-ECO-PORT-PLAN.md
index bb04c0333..ccea97bcc 100644
--- a/docs/plans/FULL-GROK-ECO-TO-RHO-ECO-PORT-PLAN.md
+++ b/docs/plans/FULL-GROK-ECO-TO-DECODER-ECO-PORT-PLAN.md
@@ -5,7 +5,7 @@
**Active execution:** [YEAR-0-ACTIVE.md](./YEAR-0-ACTIVE.md) (Year 0 control-plane track)
**ADR:** [ADR-0003](../architecture/adr/ADR-0003-grok-behavioral-port-go-multirepo.md)
**Meaning of “port”:** Reimplement **every Grok Build capability** in idiomatic **Go** across graycode-eco repos.
-**Not meaning:** Copy Rust crates, depend on Grok binaries, or collapse rho into a Rust monorepo.
+**Not meaning:** Copy Rust crates, depend on Grok binaries, or collapse decoder into a Rust monorepo.
**Source tree:** `grok-eco/grok-build` (~1.35M LOC Rust, 1 product monorepo)
**Target tree:** `graycode-eco/*` (multi-repo Go platform + cloud/TS/Python)
@@ -18,10 +18,10 @@
## 0. Port principles
1. **Behavior parity over code structure** — same user-visible contracts, not same file tree.
-2. **Go multi-repo stays** — map Grok crates into rho / engines / contracts / cloud / skills.
-3. **Prefer wire-first** — Rho already has partial types; complete wiring before greenfield.
+2. **Go multi-repo stays** — map Grok crates into decoder / engines / contracts / cloud / skills.
+3. **Prefer wire-first** — Decoder already has partial types; complete wiring before greenfield.
4. **Privacy-first defaults** — Grok Mixpanel/Sentry defaults become **opt-in** OTEL/privacy-safe telemetry.
-5. **Multi-provider stays** — Grok sampler/auth maps to **flux**, not a single-vendor clone.
+5. **Multi-provider stays** — Grok sampler/auth maps to **mux**, not a single-vendor clone.
6. **Memory stays harrier** — Grok markdown memory maps to **harrier APIs + UX**, not a second store.
7. **Tokens stay shrike** — Grok `xai-token-estimation` is obsolete relative to shrike.
8. **Track everything** — even 70-line crates appear in the matrix (Done / Partial / Port / Skip / N/A).
@@ -67,9 +67,9 @@ Critical path remains **months**; **complete parity** including TUI polish and e
```text
grok-eco/grok-build (one Rust workspace)
│
- ├─► rho product CLI/TUI/engine/tools/hooks/plugins/ACP
+ ├─► decoder product CLI/TUI/engine/tools/hooks/plugins/ACP
├─► eagle pure DTOs (tool/spawn/hooks/policy)
- ├─► flux LLM routing/stream/retry/catalog/auth credentials
+ ├─► mux LLM routing/stream/retry/catalog/auth credentials
├─► harrier memory graph + dream UX
├─► shrike compression / secrets / token cost
├─► swift session capture/import/replay
@@ -92,87 +92,87 @@ grok-eco/grok-build (one Rust workspace)
| Grok crate | ~LOC | Capability | Target repo | Status | Effort | Notes |
|------------|-----:|------------|-------------|--------|--------|-------|
-| `xai-grok-pager` | 415k | Full TUI | rho `cmd/` | Partial | XXL | Bubble Tea already; parity of panes/modals/slash is multi-year |
-| `xai-grok-pager-render` | 35k | Render pipeline | rho | Partial | L | Streaming render, blocks, media |
-| `xai-grok-pager-minimal` | 5.6k | `--minimal` native scrollback | rho | Partial | M | `rho --repl` / print modes exist |
-| `xai-grok-pager-bin` | 2.9k | Binary composition root | rho `cmd/rho` | Done | — | |
-| `xai-grok-pager-pty-harness` | 10k | PTY test harness | rho tests | Partial | M | Test infra |
-| `xai-grok-shell` | 336k | Agent runtime host | rho `internal/engine` | Partial | XXL | Largest runtime port |
-| `xai-grok-shell-base` | 2.7k | Shared shell foundation | rho | Partial | S | Absorb |
-| `xai-grok-shell-session-support` | 1.5k | Session support extract | rho `session` | Partial | S | Absorb |
-| `xai-grok-tools` | 112k | Tool implementations | rho `internal/tool` | Partial | XL | See tool matrix §3 |
-| `xai-grok-tools-api` | 0.7k | Tool API / slash wording | rho + contracts | Partial | S | |
-| `xai-grok-workspace` | 77k | FS/VCS/permissions/hub | rho + sandbox + session | Partial | XL | |
+| `xai-grok-pager` | 415k | Full TUI | decoder `cmd/` | Partial | XXL | Bubble Tea already; parity of panes/modals/slash is multi-year |
+| `xai-grok-pager-render` | 35k | Render pipeline | decoder | Partial | L | Streaming render, blocks, media |
+| `xai-grok-pager-minimal` | 5.6k | `--minimal` native scrollback | decoder | Partial | M | `decoder --repl` / print modes exist |
+| `xai-grok-pager-bin` | 2.9k | Binary composition root | decoder `cmd/decoder` | Done | — | |
+| `xai-grok-pager-pty-harness` | 10k | PTY test harness | decoder tests | Partial | M | Test infra |
+| `xai-grok-shell` | 336k | Agent runtime host | decoder `internal/engine` | Partial | XXL | Largest runtime port |
+| `xai-grok-shell-base` | 2.7k | Shared shell foundation | decoder | Partial | S | Absorb |
+| `xai-grok-shell-session-support` | 1.5k | Session support extract | decoder `session` | Partial | S | Absorb |
+| `xai-grok-tools` | 112k | Tool implementations | decoder `internal/tool` | Partial | XL | See tool matrix §3 |
+| `xai-grok-tools-api` | 0.7k | Tool API / slash wording | decoder + contracts | Partial | S | |
+| `xai-grok-workspace` | 77k | FS/VCS/permissions/hub | decoder + sandbox + session | Partial | XL | |
| `xai-grok-workspace-types` | 9.2k | Workspace wire types | contracts | Partial | M | |
-| `xai-grok-workspace-client` | 0.8k | Workspace RPC client | rho (if hub) | Port | M | Only if computer-hub ported |
-| `xai-grok-agent` | 21k | Agent defs + system prompt | rho agent/personas | Partial | L | |
-| `xai-grok-subagent-resolution` | 2.6k | Capability/isolation resolve | rho + contracts | Port | M | Critical |
-| `xai-chat-state` | 13k | Chat state actor | rho session/engine | Partial | L | |
-| `xai-grok-markdown` | 22k | Streaming MD TUI | rho markdown | Partial | L | |
-| `xai-grok-markdown-core` | 1.1k | Headless MD analysis | rho | Partial | S | |
-| `xai-ratatui-textarea` | 12k | Input widget | rho (Bubble Tea) | N/A | — | Different UI stack |
-| `xai-ratatui-inline` | 3.7k | Inline render | rho | N/A | — | UI stack |
-| `xai-fast-worktree` | 19k | CoW worktree speed | rho worktree | Port | L | Perf enhancement |
-| `xai-file-utils` | 15k | Event tracking / upload | rho observability | Partial | M | Privacy opt-in |
-| `xai-grok-telemetry` | 14k | Events + OTEL + Mixpanel + Sentry | rho observability | Partial | L | **Skip Mixpanel default**; keep OTEL |
-| `xai-hunk-tracker` | 13k | Agent vs external hunks | rho | Port | L | |
-| `xai-grok-sampling-types` | 13k | Chat API types | **flux** | Done* | — | Different shape; flux owns |
-| `xai-grok-sampler` | 11k | HTTP stream + retry | **flux** | Done* | — | Do not replace flux |
-| `xai-grok-update` | 11k | Auto-update | rho | Partial | M | |
-| `xai-grok-mcp` | 10k | MCP client (oauth, wire) | rho `mcp` | Partial | L | |
-| `xai-codebase-graph` | 9.7k | Tree-sitter graph | rho codegraph/repomap | Partial | L | |
+| `xai-grok-workspace-client` | 0.8k | Workspace RPC client | decoder (if hub) | Port | M | Only if computer-hub ported |
+| `xai-grok-agent` | 21k | Agent defs + system prompt | decoder agent/personas | Partial | L | |
+| `xai-grok-subagent-resolution` | 2.6k | Capability/isolation resolve | decoder + contracts | Port | M | Critical |
+| `xai-chat-state` | 13k | Chat state actor | decoder session/engine | Partial | L | |
+| `xai-grok-markdown` | 22k | Streaming MD TUI | decoder markdown | Partial | L | |
+| `xai-grok-markdown-core` | 1.1k | Headless MD analysis | decoder | Partial | S | |
+| `xai-ratatui-textarea` | 12k | Input widget | decoder (Bubble Tea) | N/A | — | Different UI stack |
+| `xai-ratatui-inline` | 3.7k | Inline render | decoder | N/A | — | UI stack |
+| `xai-fast-worktree` | 19k | CoW worktree speed | decoder worktree | Port | L | Perf enhancement |
+| `xai-file-utils` | 15k | Event tracking / upload | decoder observability | Partial | M | Privacy opt-in |
+| `xai-grok-telemetry` | 14k | Events + OTEL + Mixpanel + Sentry | decoder observability | Partial | L | **Skip Mixpanel default**; keep OTEL |
+| `xai-hunk-tracker` | 13k | Agent vs external hunks | decoder | Port | L | |
+| `xai-grok-sampling-types` | 13k | Chat API types | **mux** | Done* | — | Different shape; mux owns |
+| `xai-grok-sampler` | 11k | HTTP stream + retry | **mux** | Done* | — | Do not replace mux |
+| `xai-grok-update` | 11k | Auto-update | decoder | Partial | M | |
+| `xai-grok-mcp` | 10k | MCP client (oauth, wire) | decoder `mcp` | Partial | L | |
+| `xai-codebase-graph` | 9.7k | Tree-sitter graph | decoder codegraph/repomap | Partial | L | |
| `xai-grok-memory` | 9.7k | Cross-session memory | **harrier** | Done* | M | Port UX only |
-| `xai-grok-hooks` | 8.3k | File/HTTP hooks | rho hooks | Port | L | |
-| `xai-fsnotify` | 6.7k | FS events | rho (fsnotify) | Partial | S | |
-| `xai-grok-config` | 6k | Config layers + managed | rho config + cloud | Port | L | |
+| `xai-grok-hooks` | 8.3k | File/HTTP hooks | decoder hooks | Port | L | |
+| `xai-fsnotify` | 6.7k | FS events | decoder (fsnotify) | Partial | S | |
+| `xai-grok-config` | 6k | Config layers + managed | decoder config + cloud | Port | L | |
| `xai-grok-config-types` | 2.7k | Config DTOs | contracts/config | Partial | S | |
-| `xai-grok-plugin-marketplace` | 5.3k | Marketplace | rho + community-skills | Port | L | |
-| `xai-grok-shared` | 5.2k | Shared utils | rho | N/A | — | Absorb |
-| `xai-grok-test-support` | 4.6k | Test harness | rho testutil | Partial | M | |
-| `xai-grok-sandbox` | 3.9k | OS sandbox profiles | rho host permissions | Port | L | |
-| `xai-grok-voice` | 2.7k | Streaming STT | rho | Partial | M | whisper path exists |
-| `xai-acp-lib` | 2.3k | ACP protocol | rho acp | Port | L | |
-| `xai-grok-mermaid` | 2.2k | Mermaid→PNG | rho | Port | M | |
-| `xai-crash-handler` | 1.9k | Crash + startup detect | rho | Port | S | |
-| `ptyctl` | 2.3k | Headless PTY control | rho | Port | M | |
-| `ptyctl-cli` | 0.8k | PTY CLI | rho tests/tools | Optional | S | |
-| `xai-tty-utils` | 1.2k | TTY-safe spawn | rho | Port | S | |
+| `xai-grok-plugin-marketplace` | 5.3k | Marketplace | decoder + community-skills | Port | L | |
+| `xai-grok-shared` | 5.2k | Shared utils | decoder | N/A | — | Absorb |
+| `xai-grok-test-support` | 4.6k | Test harness | decoder testutil | Partial | M | |
+| `xai-grok-sandbox` | 3.9k | OS sandbox profiles | decoder host permissions | Port | L | |
+| `xai-grok-voice` | 2.7k | Streaming STT | decoder | Partial | M | whisper path exists |
+| `xai-acp-lib` | 2.3k | ACP protocol | decoder acp | Port | L | |
+| `xai-grok-mermaid` | 2.2k | Mermaid→PNG | decoder | Port | M | |
+| `xai-crash-handler` | 1.9k | Crash + startup detect | decoder | Port | S | |
+| `ptyctl` | 2.3k | Headless PTY control | decoder | Port | M | |
+| `ptyctl-cli` | 0.8k | PTY CLI | decoder tests/tools | Optional | S | |
+| `xai-tty-utils` | 1.2k | TTY-safe spawn | decoder | Port | S | |
| `xai-hooks-plugins-types` | 1.2k | Hooks/plugins ACP DTOs | contracts | Port | S | |
-| `xai-sqlite-journal` | 0.8k | SQLite journal mode | rho/harrier/shrike | Partial | XS | |
-| `xai-system-power` | 0.7k | Sleep/wake notify | rho sleep_prevent | Partial | S | |
-| `xai-grok-http` | 0.6k | Shared HTTP client | rho/netutil | Partial | XS | |
-| `xai-agent-lifecycle` | 0.6k | Lifecycle hooks data | rho hooks/engine | Partial | S | |
-| `xai-gix-status` | 0.6k | Fast git status | rho git tools | Partial | S | |
-| `xai-grok-paths` | 0.6k | AbsPath types | rho | N/A | XS | Go path.Clean enough |
-| `xai-grok-secrets` | 0.6k | Secrets helpers | shrike + flux | Partial | S | |
-| `xai-grok-announcements` | 0.4k | Release announcements | rho tips/notify | Port | S | |
-| `xai-grok-auth` | 0.4k | Auth seam | flux + rho auth | Partial | M | Browser OAuth optional |
+| `xai-sqlite-journal` | 0.8k | SQLite journal mode | decoder/harrier/shrike | Partial | XS | |
+| `xai-system-power` | 0.7k | Sleep/wake notify | decoder sleep_prevent | Partial | S | |
+| `xai-grok-http` | 0.6k | Shared HTTP client | decoder/netutil | Partial | XS | |
+| `xai-agent-lifecycle` | 0.6k | Lifecycle hooks data | decoder hooks/engine | Partial | S | |
+| `xai-gix-status` | 0.6k | Fast git status | decoder git tools | Partial | S | |
+| `xai-grok-paths` | 0.6k | AbsPath types | decoder | N/A | XS | Go path.Clean enough |
+| `xai-grok-secrets` | 0.6k | Secrets helpers | shrike + mux | Partial | S | |
+| `xai-grok-announcements` | 0.4k | Release announcements | decoder tips/notify | Port | S | |
+| `xai-grok-auth` | 0.4k | Auth seam | mux + decoder auth | Partial | M | Browser OAuth optional |
| `xai-token-estimation` | 0.3k | Bytes/4 heuristic | **shrike** | Skip | — | shrike superior |
-| `xai-tracing-macros` | 0.2k | Log macros | rho observability | N/A | XS | |
-| `xai-grok-env` | 0.2k | Backend env presets | flux/rho | Partial | XS | |
-| `xai-prompt-queue` | 0.2k | Prompt queue types | rho | Port | S | |
+| `xai-tracing-macros` | 0.2k | Log macros | decoder observability | N/A | XS | |
+| `xai-grok-env` | 0.2k | Backend env presets | mux/decoder | Partial | XS | |
+| `xai-prompt-queue` | 0.2k | Prompt queue types | decoder | Port | S | |
| `xai-mixpanel` | 0.1k | Mixpanel client | — | **Skip** | — | Privacy; OTEL opt-in |
-| `xai-grok-version` | 0.1k | Version | rho VERSION | Done | — | |
-| `xai-grok-models` | 0.1k | Default model IDs | flux catalog | Done* | — | |
+| `xai-grok-version` | 0.1k | Version | decoder VERSION | Done | — | |
+| `xai-grok-models` | 0.1k | Default model IDs | mux catalog | Done* | — | |
### 2.2 Common crates (tool protocol / hub / compaction)
| Grok crate | ~LOC | Capability | Target | Status | Effort | Notes |
|------------|-----:|------------|--------|--------|--------|-------|
-| `xai-computer-hub-sdk` | 14k | Remote tool server SDK | new or rho | Port (Y2+) | XL | Only if multi-host tools wanted |
+| `xai-computer-hub-sdk` | 14k | Remote tool server SDK | new or decoder | Port (Y2+) | XL | Only if multi-host tools wanted |
| `xai-computer-hub-core` | 4.2k | Transport/registry | same | Port (Y2+) | L | |
| `xai-computer-hub-mcp-adapter` | 1k | MCP into hub | falcon | Port (Y2+) | M | |
-| `xai-tool-protocol` | 6.6k | Wire protocol | contracts + rho | Port (Y2) | L | |
-| `xai-tool-runtime` | 5.4k | Tool trait runtime | rho tool | Partial | L | |
+| `xai-tool-protocol` | 6.6k | Wire protocol | contracts + decoder | Port (Y2) | L | |
+| `xai-tool-runtime` | 5.4k | Tool trait runtime | decoder tool | Partial | L | |
| `xai-tool-types` | 3.6k | Spawn/task types | **contracts** | Port | M | **P0** |
-| `xai-grok-compaction` | 6.8k | Compaction engine | rho engine + shrike | Partial | L | |
-| `xai-circuit-breaker` | 2.2k | HTTP breaker | flux/resilience | Partial | S | |
-| `xai-tracing` | 0.8k | Tracing | rho OTEL | Partial | S | |
-| `xai-test-utils` | 0.4k | Hermetic git tests | rho testutil | Partial | S | |
-| `xai-interjection-core` | 0.3k | Interjection messaging | rho | Port | S | Mid-turn user inject |
+| `xai-grok-compaction` | 6.8k | Compaction engine | decoder engine + shrike | Partial | L | |
+| `xai-circuit-breaker` | 2.2k | HTTP breaker | mux/resilience | Partial | S | |
+| `xai-tracing` | 0.8k | Tracing | decoder OTEL | Partial | S | |
+| `xai-test-utils` | 0.4k | Hermetic git tests | decoder testutil | Partial | S | |
+| `xai-interjection-core` | 0.3k | Interjection messaging | decoder | Port | S | Mid-turn user inject |
| `xai-proto-build` | — | Build tooling | — | Skip | — | Rust build |
-\*Done* = domain covered by rho engine with different API.
+\*Done* = domain covered by decoder engine with different API.
---
@@ -180,7 +180,7 @@ grok-eco/grok-build (one Rust workspace)
### 3.1 Grok Build native tools
-| Grok tool | Rho equivalent | Status | Port work |
+| Grok tool | Decoder equivalent | Status | Port work |
|-----------|-----------------|--------|-----------|
| `bash` / `run_terminal_command` | `Bash` | Partial | background flag, timeout, safe-bash, kill |
| `read_file` | `Read` | Partial | media/PDF page ranges parity |
@@ -210,20 +210,20 @@ grok-eco/grok-build (one Rust workspace)
Grok vendors codex/opencode tool implementations for compatibility profiles.
-| Compat surface | Rho | Action |
+| Compat surface | Decoder | Action |
|----------------|------|--------|
-| Codex apply_patch / read / list / grep | rho tools | Optional compat profile |
-| OpenCode read/write/edit/bash/glob/grep/todo/skill | rho | Optional `compat.opencode` |
-| Claude import | missing | **Port** into swift/rho |
+| Codex apply_patch / read / list / grep | decoder tools | Optional compat profile |
+| OpenCode read/write/edit/bash/glob/grep/todo/skill | decoder | Optional `compat.opencode` |
+| Claude import | missing | **Port** into swift/decoder |
| Cursor skills scan | missing | **Port** |
---
## 4. Slash commands & UX (pager)
-Grok slash modules (port checklist → rho `/` commands or CLI):
+Grok slash modules (port checklist → decoder `/` commands or CLI):
-| Grok slash | Status in rho | Action |
+| Grok slash | Status in decoder | Action |
|------------|----------------|--------|
| help | Partial | Port completeness |
| model / effort | Partial | Port effort levels |
@@ -259,17 +259,17 @@ Grok slash modules (port checklist → rho `/` commands or CLI):
---
-## 5. User-guide docs (port as rho user-guide)
+## 5. User-guide docs (port as decoder user-guide)
| Grok doc | Port to |
|----------|---------|
-| 01–05 essentials | `rho/docs/user-guide/` |
+| 01–05 essentials | `decoder/docs/user-guide/` |
| 06 theming | same |
| 07 MCP | same + mcp-servers.md merge |
| 08 skills | same |
| 09 plugins | same |
| 10 hooks | same |
-| 11 custom models | flux + rho |
+| 11 custom models | mux + decoder |
| 12 project rules AGENTS.md | exists Partial |
| 13 memory | harrier UX |
| 14 headless | CLI flags doc |
@@ -292,7 +292,7 @@ Grok slash modules (port checklist → rho `/` commands or CLI):
These are “small” crates/modules but required for **full** port claims:
-| Item | Grok home | Rho action | Effort |
+| Item | Grok home | Decoder action | Effort |
|------|-----------|-------------|--------|
| Folder trust | `workspace/folder_trust.rs` | **Port** `internal/trust` | M |
| envrc / direnv load | `workspace/envrc.rs` | **Port** | S |
@@ -332,7 +332,7 @@ These are “small” crates/modules but required for **full** port claims:
| Hyperlink routing | pager | Port | S |
| Config TOML live edit | pager | Port | S |
| Goal classifier | shell session | Port | S |
-| Swift classifier | shell | map to rho swift | S |
+| Swift classifier | shell | map to decoder swift | S |
| Repo changes tracking | shell session | Partial | M |
| Active sessions multi | shell | Partial | M |
| MCP doctor | shell mcp_doctor | Port | S |
@@ -349,10 +349,10 @@ These are “small” crates/modules but required for **full** port claims:
| Quarter | Deliverables | Repos |
|---------|--------------|-------|
-| **Q1** | Contracts spawn DTOs; wire explore/plan/general; stop hardcoded explore; explore bash hard gate; unify taskruntime; structured SpawnResult | contracts, rho |
-| **Q2** | sandbox.toml; folder trust; safe-bash; permission pipeline hooks-first; PreToolUse deny | rho |
-| **Q3** | File+HTTP hooks; vendor aliases; multi-harness skills; multi-component plugins; marketplace MVP | rho, community-skills |
-| **Q4** | Monitor/Wait/Kill; /loop; structured AskUser; plan/spec alignment; user-guide 01–12; crash handler; announcements; prompt queue; interjection | rho |
+| **Q1** | Contracts spawn DTOs; wire explore/plan/general; stop hardcoded explore; explore bash hard gate; unify taskruntime; structured SpawnResult | contracts, decoder |
+| **Q2** | sandbox.toml; folder trust; safe-bash; permission pipeline hooks-first; PreToolUse deny | decoder |
+| **Q3** | File+HTTP hooks; vendor aliases; multi-harness skills; multi-component plugins; marketplace MVP | decoder, community-skills |
+| **Q4** | Monitor/Wait/Kill; /loop; structured AskUser; plan/spec alignment; user-guide 01–12; crash handler; announcements; prompt queue; interjection | decoder |
**Exit Year 0:** Contributor-ready “Grok-class agent controls” without claiming full TUI parity.
@@ -361,7 +361,7 @@ These are “small” crates/modules but required for **full** port claims:
| Quarter | Deliverables |
|---------|--------------|
| **Q5** | ACP session/load/resume; richer updates; OpenAPI; sdk-go/python fields |
-| **Q6** | Managed policy (signed) graycode-cloud → rho; IT tier; config layer order |
+| **Q6** | Managed policy (signed) graycode-cloud → decoder; IT tier; config layer order |
| **Q7** | Foreign session import (Claude/Codex); envrc; hunk tracker; fast worktree; mermaid render |
| **Q8** | Voice streaming upgrade; update checker parity; MCP doctor; slash parity batch 1; user-guide 13–24 |
@@ -378,7 +378,7 @@ These are “small” crates/modules but required for **full** port claims:
### Year 3–5 — Continuous parity
-- Diff audit bot: scan Grok public releases → open rho issues
+- Diff audit bot: scan Grok public releases → open decoder issues
- Enterprise: MDM, SCIM (cloud), fleet policies
- Full editor suite (VS Code/Zed via ACP)
- Hardening, fuzz, SLSA releases
@@ -406,11 +406,11 @@ Each pack is a shippable program of work with Definition of Done.
- [ ] Tests for aliases and validation
- [ ] Version release
-**DoD:** rho can import types; no engine deps.
+**DoD:** decoder can import types; no engine deps.
### PACK-02: Spawn control plane (6–8 weeks)
-**Repo:** `rho`
+**Repo:** `decoder`
- [ ] Change `AgentSpawnFn` to SpawnRequest/Result
- [ ] Agent tool full schema (type, capability, isolation, resume, cwd, model, thoroughness, description, background)
@@ -440,7 +440,7 @@ Each pack is a shippable program of work with Definition of Done.
- [ ] File discovery paths
- [ ] HTTP runner
- [ ] Inject into PermissionEngine before autonomy
-- [ ] Plugin env RHO_PLUGIN_ROOT/DATA
+- [ ] Plugin env DECODER_PLUGIN_ROOT/DATA
### PACK-05: Extensions (8–10 weeks)
@@ -484,7 +484,7 @@ Each pack is a shippable program of work with Definition of Done.
### PACK-10: Enterprise policy (6 weeks)
- [ ] Signed managed policy schema (cloud)
-- [ ] rho apply layers
+- [ ] decoder apply layers
- [ ] fail-open vs fail-closed
- [ ] IT non-excludable tier end-to-end
@@ -510,7 +510,7 @@ Each pack is a shippable program of work with Definition of Done.
### PACK-14: TUI parity program (ongoing XL)
-Track Grok pager features against rho Bubble Tea:
+Track Grok pager features against decoder Bubble Tea:
- [ ] Dashboard view parity
- [ ] Agents/personas modal
@@ -545,7 +545,7 @@ Only if product requires remote tool hosts:
## 9. Per graycode-eco repo full ownership checklist
-### `rho` (majority)
+### `decoder` (majority)
Port/finish: spawn, tools, sandbox, trust, hooks, plugins, marketplace client, TUI, ACP, headless, slash, taskruntime, hunks, mermaid, voice, crash, announcements, queue, interjection, plan, ask user, update, PTY harness, envrc, permissions pipeline, user-guide.
@@ -553,7 +553,7 @@ Port/finish: spawn, tools, sandbox, trust, hooks, plugins, marketplace client, T
Port: spawn/capability/isolation types, hook events, optional sandbox policy DTO, tool protocol types (later).
-### `flux`
+### `mux`
Absorb: sampling/stream/retry/circuit-breaker lessons; catalog already ahead; managed deployment hooks; **do not** become Grok-only auth.
@@ -571,7 +571,7 @@ Foreign session import; share/export; session indexing parity with Grok session
### `kestrel` / `merlin`
-No direct Grok crates; keep peer engines; ensure rho composition matches Grok “review/merlin” product moments if any.
+No direct Grok crates; keep peer engines; ensure decoder composition matches Grok “review/merlin” product moments if any.
### `falcon`
@@ -605,10 +605,10 @@ Dashboard/usage/marketplace web UI only.
| SpaceXAI-only browser auth as sole path | Multi-provider + keychain |
| `xai-token-estimation` | shrike wins |
| Replace harrier with markdown memory files | Graph better |
-| Replace flux with xai-grok-sampler | Multi-provider better |
+| Replace mux with xai-grok-sampler | Multi-provider better |
| ratatui widgets | Bubble Tea stack |
| `xai-proto-build` | Rust build |
-| Closed contribution policy | Rho is open |
+| Closed contribution policy | Decoder is open |
Skipping is **documented completion**, not unfinished work.
@@ -650,7 +650,7 @@ Declare complete when:
6. Folder trust + sandbox deny globs pass security tests on macOS+Linux.
7. Marketplace can install a multi-component plugin.
8. Subagent explore/plan/general + resume + worktree isolation work.
-9. No second memory/token/provider stack duplicated against harrier/shrike/flux.
+9. No second memory/token/provider stack duplicated against harrier/shrike/mux.
10. Continuous parity process (PACK-17) running for 2 releases.
---
@@ -692,7 +692,7 @@ Execute shorter plan as **Year 0** of this master plan.
## 16. One-line summary
-**Port all of grok-eco into graycode-eco = reimplement Grok Build’s full capability surface in Go across graycode-eco repos, map each crate to an owner engine, skip vendor/privacy conflicts, wire Rho’s existing partial systems first, and run a multi-year program ending in behavioral parity—not a Rust code transplant.**
+**Port all of grok-eco into graycode-eco = reimplement Grok Build’s full capability surface in Go across graycode-eco repos, map each crate to an owner engine, skip vendor/privacy conflicts, wire Decoder’s existing partial systems first, and run a multi-year program ending in behavioral parity—not a Rust code transplant.**
---
diff --git a/docs/plans/GROK-CLASS-CAPABILITY-LONG-HORIZON-PLAN.md b/docs/plans/GROK-CLASS-CAPABILITY-LONG-HORIZON-PLAN.md
index 0677beccc..f810e85fe 100644
--- a/docs/plans/GROK-CLASS-CAPABILITY-LONG-HORIZON-PLAN.md
+++ b/docs/plans/GROK-CLASS-CAPABILITY-LONG-HORIZON-PLAN.md
@@ -4,8 +4,8 @@
**Date:** 2026-07-16
**Horizon:** ~12–18 months (phased; can compress with parallel teams)
**Language:** Go only (no Rust ports; reimplement contracts and behavior)
-**Primary product:** `rho`
-**Supporting repositories:** `eagle`, `flux`, `harrier` (Harrier), `shrike` (Shrike), `swift` (Swift), `kestrel` (Kestrel), `merlin` (Merlin), `falcon`, `starling`, `sparrow`, `robin`, `wren`, `owl`, and `graycode-platform` (web/BFF/Rho Cloud; outside the Rho Go runtime graph)
+**Primary product:** `decoder`
+**Supporting repositories:** `eagle`, `mux`, `harrier` (Harrier), `shrike` (Shrike), `swift` (Swift), `kestrel` (Kestrel), `merlin` (Merlin), `falcon`, `starling`, `sparrow`, `robin`, `wren`, `owl`, and `graycode-platform` (web/BFF/Decoder Cloud; outside the Decoder Go runtime graph)
---
@@ -13,21 +13,21 @@
### Goal
-Bring Rho to **Grok-class agent control-plane quality** (typed subagents, sandbox profiles, folder trust, hooks, plugins/marketplace, ACP depth, monitor/scheduler, enterprise managed policy) **without** abandoning Rho’s multi-repo Go platform advantages (flux multi-provider, harrier graph memory, shrike compression, mission mode, contracts, cloud ledger).
+Bring Decoder to **Grok-class agent control-plane quality** (typed subagents, sandbox profiles, folder trust, hooks, plugins/marketplace, ACP depth, monitor/scheduler, enterprise managed policy) **without** abandoning Decoder’s multi-repo Go platform advantages (mux multi-provider, harrier graph memory, shrike compression, mission mode, contracts, cloud ledger).
### Non-goals
-- Rewrite Rho in Rust or monorepo-collapse engines into rho.
+- Rewrite Decoder in Rust or monorepo-collapse engines into decoder.
- Vendor lock-in to a single LLM host auth model.
-- Replace flux/harrier/shrike/swift with Grok-shaped internal crates.
+- Replace mux/harrier/shrike/swift with Grok-shaped internal crates.
- Default opt-in product telemetry that violates privacy-first posture.
### Strategy
-1. **Close wiring gaps first** — Rho already has many *types* and *partial systems* that are not exposed on the Agent tool or unified.
+1. **Close wiring gaps first** — Decoder already has many *types* and *partial systems* that are not exposed on the Agent tool or unified.
2. **Stabilize contracts** in `eagle` before multi-repo consumers.
3. **Ship vertical slices** (end-to-end user value) every quarter.
-4. **Keep engines peer-independent**; rho remains the only product orchestrator.
+4. **Keep engines peer-independent**; decoder remains the only product orchestrator.
---
@@ -110,7 +110,7 @@ This is the single highest-ROI fix: **wire what already exists**, then extend.
```text
┌──────────────────────────────┐
- │ rho TUI / CLI / daemon/ACP │
+ │ decoder TUI / CLI / daemon/ACP │
└──────────────┬───────────────┘
│
┌─────────────────────────┼─────────────────────────┐
@@ -130,10 +130,10 @@ This is the single highest-ROI fix: **wire what already exists**, then extend.
│
┌────┴────┬──────────┬──────────┬──────────┐
▼ ▼ ▼ ▼ ▼
- flux harrier shrike swift kestrel/merlin
+ mux harrier shrike swift kestrel/merlin
```
-**New core package (proposed):** `rho/internal/spawn` (or expand `engine/agent`) owning:
+**New core package (proposed):** `decoder/internal/spawn` (or expand `engine/agent`) owning:
- `SpawnRequest` / `SpawnResult` (Go structs aligned with contracts)
- capability filter, isolation worktree lifecycle
@@ -186,7 +186,7 @@ Legend: **Done** | **Partial** | **Missing** | **N/A (keep engine)**
| C2 | Vendor event aliases | Missing | Full |
| C3 | File-discovered hooks | Partial (in-process) | Full |
| C4 | HTTP hooks | Missing | Full |
-| C5 | Plugin env RHO_PLUGIN_ROOT/DATA | Missing | Full |
+| C5 | Plugin env DECODER_PLUGIN_ROOT/DATA | Missing | Full |
| C6 | PreToolUse can deny in CheckTool path | Missing | Full |
### Wave D — Plugins & marketplace (P3)
@@ -261,7 +261,7 @@ Legend: **Done** | **Partial** | **Missing** | **N/A (keep engine)**
## 4. Multi-quarter roadmap (long horizon)
-Assumes ~1–2 senior Go engineers on rho core + fractional engine/cloud; scale parallelizes quarters.
+Assumes ~1–2 senior Go engineers on decoder core + fractional engine/cloud; scale parallelizes quarters.
```text
Q1 Foundation: contracts + spawn wiring + background unify
@@ -370,13 +370,13 @@ type SpawnResult struct {
**Exit criteria**
-- `go test ./...` green; rho can depend on new pseudo-version without engine imports.
+- `go test ./...` green; decoder can depend on new pseudo-version without engine imports.
---
### Phase 2 — Spawn controller & Agent tool (4–6 weeks) ★ highest ROI
-**Repo:** `rho`
+**Repo:** `decoder`
**Packages:** `internal/engine/agent`, `internal/engine`, `internal/tool`
#### 2.1 Change `AgentSpawnFn` signature
@@ -403,8 +403,8 @@ Migration: temporary adapter for one release if needed; prefer single breaking c
| 2 | Map `subagent_type` → `SubAgentMode` (+ thoroughness) |
| 3 | Default capability from mode; allow override |
| 4 | Apply `FilterToolsForMode` **and** capability filter |
-| 5 | Isolation worktree: create under `.rho/worktrees/` using shared helper from mission worker |
-| 6 | Persist child session transcript under `~/.rho/subagents//` |
+| 5 | Isolation worktree: create under `.decoder/worktrees/` using shared helper from mission worker |
+| 6 | Persist child session transcript under `~/.decoder/subagents//` |
| 7 | `resume_from`: load transcript, append prompt, re-spawn with same type |
| 8 | Return structured `SpawnResult` JSON to model |
@@ -449,7 +449,7 @@ Deprecate:
#### 2.6 PR stack (Graphite-friendly)
-1. Contracts bump in rho
+1. Contracts bump in decoder
2. `SpawnRequest` internal + adapter
3. Agent tool schema + parse
4. Wire modes plan/general/explore
@@ -474,13 +474,13 @@ Deprecate:
### Phase 3 — Sandbox profiles + folder trust (4–5 weeks)
-**Repo:** `rho`
+**Repo:** `decoder`
**Packages:** `internal/sandbox`, `internal/trust` (new), `internal/mcp`, `internal/hooks`, `internal/plugin`
#### 3.1 sandbox.toml
```toml
-# ~/.rho/sandbox.toml
+# ~/.decoder/sandbox.toml
[profiles.ci]
extends = "strict"
restrict_network = true
@@ -490,7 +490,7 @@ deny = ["**/.env", "**/*.pem", "**/*credentials*"]
**Loader rules (security-critical):**
1. Load user global.
-2. Load project `.rho/sandbox.toml` **additive only** (new names only).
+2. Load project `.decoder/sandbox.toml` **additive only** (new names only).
3. Warn on conflicting redefinition; ignore project redefinition.
4. Deny globs applied on top of backend (seatbelt/landlock/bwrap-equivalent).
5. Fail closed when deny requested but OS cannot enforce.
@@ -508,7 +508,7 @@ deny = ["**/.env", "**/*.pem", "**/*credentials*"]
#### 3.3 Folder trust
-**Store:** `~/.rho/trusted_folders.toml`
+**Store:** `~/.decoder/trusted_folders.toml`
```toml
[[folders]]
@@ -538,7 +538,7 @@ trusted_at = "2026-07-16T00:00:00Z"
### Phase 4 — Hooks pipeline completion (3–4 weeks)
-**Repo:** `rho`
+**Repo:** `decoder`
**Package:** `internal/hooks`
#### 4.1 Event model expansion
@@ -550,7 +550,7 @@ Keep existing; alias map for Claude/Cursor names.
| Type | Behavior |
|------|----------|
-| command | shell with timeout, env RHO_* |
+| command | shell with timeout, env DECODER_* |
| http | POST JSON, timeout, optional deny on non-2xx for pre_tool |
#### 4.3 Integration into PermissionEngine
@@ -566,8 +566,8 @@ CheckTool:
#### 4.4 File discovery
-- `~/.rho/hooks/*.json`
-- `.rho/hooks/*.json` (trust required)
+- `~/.decoder/hooks/*.json`
+- `.decoder/hooks/*.json` (trust required)
- Compat: `.claude/settings.json` hooks, `.cursor/hooks.json` behind flags
**Exit criteria**
@@ -582,7 +582,7 @@ CheckTool:
### Phase 5 — Plugins multi-component + marketplace MVP (6–8 weeks)
-**Repos:** `rho`, `starling`
+**Repos:** `decoder`, `starling`
#### 5.1 Plugin layout (convention)
@@ -603,19 +603,19 @@ Loader merges components; tools optional.
1. Session meta / SDK
2. `--plugin-dir`
-3. Project `.rho/plugins` (trust)
-4. User `~/.rho/plugins`
+3. Project `.decoder/plugins` (trust)
+4. User `~/.decoder/plugins`
5. Config extra paths
#### 5.3 Marketplace
| Component | Owner |
|-----------|--------|
-| Source list config | rho |
-| Index schema | community-skills + rho |
-| Install resolve (git) | rho |
-| Audit | rho plugin malware_check (extend) |
-| CLI `rho plugins` / TUI tab | rho |
+| Source list config | decoder |
+| Index schema | community-skills + decoder |
+| Install resolve (git) | decoder |
+| Audit | decoder plugin malware_check (extend) |
+| CLI `decoder plugins` / TUI tab | decoder |
| Optional web gallery | graycode-platform later |
#### 5.4 Multi-harness skills
@@ -661,7 +661,7 @@ Depends on Phase 2 unified `taskruntime`.
| Work | Detail |
|------|--------|
-| Plan subagent | Default tool for “design only”; writes plan file under `.rho/plans/` or specs |
+| Plan subagent | Default tool for “design only”; writes plan file under `.decoder/plans/` or specs |
| Spec workflow | Document mapping: plan agent → `/spec` stages; avoid double systems |
| AskUserQuestion | questions[], options, multi_select, other, cancel message |
| TUI | Reuse autonomy/spec pickers |
@@ -677,7 +677,7 @@ Depends on Phase 2 unified `taskruntime`.
### Phase 8 — ACP phase-2 + SDKs + OpenAPI (5–7 weeks)
-**Repos:** `rho`, `sparrow`, `robin`
+**Repos:** `decoder`, `sparrow`, `robin`
| Milestone | Scope |
|-----------|--------|
@@ -686,11 +686,11 @@ Depends on Phase 2 unified `taskruntime`.
| ACP-3 | permission round-trip hardened |
| API | OpenAPI fields: spawn options, sandbox, autonomy, plugins meta |
| SDK | AgentConfig + ChatRequest fields; plugin dirs |
-| Optional | `rho agent serve --bind` WS |
+| Optional | `decoder agent serve --bind` WS |
**Exit criteria**
-- Zed/VS Code can drive rho ACP for multi-turn with permissions.
+- Zed/VS Code can drive decoder ACP for multi-turn with permissions.
- SDK e2e against daemon contract snapshot tests.
**Effort:** ~7 eng-weeks (+ extension work separate).
@@ -699,13 +699,13 @@ Depends on Phase 2 unified `taskruntime`.
### Phase 9 — Enterprise managed policy (4–6 weeks)
-**Repos:** `graycode-platform/apps/worker` (deployed as `graycode-cloud`), `rho`, optional `flux`
+**Repos:** `graycode-platform/apps/worker` (deployed as `graycode-cloud`), `decoder`, optional `mux`
| Piece | Detail |
|-------|--------|
| Policy document | models allow/deny, capabilities, sandbox deny, max budget, tool denylist |
-| Signing | Ed25519 envelope; rho verifies before apply |
-| Apply path | `~/.rho/managed_policy.json` layers under user config |
+| Signing | Ed25519 envelope; decoder verifies before apply |
+| Apply path | `~/.decoder/managed_policy.json` layers under user config |
| Default | fail-open for individual; org can require fail-closed |
| IT tier | non-excludable rules (already sketched in product — finish) |
| Cloud UI | graycode-platform admin later |
@@ -726,10 +726,10 @@ Build on existing enterprise policyInput (model/capability lists).
| Item | Repo | Detail |
|------|------|--------|
-| Foreign import | swift + rho CLI | Claude/Codex session metadata → index |
-| Hunk attribution | rho | agent vs external edits via fsnotify |
-| Memory UX | harrier + rho | toggle priority, `/dream` consolidate |
-| Mermaid optional | rho | sandbox render path |
+| Foreign import | swift + decoder CLI | Claude/Codex session metadata → index |
+| Hunk attribution | decoder | agent vs external edits via fsnotify |
+| Memory UX | harrier + decoder | toggle priority, `/dream` consolidate |
+| Mermaid optional | decoder | sandbox render path |
**Exit criteria**
@@ -756,20 +756,20 @@ Build on existing enterprise policyInput (model/capability lists).
| Concept family | Primary | Secondary | Contracts? |
|----------------|---------|-----------|------------|
-| Spawn / capability / isolation | rho | — | yes |
-| Sandbox profiles | rho | — | optional DTO |
-| Folder trust | rho | — | no |
-| Hooks | rho | — | event names yes |
-| Plugins / marketplace | rho | community-skills | manifest schema |
-| Multi-harness skills | rho | community-skills | no |
-| Monitor/tasks | rho | — | optional |
-| ACP | rho | sdk-go/python | OpenAPI |
-| Managed policy | graycode-platform/apps/worker (deployed as `graycode-cloud`) | rho, graycode-platform/apps/bff | yes DTO |
-| Foreign import | swift | rho | optional |
-| Memory dream UX | harrier | rho | no |
+| Spawn / capability / isolation | decoder | — | yes |
+| Sandbox profiles | decoder | — | optional DTO |
+| Folder trust | decoder | — | no |
+| Hooks | decoder | — | event names yes |
+| Plugins / marketplace | decoder | community-skills | manifest schema |
+| Multi-harness skills | decoder | community-skills | no |
+| Monitor/tasks | decoder | — | optional |
+| ACP | decoder | sdk-go/python | OpenAPI |
+| Managed policy | graycode-platform/apps/worker (deployed as `graycode-cloud`) | decoder, graycode-platform/apps/bff | yes DTO |
+| Foreign import | swift | decoder | optional |
+| Memory dream UX | harrier | decoder | no |
| Token | shrike | — | no change |
-| Providers | flux | rho | no change |
-| Review engines | kestrel/merlin | rho | findings already |
+| Providers | mux | decoder | no change |
+| Review engines | kestrel/merlin | decoder | findings already |
---
@@ -835,7 +835,7 @@ Prefer **secure defaults** (folder trust on) even if noisy.
| Risk | Impact | Mitigation |
|------|--------|------------|
-| Signature change of AgentSpawnFn breaks plugins | High | Adapter release; version min_rho |
+| Signature change of AgentSpawnFn breaks plugins | High | Adapter release; version min_decoder |
| Worktree disk bloat | Med | GC old worktrees; symlink shared dirs (already pattern) |
| Explore still escapes via Bash | High | AST allowlist + sandbox |
| Marketplace supply chain | High | audit, pin commit SHAs, signatures later |
@@ -886,7 +886,7 @@ docs(user-guide): 01-getting-started …
| Role | Q1–Q2 | Q3–Q4 | Q5–Q8 |
|------|-------|-------|-------|
-| Rho core (Go) | 1.5 FTE | 1.5 FTE | 1 FTE |
+| Decoder core (Go) | 1.5 FTE | 1.5 FTE | 1 FTE |
| Security-minded sandbox | 0.5 FTE | 0.5 FTE | 0.25 FTE |
| Community-skills / marketplace content | 0.25 | 0.75 | 0.5 |
| Cloud (TS) | 0 | 0.25 | 0.75 |
@@ -920,21 +920,21 @@ Background:
---
-## 14. Appendix B — Mapping Grok names → Rho names
+## 14. Appendix B — Mapping Grok names → Decoder names
-| Grok | Rho |
+| Grok | Decoder |
|------|------|
| `task` tool | `Agent` / `Task` alias |
| `general-purpose` | `general` / `general-purpose` |
| `capability_mode` | same |
| `isolation: worktree` | same |
| `resume_from` | same (replace weak `agent_id` semantics) |
-| `sandbox.toml` | `~/.rho/sandbox.toml` |
-| folder trust | `~/.rho/trusted_folders.toml` |
+| `sandbox.toml` | `~/.decoder/sandbox.toml` |
+| folder trust | `~/.decoder/trusted_folders.toml` |
| `/loop` | `/loop` over CronScheduler |
-| plugin marketplace | `rho plugins` + community registry |
+| plugin marketplace | `decoder plugins` + community registry |
| managed_config | managed policy via graycode-cloud |
-| ACP | `rho acp` |
+| ACP | `decoder acp` |
---
@@ -976,7 +976,7 @@ Week 4
| Trust default | On | Security |
| Marketplace before trust? | No | Supply chain |
| Replace harrier? | No | Graph memory superior |
-| Replace flux? | No | Multi-provider is differentiator |
+| Replace mux? | No | Multi-provider is differentiator |
| Three bg systems | Unify early | Blocks monitor/wait |
---
diff --git a/docs/plans/SPEC_DRIVEN_PHASE2_PLAN.md b/docs/plans/SPEC_DRIVEN_PHASE2_PLAN.md
index 29e1dffa3..a290602c6 100644
--- a/docs/plans/SPEC_DRIVEN_PHASE2_PLAN.md
+++ b/docs/plans/SPEC_DRIVEN_PHASE2_PLAN.md
@@ -69,7 +69,7 @@
**Changes:**
1. Create `internal/tool/spec_version.go` — SpecVersionTool
- - Stage .rho/specs/ changes
+ - Stage .decoder/specs/ changes
- Generate commit message referencing REQ IDs
- Link code commits to spec requirements
diff --git a/docs/plans/YEAR-0-ACTIVE.md b/docs/plans/YEAR-0-ACTIVE.md
index aaf9be48d..7f91cfb43 100644
--- a/docs/plans/YEAR-0-ACTIVE.md
+++ b/docs/plans/YEAR-0-ACTIVE.md
@@ -1,13 +1,13 @@
-# Year 0 Active Track (Grok → Rho)
+# Year 0 Active Track (Grok → Decoder)
> **Historical.** This track predates the removal of the harrier, kestrel,
-> merlin, shrike, and swift engines. Rho now depends only on `flux` and
+> merlin, shrike, and swift engines. Decoder now depends only on `mux` and
> embeds its own token engine. Kept for record.
**Status:** Superseded
**Date:** 2026-07-16
**ADR:** [ADR-0003](../architecture/adr/ADR-0003-grok-behavioral-port-go-multirepo.md)
-**Full matrices:** [FULL-GROK-ECO-TO-RHO-ECO-PORT-PLAN.md](./FULL-GROK-ECO-TO-RHO-ECO-PORT-PLAN.md),
+**Full matrices:** [FULL-GROK-ECO-TO-DECODER-ECO-PORT-PLAN.md](./FULL-GROK-ECO-TO-DECODER-ECO-PORT-PLAN.md),
[GROK-CLASS-CAPABILITY-LONG-HORIZON-PLAN.md](./GROK-CLASS-CAPABILITY-LONG-HORIZON-PLAN.md)
This is the **executable Year 0 program**. It does not replace the full
@@ -18,8 +18,8 @@ port matrices; it freezes what “Year 0 done” means and tracks pack status.
| Do | Do not |
|----|--------|
| Reimplement Grok **behavior** in Go | Copy Rust crates or depend on Grok |
-| Map capabilities to graycode-eco repos | Collapse engines into rho monorepo |
-| Wire existing modes/budgets first | Rebuild flux/harrier/shrike as Grok clones |
+| Map capabilities to graycode-eco repos | Collapse engines into decoder monorepo |
+| Wire existing modes/budgets first | Rebuild mux/harrier/shrike as Grok clones |
| Privacy-first telemetry (OTEL opt-in) | Port Mixpanel defaults |
## Pack status
@@ -42,13 +42,13 @@ port matrices; it freezes what “Year 0 done” means and tracks pack status.
- [x] Model can spawn `explore` \| `plan` \| `general-purpose` via Agent tool schema (isolation=worktree works; resume still stub)
- [x] Explore bash cannot mutate (`ExploreBashAllowed` segment allowlist + `ReadOnlyBash` on subagents)
- [x] Unified agent taskruntime (`internal/taskruntime`; shell TaskOutput merge is PACK-06)
-- [x] Folder trust gates project hooks / plugins (`.rho/plugins`, `.rho/hooks`; MCP/LSP follow same AllowLoadPath)
+- [x] Folder trust gates project hooks / plugins (`.decoder/plugins`, `.decoder/hooks`; MCP/LSP follow same AllowLoadPath)
- [x] `sandbox.toml` profiles + project additive merge; deny globs fail-closed
- [x] PreToolUse hooks can deny inside `PermissionEngine` before autonomy
- [x] Multi-component plugins + marketplace MVP install path
- [x] Monitor + Wait/Kill + `/loop` tools implemented and working
- [~] Crash handler, announcements, prompt queue, interjection — crash handler exists in cmd/errors.go; `/btw` (interjection) implemented; announcements and prompt queue still missing
-- [x] User-guide docs `01`–`24` under `rho/docs/user-guide/` (completed July 2026)
+- [x] User-guide docs `01`–`24` under `decoder/docs/user-guide/` (completed July 2026)
- [x] ADR-0003 published
- [x] PACK-00 inventory + flags + spawn matrix template complete
@@ -62,9 +62,9 @@ computer hub, full slash/TUI pixel parity, Mixpanel.
| Env | Default | Purpose |
|-----|---------|---------|
-| `RHO_Y0_SPAWN_V2` | `1` once PACK-02 ships; `0` during dual path | Typed SpawnRequest path |
-| `RHO_Y0_FOLDER_TRUST` | `1` recommended after PACK-03 | Gate project automation |
-| `RHO_Y0_MARKETPLACE` | `0` until PACK-05 + trust | Marketplace install path |
+| `DECODER_Y0_SPAWN_V2` | `1` once PACK-02 ships; `0` during dual path | Typed SpawnRequest path |
+| `DECODER_Y0_FOLDER_TRUST` | `1` recommended after PACK-03 | Gate project automation |
+| `DECODER_Y0_MARKETPLACE` | `0` until PACK-05 + trust | Marketplace install path |
Implementation: `internal/flags/y0.go`.
diff --git a/docs/plans/codex-adoption-plan.md b/docs/plans/codex-adoption-plan.md
index 66ad9a4ae..500522875 100644
--- a/docs/plans/codex-adoption-plan.md
+++ b/docs/plans/codex-adoption-plan.md
@@ -1,9 +1,9 @@
# OpenAI Codex CLI Adoption Plan
-Status: Audited. Core ideas already implemented natively in rho; remaining
+Status: Audited. Core ideas already implemented natively in decoder; remaining
deltas recorded as future RFCs.
-> **Superseded runtime assumptions (2026-09-20):** Rho no longer ships a
+> **Superseded runtime assumptions (2026-09-20):** Decoder no longer ships a
> native OS/container sandbox or a Docker execution backend. The permission
> engine, path guard, trust policy, and destructive-command hard blocks are
> the current local safety boundary. Sandbox rows below are historical design
@@ -14,9 +14,9 @@ Source: `https://github.com/openai/codex` (Apache-2.0, Rust workspace
## Executive Decision
-The audit found that every codex-rs capability relevant to rho's security and
+The audit found that every codex-rs capability relevant to decoder's security and
runtime model already has a native Go implementation, several of them deeper
-than codex's equivalents because they build on Rho's independent ecosystem
+than codex's equivalents because they build on Decoder's independent ecosystem
repositories.
No second runtime, sandbox layer, or policy engine was created.
@@ -27,18 +27,18 @@ Three codex ideas are deliberately deferred as future RFCs; see
## Capability Audit
-| codex-rs crate/concept | rho implementation | Decision |
+| codex-rs crate/concept | decoder implementation | Decision |
|---|---|---|
-| `core` agent loop | `internal/engine` | Keep rho |
-| `tui`, `ansi-escape`, `terminal-detection` | Bubble Tea/Lipgloss TUI | Keep rho |
-| `rollout`, `thread-store`, `history` JSONL sessions with resume/fork | `internal/session` JSONL + WAL + named checkpoints + fork + recovery + handover | Keep rho (richer) |
-| `app-server-daemon`, `app-server-protocol` (JSON-RPC for IDE/desktop) | `internal/daemon` HTTP/SSE on 4590 + `internal/acp` | Keep rho |
-| `mcp-server`, `codex-mcp`, `rmcp-client`, `connectors` | `internal/mcp` client+server, sibling `falcon` scaffolding | Keep rho |
-| `skills`, `plugin`, `hooks` | community skill registry + structural validator, plugins, expanded lifecycle hook events | Keep rho |
-| `login`, `keyring-store`, `aws-auth` | flux credential store in OS keychain across 28 providers | Keep rho (broader) |
-| `model-provider(-info)`, `models-manager`, `ollama`, `lmstudio` | sibling `flux` adapters, catalog, cascade routing | Keep rho (much broader) |
-| `memories`, `agent-graph-store`, `context-fragments` | sibling `harrier` (Harrier) graph memory; eventlog/graphjournal projections | Keep rho |
-| `apply-patch`, `file-search`, `file-watcher`, `git-utils` | edit tools, codegraph, git tooling, watcher hooks | Keep rho |
+| `core` agent loop | `internal/engine` | Keep decoder |
+| `tui`, `ansi-escape`, `terminal-detection` | Bubble Tea/Lipgloss TUI | Keep decoder |
+| `rollout`, `thread-store`, `history` JSONL sessions with resume/fork | `internal/session` JSONL + WAL + named checkpoints + fork + recovery + handover | Keep decoder (richer) |
+| `app-server-daemon`, `app-server-protocol` (JSON-RPC for IDE/desktop) | `internal/daemon` HTTP/SSE on 4590 + `internal/acp` | Keep decoder |
+| `mcp-server`, `codex-mcp`, `rmcp-client`, `connectors` | `internal/mcp` client+server, sibling `falcon` scaffolding | Keep decoder |
+| `skills`, `plugin`, `hooks` | community skill registry + structural validator, plugins, expanded lifecycle hook events | Keep decoder |
+| `login`, `keyring-store`, `aws-auth` | mux credential store in OS keychain across 28 providers | Keep decoder (broader) |
+| `model-provider(-info)`, `models-manager`, `ollama`, `lmstudio` | sibling `mux` adapters, catalog, cascade routing | Keep decoder (much broader) |
+| `memories`, `agent-graph-store`, `context-fragments` | sibling `harrier` (Harrier) graph memory; eventlog/graphjournal projections | Keep decoder |
+| `apply-patch`, `file-search`, `file-watcher`, `git-utils` | edit tools, codegraph, git tooling, watcher hooks | Keep decoder |
| `external-agent-migration` | swift reads Claude Code / Codex / Gemini CLI / OpenCode / Cursor sessions | Parity |
| **`linux-sandbox`** (Landlock + seccomp-bpf) | Removed from the local product runtime | Removed |
| **macOS Seatbelt** | Removed from the local product runtime | Removed |
@@ -68,19 +68,19 @@ Three codex ideas are deliberately deferred as future RFCs; see
the safe read-only fan-out case. Arbitrary-script execution still requires an
embedded runtime, capabilities model, and output-trust threat model; track as
a standalone RFC.
-- **Agent identity signing** (`agent-identity`): rho already provides a
+- **Agent identity signing** (`agent-identity`): decoder already provides a
per-harness anonymous user identity (`internal/identity`) and a tamper-evident
HMAC-chained security log with session-scoped events (`internal/securitylog`).
Signed subagent delegation chains are worth a focused design once multi-org
delegation exists.
- **Cloud tasks client** (`cloud-tasks*`): remote task queue integration.
- Rho Cloud already provides sync/review surfaces; a queue protocol would
+ Decoder Cloud already provides sync/review surfaces; a queue protocol would
duplicate that until a concrete consumer exists.
## Verification
- `go test ./...` full suite green.
-- `make vet`, `make lint`, `rho verify` green.
+- `make vet`, `make lint`, `decoder verify` green.
- Repo-owned markdown passes `markdownlint-cli2 '**/*.md'` (CI scope);
findings under sibling repositories belong to those repositories and follow
their own contribution flow.
diff --git a/docs/plans/commandcodeai-adoption-plan.md b/docs/plans/commandcodeai-adoption-plan.md
index 6f68896f1..15f5c5345 100644
--- a/docs/plans/commandcodeai-adoption-plan.md
+++ b/docs/plans/commandcodeai-adoption-plan.md
@@ -1,6 +1,6 @@
# CommandCodeAI Adoption Plan
-Status: Implemented in the Rho working tree where the existing architecture
+Status: Implemented in the Decoder working tree where the existing architecture
supports a safe, native implementation.
## Source Review
@@ -13,7 +13,7 @@ The reviewed CommandCodeAI organization contains four relevant categories:
| `cmd-old-public` | Archived placeholder/documentation repository | No implementation to adopt |
| `BaseAI` | Archived TypeScript pipe SDK/local provider server; licensing metadata is inconsistent | Reimplement narrow ideas only; do not add as a dependency |
| `agent-skills` | MIT skill collection with progressive-disclosure guidance | Adopt authoring/process ideas; preserve individual asset licenses |
-| `awesome-agents` | Apache-2.0 example applications | Reference only; do not merge into Rho skills |
+| `awesome-agents` | Apache-2.0 example applications | Reference only; do not merge into Decoder skills |
`starling` remains the canonical public skill registry. Its
validator and registry tooling are more complete than the CommandCodeAI
@@ -23,7 +23,7 @@ repositories and should remain authoritative.
### 5. Kimi Code workflow parity
-The Kimi Code comparison confirmed that Rho already provides native equivalents
+The Kimi Code comparison confirmed that Decoder already provides native equivalents
for most of its useful workflow ideas. The remaining gaps were addressed without
adding a second agent runtime:
@@ -34,20 +34,20 @@ adding a second agent runtime:
`UserPromptQueued`, `TurnStarted`, `PostToolFailure`, `PermissionResult`,
`SessionHeartbeat`, `TaskStarted`, `StopFailure`, `Interrupt`, and
`Notification`.
-- Rho's existing permission engine already supports ordered allow/deny rules
+- Decoder's existing permission engine already supports ordered allow/deny rules
such as `Bash(git status*)` and `Write(*.env)`, pre-tool denial hooks, scoped
policy snapshots, and destructive-command hard blocks.
-- Rho's existing goal tracker already provides durable objective state,
+- Decoder's existing goal tracker already provides durable objective state,
dependencies, progress, token budgets, continuation prompts, and lifecycle
events. A second `GOAL.md` state machine would duplicate this implementation.
The comparison also found no reason to adopt Kimi Code's two-engine split or
-replace Rho's stronger Harrier memory, Shrike token controls, Swift replay, Kestrel
-review, Merlin auditing, or Flux provider runtime.
+replace Decoder's stronger Harrier memory, Shrike token controls, Swift replay, Kestrel
+review, Merlin auditing, or Mux provider runtime.
### 1. Skill metadata interoperability
-Rho's smart-skill parser accepts both hyphenated and community-schema
+Decoder's smart-skill parser accepts both hyphenated and community-schema
snake_case keys:
- `auto-invoke` / `auto_invoke`
@@ -66,7 +66,7 @@ metadata.
### 2. Local skill validation
-Rho's existing Unicode audit remains the runtime security scanner. A new
+Decoder's existing Unicode audit remains the runtime security scanner. A new
structural validator complements it by checking:
- required `name` and `description`
@@ -77,13 +77,13 @@ structural validator complements it by checking:
- `SKILL.md` size
- `@ref(...)` path containment
-`rho skills audit` now reports both Unicode and structural findings. This is a
+`decoder skills audit` now reports both Unicode and structural findings. This is a
small Go-native subset of the community repository's broader validation model;
it does not duplicate the registry's Python implementation.
### 3. Transparent preference model
-Rho already has `internal/features/taste` with confidence, sample count,
+Decoder already has `internal/features/taste` with confidence, sample count,
decay, project identity, merge, reset, prompt projection, and accept/edit
signals. No second preference database was created. The user-facing model and
policy are documented in `docs/user-guide/26-learned-preferences.md`:
@@ -96,12 +96,12 @@ policy are documented in `docs/user-guide/26-learned-preferences.md`:
### 4. Workflow and harness documentation
-CommandCodeAI's strongest product contribution is discoverability. Rho now
+CommandCodeAI's strongest product contribution is discoverability. Decoder now
documents its existing capabilities in:
- `docs/user-guide/26-learned-preferences.md`
- `docs/user-guide/27-workflows.md`
-- `docs/architecture/rho-harness.md`
+- `docs/architecture/decoder-harness.md`
- `docs/user-guide/28-workflow-budgets.md`
These cover slash/shell/file-context input, headless review, MCP-backed
@@ -111,22 +111,22 @@ tool, depth, time, token, and cost budgets.
## Deliberately Not Adopted
-- CommandCodeAI provider adapters: Flux owns provider protocols and routing.
-- BaseAI remote pipes: incompatible with Rho's local authority and durable
+- CommandCodeAI provider adapters: Mux owns provider protocols and routing.
+- BaseAI remote pipes: incompatible with Decoder's local authority and durable
event model.
-- BaseAI `lowdb` JSON memory: weaker than Harrier and Rho persistence.
+- BaseAI `lowdb` JSON memory: weaker than Harrier and Decoder persistence.
- Unconditional parallel tool execution: unsafe for mutations and approvals.
- Historical `gpt3-agent`: no permissions, sandbox, path guard, audit, or tests.
-- Media/UI/status repositories: outside Rho's code-intelligence boundary.
+- Media/UI/status repositories: outside Decoder's code-intelligence boundary.
- CommandCodeAI branding, proprietary model claims, and undocumented services.
## Verification Plan
-1. Run formatting and static checks on all changed Rho Go files.
+1. Run formatting and static checks on all changed Decoder Go files.
2. Run focused parser, validator, taste, engine, and command tests.
-3. Run the full Rho test suite and vet.
+3. Run the full Decoder test suite and vet.
4. Repeat the focused and full checks independently.
5. Merlin the final diff, worktree, and sibling-repository status.
-The Flux repository remains a separate repository change and must be published
-through its own feature branch and PR before updating Rho's module pin.
+The Mux repository remains a separate repository change and must be published
+through its own feature branch and PR before updating Decoder's module pin.
diff --git a/docs/plans/competitive-gap-02-share-multisession.md b/docs/plans/competitive-gap-02-share-multisession.md
index 543c1b782..687eb0440 100644
--- a/docs/plans/competitive-gap-02-share-multisession.md
+++ b/docs/plans/competitive-gap-02-share-multisession.md
@@ -6,9 +6,9 @@ Source: field comparison vs OpenCode share-links/multi-session, herdr multiplexe
Constraint: developer-first, local by default, no cloud account required
(per `.github/ISSUE_TEMPLATE/feature_request.yml:60-63`).
-## Existing rho capabilities (verified)
+## Existing decoder capabilities (verified)
-- `GenerateShareLink` returns local deeplink `rho://share/` (`internal/session/export.go:801-819`); deterministic, no hosted URL.
+- `GenerateShareLink` returns local deeplink `decoder://share/` (`internal/session/export.go:801-819`); deterministic, no hosted URL.
- Session export (`session_export.go`), mission graph export (`cmd/execution_graph.go`, `mission-graph.json`), daemon sessions, `mission` worktrees.
- Completion list includes `exec`, `daemon`, `mission`, `sessions`, `tools`, `skills` (`cmd/completions_test.go:50`).
@@ -21,7 +21,7 @@ Do not adopt: hosted share URLs, cloud account,/Desktop app.
## Priority model
- P0: `sessions` list shows id/model/updated + export path; document `graph export` bundle as the share unit.
-- P1: TUI session picker surfaces the `rho://share/` deeplink + export file path for copy-paste.
+- P1: TUI session picker surfaces the `decoder://share/` deeplink + export file path for copy-paste.
- P2: Mission watchdog read-only overview (already in HUD panel) exposed via `mission --dry-run`/status; no new runtime.
## Steps
diff --git a/docs/plans/competitive-gap-03-kitty-graphics.md b/docs/plans/competitive-gap-03-kitty-graphics.md
index 6293be2f3..f53710212 100644
--- a/docs/plans/competitive-gap-03-kitty-graphics.md
+++ b/docs/plans/competitive-gap-03-kitty-graphics.md
@@ -3,7 +3,7 @@
Status: Implemented (2026-09-09)
Source: `https://github.com/kovidgoyal/kitty` (GPL-3.0; protocol only, no code copy), Ghostty compat; extends `docs/plans/pi-adoption-plan.md:25` (already proposed there — this file scopes the TUI work, it does not re-propose).
-## Existing rho capabilities (verified)
+## Existing decoder capabilities (verified)
- Vision input path: `internal/engine/vision.go`; image command: `cmd/image.go`.
- Terminal detection covers kitty/ghostty/wezterm/alacritty names (`internal/ui/icons/detect_test.go:56`).
diff --git a/docs/plans/competitive-gap-04-published-benchmarks.md b/docs/plans/competitive-gap-04-published-benchmarks.md
index 09ed2c9bb..526d81142 100644
--- a/docs/plans/competitive-gap-04-published-benchmarks.md
+++ b/docs/plans/competitive-gap-04-published-benchmarks.md
@@ -5,7 +5,7 @@ Source: field comparison vs ripgrep/fzf/alacritty (numbers in README), Aider Rep
Constraint: docs-only. No new benchmark framework; infra already exists.
-## Existing rho capabilities (verified)
+## Existing decoder capabilities (verified)
- `make bench` (`go test -bench=. -benchmem -count=3`) in `Makefile:100-101`.
- `internal/bench/suite.go` (eco suite runner + report formatter).
@@ -21,7 +21,7 @@ Do not adopt: new eval harness, SWE-bench claims, provider-funded comparisons.
## Priority model
- P0: fixed command + env (`make bench` subset: session save/load 100/1000, repomap size/tokens) recorded with machine + commit.
-- P1: `docs/BENCHMARKS.md` table (TUI-independent, no latency theater): session save/load, repomap tokens, tool-catalog size before/after `RHO_TOOL_SHRINK=1`.
+- P1: `docs/BENCHMARKS.md` table (TUI-independent, no latency theater): session save/load, repomap tokens, tool-catalog size before/after `DECODER_TOOL_SHRINK=1`.
- P2: CI artifact (optional): nightly `bench` JSON upload; never gate releases on it.
## Steps
diff --git a/docs/plans/competitive-gap-05-backend-wiring.md b/docs/plans/competitive-gap-05-backend-wiring.md
index 177ea64c2..1e741200e 100644
--- a/docs/plans/competitive-gap-05-backend-wiring.md
+++ b/docs/plans/competitive-gap-05-backend-wiring.md
@@ -5,11 +5,11 @@ Source: field comparison vs Qwen `computer_use`, Codex browser/screenshot, Goose
Constraints (non-negotiable):
-- Provider ownership lives in `../flux`; rho consumes only the stable engine facade (`AGENTS.md`, `docs/SECURITY-DEVELOPER.md:51-56`).
-- Boundary guards must stay green: `make boundaries` (incl. `flux-client-guard`, `flux-engine-guard`).
+- Provider ownership lives in `../mux`; decoder consumes only the stable engine facade (`AGENTS.md`, `docs/SECURITY-DEVELOPER.md:51-56`).
+- Boundary guards must stay green: `make boundaries` (incl. `mux-client-guard`, `mux-engine-guard`).
- Tools fail safe today with explicit errors when unwired — preserve that behavior when disabled.
-## Existing rho capabilities (verified)
+## Existing decoder capabilities (verified)
- `ComputerUseTool` reports "no computer backend installed" without `SetComputerBackend` (`internal/tool/computer_use.go:67-94`).
- `GenerateMediaTool` backend nil by default via `SetMediaEngine` (`internal/tool/media_generation.go:69-71`).
@@ -20,18 +20,18 @@ Constraints (non-negotiable):
Adopt: opt-in host wiring through the router facade, env-gated, off by default.
-Do not adopt: direct `flux/client` production imports, new secrets paths, always-on media/computer-use.
+Do not adopt: direct `mux/client` production imports, new secrets paths, always-on media/computer-use.
## Priority model
- P0: design note mapping each tool seam → facade method (media/image, STT/audio, computer backend) with guard-safe import path.
-- P1: env-gated wiring (e.g. `RHO_MEDIA=1`) + docs; unwired default error text unchanged.
-- P2: `rho doctor` reports backend status (wired/unwired) without leaking secrets.
+- P1: env-gated wiring (e.g. `DECODER_MEDIA=1`) + docs; unwired default error text unchanged.
+- P2: `decoder doctor` reports backend status (wired/unwired) without leaking secrets.
## Steps
-1. Confirm facade methods exist in sibling `../flux/engine`; if missing, file the change there first (router repo owns providers).
-2. Implement wiring in rho behind env gates; keep `Set*` seams for tests.
+1. Confirm facade methods exist in sibling `../mux/engine`; if missing, file the change there first (router repo owns providers).
+2. Implement wiring in decoder behind env gates; keep `Set*` seams for tests.
3. Run `make boundaries` + `make vet` + targeted `go test ./internal/tool/ -run 'TestComputer|TestMedia'`.
## Verification
diff --git a/docs/plans/rho-contracts-migration-backlog.md b/docs/plans/decoder-contracts-migration-backlog.md
similarity index 63%
rename from docs/plans/rho-contracts-migration-backlog.md
rename to docs/plans/decoder-contracts-migration-backlog.md
index 34cc8ff62..26c9295d0 100644
--- a/docs/plans/rho-contracts-migration-backlog.md
+++ b/docs/plans/decoder-contracts-migration-backlog.md
@@ -1,8 +1,8 @@
-# Plan: Rho Contracts Migration Backlog
+# Plan: Decoder Contracts Migration Backlog
> Status: locally complete
> Scope: graycode-eco ecosystem architecture cleanup after introducing `eagle`
-> Goal: keep `rho` as the product while moving stable cross-repo contracts out of Rho internals
+> Goal: keep `decoder` as the product while moving stable cross-repo contracts out of Decoder internals
External follow-up still outside the scope of this local workspace audit:
@@ -22,8 +22,8 @@ These items are already completed in the current workspace.
- added `eagle/types`
- moved severity and finding definitions into contracts
- migrated `kestrel` and `merlin` to import contracts
-- switched Rho `internal/types/severity.go` to re-export from contracts
-- removed `rho/shared/types` after local ecosystem migration
+- switched Decoder `internal/types/severity.go` to re-export from contracts
+- removed `decoder/shared/types` after local ecosystem migration
- removed the duplicate severity/finding definitions in `shrike/types` (shrike was the
original shared-types host)
- removed the `shrike/types` compatibility shim after verifying no in-workspace
@@ -31,15 +31,15 @@ These items are already completed in the current workspace.
### Tool contract migration
- added `eagle/tools`
-- switched Rho session persistence to provider-neutral tool contracts
+- switched Decoder session persistence to provider-neutral tool contracts
- added runtime/session conversion helpers
- added `eagle/tools/tool_test.go`
-- centralized message slice conversion in `rho/internal/session`
-- removed direct lower-level provider message reconstruction from Rho
+- centralized message slice conversion in `decoder/internal/session`
+- removed direct lower-level provider message reconstruction from Decoder
cmd/session restore paths
-- replaced the provider-owned message alias with a Rho-owned runtime DTO
-- added explicit Rho-owned runtime DTOs; the final boundary translates them
- through `flux/engine`
+- replaced the provider-owned message alias with a Decoder-owned runtime DTO
+- added explicit Decoder-owned runtime DTOs; the final boundary translates them
+ through `mux/engine`
### Event contract migration
- added `eagle/events`
@@ -56,14 +56,14 @@ These items are already completed in the current workspace.
### Governance
- added `check-shared-types-imports.sh`
- added `check-ecosystem-boundaries.sh`
-- added `check-flux-client-imports.sh`
+- added `check-mux-client-imports.sh`
- wired both guards into `Makefile` and CI
-- wired the Flux engine-boundary guards into `Makefile` and CI
+- wired the Mux engine-boundary guards into `Makefile` and CI
- added a legacy import guard so the removed `shared/types` path cannot return
- extended the ecosystem boundary guard to scan sibling engine repos when present locally
-- updated docs across Rho, kestrel, merlin, and external workspace copies
+- updated docs across Decoder, kestrel, merlin, and external workspace copies
- added standalone boundary guards in `kestrel` and `merlin`
-- added standalone boundary guards in `shrike`, `flux`, `harrier`, and `swift`
+- added standalone boundary guards in `shrike`, `mux`, `harrier`, and `swift`
- updated support repo READMEs with ecosystem boundary rules
### Review and verification contract migration
@@ -72,8 +72,8 @@ These items are already completed in the current workspace.
- added shared review/verification contract tests
- added kestrel -> review contract adapters
- added merlin -> verify contract adapters
-- switched Rho review persistence to neutral review contracts
-- switched Rho review/merlin bridge paths to return neutral review/verify contracts
+- switched Decoder review persistence to neutral review contracts
+- switched Decoder review/merlin bridge paths to return neutral review/verify contracts
## Remaining external follow-up
@@ -91,26 +91,26 @@ Still external:
### 2. Confirm release/publication convergence
Local state:
-- Rho local integration snapshot points at architecture-aligned support-repo revisions
+- Decoder local integration snapshot points at architecture-aligned support-repo revisions
Still external:
-- confirm released module versions used by Rho match the merged contract changes
+- confirm released module versions used by Decoder match the merged contract changes
-### 3. Remove Rho production dependency on lower Flux packages
+### 3. Remove Decoder production dependency on lower Mux packages
Current state:
- session persistence uses neutral tool contracts
-- Rho now owns the runtime message DTO in `internal/types.FluxMessage`
-- Rho now owns runtime tool call/result DTOs in `internal/types`
-- Rho now owns runtime response/usage/stream DTOs in `internal/types`
-- Rho now owns runtime chat options, response format, tool choice, continuation config, and tool definition DTOs in `internal/types`
-- Rho now owns the transport-provider seam in `internal/types.ChatProvider`
-- Rho session, review, setup, catalog, diagnostics, and custom-provider paths
- now enter through `flux/engine`
-- production imports of every lower Flux package are zero
+- Decoder now owns the runtime message DTO in `internal/types.MuxMessage`
+- Decoder now owns runtime tool call/result DTOs in `internal/types`
+- Decoder now owns runtime response/usage/stream DTOs in `internal/types`
+- Decoder now owns runtime chat options, response format, tool choice, continuation config, and tool definition DTOs in `internal/types`
+- Decoder now owns the transport-provider seam in `internal/types.ChatProvider`
+- Decoder session, review, setup, catalog, diagnostics, and custom-provider paths
+ now enter through `mux/engine`
+- production imports of every lower Mux package are zero
- cmd/session restore paths now go through centralized `session.ToRuntimeMessages` and `session.FromRuntimeMessages`
Decision:
-- completed: Rho owns the product DTO/port seam and Flux owns the engine,
+- completed: Decoder owns the product DTO/port seam and Mux owns the engine,
provider, credential, catalog, routing, resilience, and normalization layers
- keep the zero-exception boundary enforced; lower packages are test-fixture-only
@@ -133,7 +133,7 @@ Do this only if another repo truly needs them.
Current state:
- normalized review result contracts now live in `eagle/review`
- normalized verification report contracts now live in `eagle/verify`
-- Rho consumes neutral review/verification contracts at persistence and bridge boundaries
+- Decoder consumes neutral review/verification contracts at persistence and bridge boundaries
Possible later additions:
- review lifecycle status enums if another repo needs them
@@ -151,12 +151,12 @@ Possible later additions:
Do not move every internal event shape by default.
-### 6. Remove `rho/shared/types`
+### 6. Remove `decoder/shared/types`
Completed for the local ecosystem.
Current status:
-- Rho no longer ships `rho/shared/types`
+- Decoder no longer ships `decoder/shared/types`
- local import guards prevent the old path from returning
## Non-goals
@@ -164,36 +164,36 @@ Current status:
Do not do these without a separate decision:
- move provider runtime types into contracts
-- move Rho orchestration logic into contracts
+- move Decoder orchestration logic into contracts
- move sandbox manager internals into contracts
-- move every event struct in Rho into contracts
-- force Lark/Gitant architecture into Rho contracts
+- move every event struct in Decoder into contracts
+- force Lark/Gitant architecture into Decoder contracts
## Recommended PR order
### PR 1
-- completed: moved chat options/request DTOs behind Rho-owned runtime adapters
+- completed: moved chat options/request DTOs behind Decoder-owned runtime adapters
### PR 2
-- completed: moved provider/config interfaces behind Rho-owned transport adapters
+- completed: moved provider/config interfaces behind Decoder-owned transport adapters
### PR 3
-- completed: removed all lower-level Flux imports from Rho production code and
+- completed: removed all lower-level Mux imports from Decoder production code and
replaced the compatibility allowlist with a zero-exception guard
### PR 4
-- completed: added neutral review/verification result contracts and wired Rho bridge/persistence edges
+- completed: added neutral review/verification result contracts and wired Decoder bridge/persistence edges
### PR 5
-- completed: removed `rho/shared/types` from the local ecosystem and kept a legacy import guard
+- completed: removed `decoder/shared/types` from the local ecosystem and kept a legacy import guard
## Success criteria
The migration is in a good long-term state when:
- `eagle` is the only source of truth for shared contracts
-- support repos do not import `rho/internal/*`
-- support repos do not import `rho/shared/types`
+- support repos do not import `decoder/internal/*`
+- support repos do not import `decoder/shared/types`
- removed compatibility shims do not return
- CI prevents regressions
- new shared contracts are added deliberately, not by habit
diff --git a/docs/plans/rho-tau-alignment.md b/docs/plans/decoder-tau-alignment.md
similarity index 77%
rename from docs/plans/rho-tau-alignment.md
rename to docs/plans/decoder-tau-alignment.md
index 8078ba628..7041d1a95 100644
--- a/docs/plans/rho-tau-alignment.md
+++ b/docs/plans/decoder-tau-alignment.md
@@ -1,32 +1,32 @@
-# Plan: Rho — Tau-style TUI restyle + architecture tightening
+# Plan: Decoder — Tau-style TUI restyle + architecture tightening
Status: in progress
-Branch: `feat/rename-rho`
+Branch: `feat/rename-decoder`
## Context
-Rho (formerly Hawk) is a Go terminal coding agent (Bubble Tea + Lip Gloss,
+Decoder (formerly Hawk) is a Go terminal coding agent (Bubble Tea + Lip Gloss,
~17.7k LOC TUI across 107 files, 138 tools, 64 commands). Tau is a small
Python/Textual teaching agent with a strict 3-layer split
(`tau_ai → tau_agent → tau_coding`).
-"Make Rho like Tau" cannot mean a language port or a Textual clone. This plan
+"Make Decoder like Tau" cannot mean a language port or a Textual clone. This plan
does the achievable parts:
1. **Tau-style visual restyle** — adopt Tau's restrained, low-chrome look in
- Rho's existing Bubble Tea TUI.
+ Decoder's existing Bubble Tea TUI.
2. **Tau-style architecture discipline** — make `engine.StreamEvent` the hard
frontend contract; document and enforce the boundary.
3. **Verify twice** — targeted tests + lint, then a second independent pass.
## Phase 0 — Rename completion (done)
-- [x] Content rename hawk → rho (0 refs remain except intentional shims)
-- [x] File/dir renames (`cmd/rho`, `internal/rhoerr`, npm packages)
-- [x] Module path `github.com/GrayCodeAI/rho`
-- [x] Compatibility shims: `env.GetenvRho`, `storage.resolveAppDir`,
+- [x] Content rename hawk → decoder (0 refs remain except intentional shims)
+- [x] File/dir renames (`cmd/decoder`, `internal/decodererr`, npm packages)
+- [x] Module path `github.com/GrayCodeAI/decoder`
+- [x] Compatibility shims: `env.GetenvDecoder`, `storage.resolveAppDir`,
legacy `HAWK_*_DIR` overrides
-- [x] Committed + pushed to `feat/rename-rho`
+- [x] Committed + pushed to `feat/rename-decoder`
## Phase 1 — Tau-style theme (visual)
@@ -70,6 +70,6 @@ accent, generous dim text, no heavy borders.
## Out of scope (explicitly)
-- Rewriting Rho in Python / cloning Textual.
-- Deleting Rho's tool/command surface (separate decision).
+- Rewriting Decoder in Python / cloning Textual.
+- Deleting Decoder's tool/command surface (separate decision).
- Changing the daemon/ACP wire protocols.
\ No newline at end of file
diff --git a/docs/plans/dsh-harness-gap-port-plan.md b/docs/plans/dsh-harness-gap-port-plan.md
index 81c172863..cb65196fb 100644
--- a/docs/plans/dsh-harness-gap-port-plan.md
+++ b/docs/plans/dsh-harness-gap-port-plan.md
@@ -24,7 +24,7 @@ Same as the parent plan:
## Gap inventory (from the comparison audit)
-| # | DSH package(s) | Rho gap | Port status |
+| # | DSH package(s) | Decoder gap | Port status |
| --- | --- | --- | --- |
| 13 | `identity/anonymous-user-id` | no per-home anonymous telemetry identity | **Delivered** |
| 14 | `web/web-search-deepseek`, `-exa`, `-perplexity` | web search only has Brave/SearXNG/DDG | **Delivered** |
@@ -37,7 +37,7 @@ Same as the parent plan:
| 21 | `session/session-persistence-sqlite`, `session-query/*sqlite`, `storage/storage-sqlite` | JSONL-only session persistence | deferred |
| 22 | `e2b/*` | no cloud Linux sandbox | deferred |
| 23 | `code-runtime/*` | no sandboxed model-written program execution | deferred |
-| 24 | `sdk/client`, `sdk/protocol`, `sdk/server`, `python/sdk` | rho exposes ACP server instead of DSH JSON-RPC SDK | deferred (keep ACP) |
+| 24 | `sdk/client`, `sdk/protocol`, `sdk/server`, `python/sdk` | decoder exposes ACP server instead of DSH JSON-RPC SDK | deferred (keep ACP) |
| 25 | `terminal/*`, `tool-terminal` | no PTY terminal tool | deferred |
| 26 | `client/*`, `web/*`, `website`, `bundle/*-web-app` | web UI layer | out of scope (CLI/TUI) |
@@ -46,7 +46,7 @@ Same as the parent plan:
Port of DSH `identity/anonymous-user-id/src/index.ts`.
- `identity.Identity` — per-harness-home anonymous user id.
-- Resolved once per process (memoized): `$RHO_HOME`-style home (`~/.rho`),
+- Resolved once per process (memoized): `$DECODER_HOME`-style home (`~/.decoder`),
`.anonymous-user-id` file containing a bare random UUID.
- Never derived from hostname, network address, git remote, or env.
- Sync read/write; deleting the file mints a fresh identity.
@@ -98,7 +98,7 @@ Port of DSH `attachment/attachment` version-one image path.
`attachment.Limits` (maxImageBytes, maxImagesPerMessage,
maxMessageImageBytes, maxImagePixels, mediaTypes), `attachment.SaveImage`,
`attachment.Stored` (ref + data), `attachment.Store` interface +
- filesystem `Store` under the rho home data dir.
+ filesystem `Store` under the decoder home data dir.
- Validation: declared media type checked against decoded bytes; byte and
pixel limits enforced; duplicate writes rejected; ID opaque.
@@ -118,7 +118,7 @@ Port of DSH `session/session-projection-cache` semantics.
## Phase 18 — OTLP log-record export (`internal/observability/otellog`)
Port of DSH `session/session-telemetry-otel` backend semantics (the capture
-coordinator stays out of scope — rho has no Cordis bus; records reach the
+coordinator stays out of scope — decoder has no Cordis bus; records reach the
backend via `Emit`/`EmitFeedback`).
- `Record{Channel, Time, Severity, Attributes, Body}` / `Sink` seam —
@@ -139,8 +139,8 @@ backend via `Emit`/`EmitFeedback`).
- Shutdown races the DSH deadline (default 3s); exporter-shutdown goroutine
stays observed after the deadline; `Emit` is a non-blocking enqueue.
- `DefaultConfig()` mirrors oteltrace env conventions
- (`RHO_ENABLE_TELEMETRY=1` + `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`);
- wired in `cmd/rho/main.go` and `cmd/daemon.go`.
+ (`DECODER_ENABLE_TELEMETRY=1` + `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`);
+ wired in `cmd/decoder/main.go` and `cmd/daemon.go`.
- Tests: mode resolution, load-time validation, severity mapping, full/ops/
ledger emission (in-memory exporter), feedback-only direct-drop,
disabled-drop, idempotent shutdown, value conversion, attribute filtering.
@@ -148,7 +148,7 @@ backend via `Emit`/`EmitFeedback`).
## Gates
Each phase: `gofmt`/`go vet`/`go test` on the touched packages, then `make lint`
-and `rho verify` — run **twice** (the second pass re-runs the full touched
+and `decoder verify` — run **twice** (the second pass re-runs the full touched
suite after any fixes). No direct commits to `main`.
### Verification record (2026-08-17, branch `feat/dsh-harness-port-p0-eventlog`)
@@ -162,14 +162,14 @@ Pass 1:
- `make lint`: **0 issues** (fixed pre-existing errcheck `check-type-assertions`
debt + one unused helper in `internal/session/preparations.go`, and an S1000
single-case select in `internal/jobs/jobs.go`)
-- `rho verify`: exit 0
+- `decoder verify`: exit 0
- `scripts/check-internal-layer-imports.sh`: passed
Pass 2 (after lint fixes):
- `gofmt -l`: clean; `go vet`: clean; `go build ./...`: clean
- `go test -race` (identity, jobs, attachment): ok; `go test` (session, tool): ok
-- `make lint`: 0 issues; `rho verify`: exit 0
+- `make lint`: 0 issues; `decoder verify`: exit 0
New dependency: `golang.org/x/image v0.45.0` (direct) — webp decode validation
for `internal/attachment` (stdlib has no webp decoder).
@@ -178,18 +178,18 @@ for `internal/attachment` (stdlib has no webp decoder).
Pass 1:
-- `gofmt -l` (cmd/rho/main.go, cmd/daemon.go, internal/observability/otellog): clean
+- `gofmt -l` (cmd/decoder/main.go, cmd/daemon.go, internal/observability/otellog): clean
- `go vet` (otellog, cmd): clean
- `go test -race` (otellog): ok; `go build ./...`: ok
- `make lint`: **0 issues**
-- `rho verify`: exit 0
+- `decoder verify`: exit 0
- `scripts/check-internal-layer-imports.sh`: passed
Pass 2 (uncached re-run, no fixes were needed):
- `gofmt -l`: clean; `go vet`: clean; `go build ./...`: clean
- `go test -count=1 -race` (otellog): ok
-- `make lint`: 0 issues; `rho verify`: exit 0
+- `make lint`: 0 issues; `decoder verify`: exit 0
New dependencies (all direct): `go.opentelemetry.io/otel/log v0.20.0`,
`go.opentelemetry.io/otel/sdk/log v0.20.0`,
diff --git a/docs/plans/dsh-harness-port-plan.md b/docs/plans/dsh-harness-port-plan.md
index 9c4dba9b3..ef4b2ab41 100644
--- a/docs/plans/dsh-harness-port-plan.md
+++ b/docs/plans/dsh-harness-port-plan.md
@@ -1,4 +1,4 @@
-# Adopt durable-design ideas from deepseek-harness in rho
+# Adopt durable-design ideas from deepseek-harness in decoder
Status: Phase 0 scaffolded on `feat/dsh-harness-port-p0-eventlog`.
@@ -11,14 +11,14 @@ Status: Phase 0 scaffolded on `feat/dsh-harness-port-p0-eventlog`.
## Reference sources
-| dsh file | Extract | Maps to rho |
+| dsh file | Extract | Maps to decoder |
| --- | --- | --- |
| `packages/core/session/src/index.ts` | append-only `SessionEvent` log + `session/event` emit | `internal/eventlog` |
| `docs/architecture.md` "Turn flow" | `deriveMessages`; "model-visible ⟺ logged" | `Session.Persistence()` projection |
| `packages/core/tools/src/index.ts` | `tools/pre-execute` / `tools/execute` / `tools/post-execute` waterfall | `internal/tool/interceptor.go` (Phase 1) |
| `packages/interaction/user-approval/src/index.ts:30` | `approval/request` waterfall, fail-closed | `internal/engine/approval_gate.go` (Phase 1) |
| `docs/cordis-primer.md` "Waterfall Semantics" | `next()` delegate / short-circuit | interceptor contract |
-| `docs/capability-seams.md` | owner / impl / consumer roles | `docs/architecture/rho-capability-seams.md` (Phase 2) |
+| `docs/capability-seams.md` | owner / impl / consumer roles | `docs/architecture/decoder-capability-seams.md` (Phase 2) |
## Phase 0 — Event-sourced session log + "model-visible ⟺ logged"
@@ -93,7 +93,7 @@ concrete tool, carry it through `toolExecResult` in a later PR.
## Phase 2 — Seam discipline (docs + disposers)
-- `docs/architecture/rho-capability-seams.md`: owner / impl / consumer table.
+- `docs/architecture/decoder-capability-seams.md`: owner / impl / consumer table.
- Registrations return disposers (tool registry, hooks, MCP client).
- "Where new behavior goes" table.
@@ -114,16 +114,16 @@ concrete tool, carry it through `toolExecResult` in a later PR.
## Upstream parity matrix (honest status)
-These numbers compare Rho against the real deepseek-harness source, not the
+These numbers compare Decoder against the real deepseek-harness source, not the
plan's own scoped promises. The clone inspected was
`deepseek-ai/deepseek-harness` at `dsh-0.1.0-rc.7`.
-Rho is a **deliberate subset**. It ports the session-log spine, the fail-closed
+Decoder is a **deliberate subset**. It ports the session-log spine, the fail-closed
approval waterfall, and the interceptor/disposer seams; it does not port the
-product-wide plugin catalogue. Measured head-to-head, Rho has roughly **20–30%**
+product-wide plugin catalogue. Measured head-to-head, Decoder has roughly **20–30%**
of upstream by feature surface, and roughly **80–90%** of the plan's stated scope.
-| Surface | DSH | Rho today | Gap |
+| Surface | DSH | Decoder today | Gap |
| --- | --- | --- | --- |
| Known event types | 44 (dsh known-event-types.ts) | **44** (internal/eventlog/event.go) | **Closed** — all 26 new DSH event types added with typed payloads, wire decode, and Append helpers |
| Session spine code | ~3,156 non-test TS lines | ~868 non-test Go lines | Focused core, not full parity |
@@ -234,7 +234,7 @@ surface operations, ignorable markers, format version enforcement, and session
header parity. The port is functionally complete. Remaining optional depth:
- ~~DSH `surface.ts` `SurfaceManager`/`SurfaceReplacePlan` (live correction protocol — replacement operations).~~ Delivered: `internal/eventlog/surface.go` — `FoldSurface` (complete replay → surface nodes + replacement history) and an incremental `SurfaceManager` (bound to a `*Log`, with `Nodes`/`ReplaceGeneration`/`ValidateNext` atomic pre-flight), mirroring DSH's surface provenance, replacement-range, contiguity, and tool-result-rewrite invariants.
- ~~Zstd compression in persistence (DSH `session-persistence-jsonl/src/zstd.ts`).~~ Delivered: `internal/eventlog/zstdz/zstd.go` + `internal/session/session.go` (`.jsonl.zstd` saves) — see Phase 9.
-- DSH `packages/llm/llm/src/assembler.ts` (response normalization — covered by Flux facade).
+- DSH `packages/llm/llm/src/assembler.ts` (response normalization — covered by Mux facade).
This matrix is the honest anchor: the skeleton is ported; the deep fidelity is
the actual remaining work.
@@ -429,4 +429,4 @@ UI additions (Safari support, outside pointer handling) or ACP content admission
## Gates
-Each phase: `make ci` + `rho verify`; no direct commits to `main`.
+Each phase: `make ci` + `decoder verify`; no direct commits to `main`.
diff --git a/docs/plans/dsh-harness-rfc-port-plan.md b/docs/plans/dsh-harness-rfc-port-plan.md
index 89f86b81d..dc6539700 100644
--- a/docs/plans/dsh-harness-rfc-port-plan.md
+++ b/docs/plans/dsh-harness-rfc-port-plan.md
@@ -1,6 +1,6 @@
-# Wave 2 — high-value deepseek-harness RFC ports for rho
+# Wave 2 — high-value deepseek-harness RFC ports for decoder
-> **Sandbox phases are obsolete.** Rho no longer contains `internal/sandbox`,
+> **Sandbox phases are obsolete.** Decoder no longer contains `internal/sandbox`,
> Docker execution, or an OS/container sandbox backend. Do not implement Phase
> 2.3 or 2.11 as written; any future policy work must target the host-native
> permission, path, trust, and environment controls.
@@ -36,7 +36,7 @@ Reference source: `deepseek-ai/deepseek-harness` at `dsh-v0.1.0-rc.7`
## Wave 2 gap inventory
-| # | DSH source | Rho gap | Status |
+| # | DSH source | Decoder gap | Status |
| --- | --- | --- | --- |
| 2.1 | `guard/timeout-policy` | no per-tool declared timeout enforced at dispatch | **implemented** on `feat/dsh-harness-rfc-2.1-timeout-policy` |
| 2.2 | `compaction/compaction` tool-pairing helpers | compact strategies can cut across open tool call/result pairs | proposed |
@@ -64,7 +64,7 @@ Port of DSH `guard/timeout-policy` (`dsh-tool-call-timeout-policy`) + the
the tool's own declaration, not from a policy table.
- `tool.Tool` gains an optional `TimeoutProvider` interface (`Timeout()
- time.Duration`, 0 = no declaration) — the rho-native form of DSH's
+ time.Duration`, 0 = no declaration) — the decoder-native form of DSH's
`ToolDefinition.timeoutMs`, consistent with the existing optional-provider
pattern (`RiskLevelProvider`, `RetryPolicyProvider`, `SchemaProvider`).
`tool.TimeoutOf(t Tool) time.Duration` reads it.
@@ -94,7 +94,7 @@ TOOL_TIMEOUT).
## Phase 2.2 — Compaction tool-pairing boundaries (`internal/engine/compact` + `internal/eventlog`)
Port of DSH `compaction/compaction` surface contract + the
-`toolPairingBalancedBefore` / `toolPairingBalancedAfter` helpers. Rho's
+`toolPairingBalancedBefore` / `toolPairingBalancedAfter` helpers. Decoder's
`internal/engine/compact/` already does LLM summarization
(`strategy.go`, `micro.go`, `session_memory.go`) and `internal/eventlog` already
journals `tool.call` / `tool.result` / `session.compacted` (Wave 1 Phase 0). The
@@ -125,14 +125,14 @@ detection and adoption on load; deterministic replay after replace.
## Phase 2.3 — Sandbox mode vocabulary + model-facing policy (`internal/sandbox` + `internal/eventlog` + `internal/engine`)
> **Obsolete specification — retained for historical provenance only.** Do not
-> implement this phase. Rho's current product boundary is host-native
+> implement this phase. Decoder's current product boundary is host-native
> permission, path, trust, and environment policy; there is no sandbox mode or
> `internal/sandbox` package to extend.
Port of DSH `sandbox/sandbox-policy` semantics
(`SandboxMode` read-only / workspace-write / danger-full-access,
`ctx.sandboxPolicy.resolve()`, `setSandboxMode`, the `sandbox:policy` context
-contribution). Rho already has the vocabulary — `internal/sandbox/mode.go`
+contribution). Decoder already has the vocabulary — `internal/sandbox/mode.go`
`Mode` strict / workspace / off — so this phase ports the **policy resolution
and durability** around it.
@@ -153,7 +153,7 @@ and durability** around it.
durable context message on the first request and on each effective policy
change; unchanged requests add nothing. `workspace` carries only the canonical
workspace path (no host-dependent temp paths — summarize them). Rendered by
- the prompt assembler exactly like DSH's three templates, but with rho's
+ the prompt assembler exactly like DSH's three templates, but with decoder's
vocabulary:
- `strict` — read-only; do not refuse a required modification from this policy
alone; try the tool and follow denial/escalation guidance.
@@ -234,7 +234,7 @@ discovery; runtime provider registration/disposal.
Revives gap `#21` in **query-only** scope (no migration of the JSONL store; the
JSONL file stays the source of truth). Port of DSH
-`session-query/session-query-sqlite` semantics over rho's session logs.
+`session-query/session-query-sqlite` semantics over decoder's session logs.
- New `internal/sessionquery` package:
- FTS5 index (external content or contentless) over the session store,
@@ -282,9 +282,9 @@ resume of overdue work, no external channel, create/list/delete round-trip.
## Phase 2.8 — ACP client + external-agent subagent providers (`internal/acp` + `internal/multiagent`)
Port of DSH `acp/` (client side) + `subagent/subagent-acp`, `subagent-claude-code`,
-`subagent-codex`. Rho has the ACP **server** (Wave 1 `internal/acp/server.go` —
+`subagent-codex`. Decoder has the ACP **server** (Wave 1 `internal/acp/server.go` —
initialize, session/new, session/prompt, streamed updates,
-session/request_permission); this phase adds the client so rho's mission mode
+session/request_permission); this phase adds the client so decoder's mission mode
can **delegate to** other ACP agents, Claude Code, and Codex.
- `internal/acp/client.go`:
@@ -327,7 +327,7 @@ tool calls and supports interactive stdin.
- Local backend over the sandbox executor: PTY allocation with zero-CGO on
Linux (`syscall`-based pty or a maintained pure-Go pty; verify
`github.com/creack/pty`'s CGO status before adoption — zero-CGO is a hard
- rho constraint); Windows via `ConPTY` later, outside this phase.
+ decoder constraint); Windows via `ConPTY` later, outside this phase.
- Sandbox enforcement: the backend applies the resolved Phase 2.3 policy
(mode + workspace root) before exec, fail-closed.
- Bounded reads: per-read byte cap; no unbounded buffering in model-facing
@@ -377,12 +377,12 @@ pre-publication failure.
## Phase 2.11 — Native Windows ACL sandbox (`internal/sandbox`)
> **Obsolete specification — retained for historical provenance only.** Do not
-> implement this phase. Rho no longer provides a local OS/container sandbox or
+> implement this phase. Decoder no longer provides a local OS/container sandbox or
> Docker fallback on any platform.
The original proposal ported DSH `sandbox/sandbox-windows-acl` and assumed a
cross-platform confinement backend. That assumption is no longer part of
-Rho's local product architecture.
+Decoder's local product architecture.
- `internal/sandbox/windows_acl.go` (`//go:build windows`):
- Implements the same `Sandbox` interface as `landlock.go`
@@ -409,7 +409,7 @@ Port of DSH `lsp/lsp-stdio` operational semantics. `internal/lsp/` currently has
`client.go`/`manager.go`/`config.go`; this phase audits and aligns the client
lifecycle with DSH's:
- **Transient-open sequence**: per query — resolve and byte-bound the source
- through rho's fs, `textDocument/didOpen` (version 1, full text), the
+ through decoder's fs, `textDocument/didOpen` (version 1, full text), the
requested request, then `textDocument/didClose` in `finally`. No document
cache, no LRU, no `didChange`; a failed/canceled `didOpen` write terminates
the server instance before the pool can reuse it.
@@ -439,7 +439,7 @@ scrubbing (KEY/PASSWORD/SECRET/TOKEN absent from child env); processId null.
## Gates (each phase)
`gofmt`/`go vet`/`go test -race` on the touched packages, then `make lint` and
-`rho verify`, run **twice** (second pass re-runs the full touched suite after
+`decoder verify`, run **twice** (second pass re-runs the full touched suite after
any fixes). `scripts/check-internal-layer-imports.sh` must stay green. No direct
commits to `main` — each phase is its own feature branch
(`feat/dsh-harness-rfc-`), opened from `main`, with a PR and green CI.
diff --git a/docs/plans/engine-refactor-plan.md b/docs/plans/engine-refactor-plan.md
index ea4631074..f96550f5b 100644
--- a/docs/plans/engine-refactor-plan.md
+++ b/docs/plans/engine-refactor-plan.md
@@ -1,20 +1,20 @@
-# rho/engine sub-package split — analysis and migration plan
+# decoder/engine sub-package split — analysis and migration plan
> Status: **analysis only**. No code is moved by this document. The actual
-> split is multi-PR work that should land incrementally to keep rho's
+> split is multi-PR work that should land incrementally to keep decoder's
> build green at every step.
## The problem
```
-rho/engine/
+decoder/engine/
├── *.go 161 source files, 66,682 lines
└── *_test.go 141 test files, 65,907 lines
───── total: ~133K lines, 302 files, ONE package
```
For comparison: the entire `kubernetes/kubectl` (a non-trivial CLI) is
-~110K lines split across **dozens** of internal packages. rho's engine
+~110K lines split across **dozens** of internal packages. decoder's engine
is bigger than that and lives in a single `package engine`.
Concrete pain that creates today:
@@ -40,7 +40,7 @@ splitting into ~15 sub-packages. The line counts are file-name-based
estimates; the real numbers will shift during the split.
```
-rho/engine/
+decoder/engine/
├── engine.go # top-level Engine type, public API only
├── lifecycle.go # session start/stop, hooks, graceful shutdown
├── stream.go # the main response stream loop (large; consider further split)
@@ -193,18 +193,18 @@ code from earlier experiments).
## Migration strategy
-The split is high-risk because it touches every other package in rho
-that imports `engine.Foo`. To keep rho green at every commit:
+The split is high-risk because it touches every other package in decoder
+that imports `engine.Foo`. To keep decoder green at every commit:
1. **Stage 1 — alias-only.** For each proposed sub-package, create
`engine//.go` containing only re-exports:
```go
package compact
- import "github.com/GrayCodeAI/rho/engine"
+ import "github.com/GrayCodeAI/decoder/engine"
type Strategy = engine.CompactStrategy
var Default = engine.DefaultCompactStrategy
```
- Rho's external callers can start migrating to the new import paths.
+ Decoder's external callers can start migrating to the new import paths.
Old code keeps working unchanged. **Land this first.**
2. **Stage 2 — move bodies.** For one sub-package at a time:
@@ -223,7 +223,7 @@ that imports `engine.Foo`. To keep rho green at every commit:
coordinator package only.
This approach scales: each PR is small, reviewable, and individually
-revertible. No "big bang" merge that paralyses rho for a week.
+revertible. No "big bang" merge that paralyses decoder for a week.
## Estimated effort
@@ -266,7 +266,7 @@ The `compact/` sub-package is the cleanest extraction candidate:
| `git/` | `engine/git/aliases.go` | 9 types, 4 funcs |
| `prompt/` | `engine/prompt/aliases.go` | 6 types, 3 funcs |
-New code should import `github.com/GrayCodeAI/rho/engine/`
+New code should import `github.com/GrayCodeAI/decoder/engine/`
instead of reaching into `engine` for these names. The remaining 17
clusters follow the same pattern:
@@ -274,7 +274,7 @@ clusters follow the same pattern:
// engine//aliases.go
package
-import "github.com/GrayCodeAI/rho/engine"
+import "github.com/GrayCodeAI/decoder/engine"
// Re-export the cluster's public symbols from engine as type and var
// aliases. Implementation stays in engine until Stage 2 of this plan.
diff --git a/docs/plans/fix-critical-and-high-review.md b/docs/plans/fix-critical-and-high-review.md
index 56e83bba4..349c9456e 100644
--- a/docs/plans/fix-critical-and-high-review.md
+++ b/docs/plans/fix-critical-and-high-review.md
@@ -1,7 +1,7 @@
-# Plan: Fix Critical + High-Impact Review Findings — rho
+# Plan: Fix Critical + High-Impact Review Findings — decoder
> Branch: `fix/critical-and-high-review-2026-06`
-> PR:
+> PR:
> Status: **✅ COMPLETE — all 9 items + extensive follow-up committed.**
> Constraint: **no new go.mod / go.sum dependencies** for any item in this plan.
>
@@ -81,12 +81,12 @@ These were documented in the original plan as out-of-scope-for-this-PR. They rem
## Context
-A deep code review of `flux` and `rho` (companion plan at
-`../flux/docs/plans/fix-critical-and-high-review.md`) surfaced 7 critical
-and 9 high items. This plan covers **all rho items** (C3, C4, C5, H5,
+A deep code review of `mux` and `decoder` (companion plan at
+`../mux/docs/plans/fix-critical-and-high-review.md`) surfaced 7 critical
+and 9 high items. This plan covers **all decoder items** (C3, C4, C5, H5,
H6, H7, H8, H9) broken into a sequence of small, reviewable PRs.
-## Scope (rho)
+## Scope (decoder)
| ID | Severity | Title | File(s) | Effort |
|----|----------|-------|---------|--------|
@@ -101,9 +101,9 @@ H6, H7, H8, H9) broken into a sequence of small, reviewable PRs.
## Out of scope (deferred to next plan)
-- H10 from flux: `//nolint:errcheck` on type-assertion that can panic.
+- H10 from mux: `//nolint:errcheck` on type-assertion that can panic.
- M1–M20 medium items.
-- L-tier quick wins (e.g. `cosmenticFlags` typo, `cmd/.rho/` leaked state).
+- L-tier quick wins (e.g. `cosmenticFlags` typo, `cmd/.decoder/` leaked state).
- `internal/intelligence/repomap/` documentation (large, separate effort).
- Anything that requires a new dependency.
@@ -131,7 +131,7 @@ PRs can be merged individually; the branch is a namespace.
## PR 1 — Surface silent migration error (C4)
**What**: `cmd/root.go:114` calls `MigrateProviderSecrets()` and discards
-the error. If migration fails, secrets may remain in `~/.rho/.env` while
+the error. If migration fails, secrets may remain in `~/.decoder/.env` while
the agent is told to ignore that file.
**Fix**:
@@ -240,7 +240,7 @@ core. Mitigation: keep both code paths behind a feature flag for one
release; metric for "wait latency" before/after.
**Rollback**: feature flag. If regressions appear, set
-`RHO_MULTIAGENT_POLLING=1` to revert.
+`DECODER_MULTIAGENT_POLLING=1` to revert.
---
@@ -367,7 +367,7 @@ legitimate-input fix, not a security regression.
> This section records the original review finding only. Do not recreate the
> removed sandbox package or Docker fallback from this plan.
-**Bug**: `internal/sandbox/seatbelt.go:70-108` `DefaultRhoPolicy` defaults
+**Bug**: `internal/sandbox/seatbelt.go:70-108` `DefaultDecoderPolicy` defaults
to `AllowWrite: true` and `AllowProcess: true`. A sandboxed bash can write
and spawn processes out of the box.
@@ -471,7 +471,7 @@ behavioral changes, only structural.
```bash
go mod verify
-go build ./cmd/rho
+go build ./cmd/decoder
go test -race -count=1 -shuffle=on ./...
go vet ./...
golangci-lint run
@@ -499,10 +499,10 @@ Coverage target: maintained at 60%+ (CI gate).
## Cross-repo coordination
-- **flux PR 4 (C2 — Vertex fix)** and **rho PR 4 (H6 — Session
+- **mux PR 4 (C2 — Vertex fix)** and **decoder PR 4 (H6 — Session
decomposition)** are independent.
-- **flux PR 8 (H4 — FluxError)** is a prerequisite for any future
- rho-side `errors.As(err, &fluxErr)` use (currently none). No
+- **mux PR 8 (H4 — MuxError)** is a prerequisite for any future
+ decoder-side `errors.As(err, &muxErr)` use (currently none). No
ordering dependency.
- The two repos' branches are independent and can be merged in any
order.
diff --git a/docs/plans/fx-adoption-plan.md b/docs/plans/fx-adoption-plan.md
index d46b88893..5c8b46539 100644
--- a/docs/plans/fx-adoption-plan.md
+++ b/docs/plans/fx-adoption-plan.md
@@ -1,18 +1,18 @@
# Vercel fx Adoption Plan
-Status: Implemented in Rho's native Go architecture
+Status: Implemented in Decoder's native Go architecture
Source: `https://github.com/vercel-labs/fx`
This plan records the useful ideas identified while comparing Vercel Labs'
-`fx` Unix-like coding agent with Rho and its independent ecosystem repositories. It is an
-adoption plan, not a code-porting plan. Rho should reimplement compatible
+`fx` Unix-like coding agent with Decoder and its independent ecosystem repositories. It is an
+adoption plan, not a code-porting plan. Decoder should reimplement compatible
behavior in Go and preserve its existing provider, memory, review, audit,
session, and security boundaries.
## Executive Decision
-Rho should adopt the following `fx` ideas:
+Decoder should adopt the following `fx` ideas:
1. Stable identities and operational commands for persisted permission rules.
2. A unified machine-readable runtime status snapshot.
@@ -21,21 +21,21 @@ Rho should adopt the following `fx` ideas:
user authority.
5. Compatibility aliases for common permission modes in CLI and ACP surfaces.
6. Stronger subagent lifecycle and permission observability.
-7. A narrow embeddable host API over Rho's existing daemon and ACP surfaces.
+7. A narrow embeddable host API over Decoder's existing daemon and ACP surfaces.
-Rho should not copy `fx` source code, replace its Go runtime with Zig, create a
+Decoder should not copy `fx` source code, replace its Go runtime with Zig, create a
second permission system, or reduce its code-intelligence tool surface merely to
match `fx`'s smaller binary.
-## Existing Rho Capabilities
+## Existing Decoder Capabilities
-The comparison found that Rho already provides the foundation for most `fx`
+The comparison found that Decoder already provides the foundation for most `fx`
features:
-| `fx` capability | Rho implementation | Current decision |
+| `fx` capability | Decoder implementation | Current decision |
|---|---|---|
-| Native single binary | Go static binary and cross-platform release builds | Keep Rho implementation |
-| Agent loop | `internal/engine` | Keep Rho implementation |
+| Native single binary | Go static binary and cross-platform release builds | Keep Decoder implementation |
+| Agent loop | `internal/engine` | Keep Decoder implementation |
| Permission and host-policy split | `internal/engine/safety`, `internal/permissions`, `internal/trust` | Harden and document |
| `ask`/automatic approval behavior | Autonomy profiles, governance, grants, hooks | Add compatibility aliases only |
| Child agents | `internal/multiagent`, continuable children, cold resume | Add observability and configuration polish |
@@ -45,7 +45,7 @@ features:
| ACP | `internal/acp` | Extend status/config parity where useful |
| Swift and replay | sibling `swift` (Swift), `internal/session/replay` | Add terminal-level tape capability |
| Persistent memory | sibling `harrier` (Harrier) | Do not replace with flat JSON state |
-| Provider runtime | sibling `flux` | Do not add provider logic to Rho |
+| Provider runtime | sibling `mux` | Do not add provider logic to Decoder |
## Priority Model
@@ -63,11 +63,11 @@ when their original command, path, or workspace has changed.
### Scope and ownership
-- Primary implementation: Rho `internal/permissions` and
+- Primary implementation: Decoder `internal/permissions` and
`internal/engine/safety`.
- Shared contract changes, if needed: sibling `eagle/policy`.
- User-facing commands: `cmd` and the existing slash-command surface.
-- No changes to sibling `flux` or `falcon`.
+- No changes to sibling `mux` or `falcon`.
### Required behavior
@@ -88,12 +88,12 @@ when their original command, path, or workspace has changed.
### Proposed interfaces
```text
-rho permissions list [--json]
-rho permissions revoke
-rho permissions reset [--scope user|project]
+decoder permissions list [--json]
+decoder permissions revoke
+decoder permissions reset [--scope user|project]
```
-The exact command names may follow existing Rho conventions, but the typed
+The exact command names may follow existing Decoder conventions, but the typed
operation should be shared by CLI, TUI, daemon, and ACP.
### Acceptance criteria
@@ -155,7 +155,7 @@ the daemon, ACP clients, and the interactive UI.
### Ownership
-- Snapshot contract: Rho root or `eagle` if consumed cross-repo.
+- Snapshot contract: Decoder root or `eagle` if consumed cross-repo.
- Assembly: `internal/engine`, `internal/session`, `internal/mcp`,
`internal/permissions`, `internal/multiagent`.
- Rendering: CLI/TUI and daemon adapters.
@@ -164,7 +164,7 @@ the daemon, ACP clients, and the interactive UI.
```text
schema_version
-rho_version
+decoder_version
session_id
workspace
git_branch
@@ -193,8 +193,8 @@ identifiers rather than raw secrets.
### Required interfaces
```text
-rho status
-rho status --json
+decoder status
+decoder status --json
```
The daemon and ACP should expose the same snapshot schema, with transport
@@ -212,14 +212,14 @@ metadata kept outside the product snapshot.
### Goal
-Add `fx`-style terminal byte and resize recording to complement Rho's existing
+Add `fx`-style terminal byte and resize recording to complement Decoder's existing
agent-session swift and replay features.
### Ownership
- Preferred home: sibling `swift` (Swift) if the capability is intended for reuse by
other agents.
-- Rho integration: `internal/swift` or the TUI composition layer.
+- Decoder integration: `internal/swift` or the TUI composition layer.
- Do not put terminal tape parsing in the agent engine.
### Required behavior
@@ -237,10 +237,10 @@ agent-session swift and replay features.
### Proposed interfaces
```text
-rho swift record --output
-rho swift replay
-rho swift replay --frames
-rho swift replay --json
+decoder swift record --output
+decoder swift replay
+decoder swift replay --frames
+decoder swift replay --json
```
Existing Swift session capture remains the source of prompts, tool calls, git
@@ -260,35 +260,35 @@ ID.
### Goal
-Expose familiar `fx` permission names without weakening Rho's richer policy
+Expose familiar `fx` permission names without weakening Decoder's richer policy
engine.
### Mapping
-| Compatibility name | Rho behavior |
+| Compatibility name | Decoder behavior |
|---|---|
| `ask` | Supervised or equivalent prompt-required policy |
| `auto` | Automatic review/approval behavior where configured |
| `yolo` | Explicit high-autonomy mode, still subject to governance, sandbox, and destructive-command hard blocks |
-These are aliases or presentation-layer modes, not a replacement for Rho's
+These are aliases or presentation-layer modes, not a replacement for Decoder's
autonomy tiers, governance ceiling, spec gates, and sandbox policy.
### Required behavior
1. Accept names in configuration, CLI, and ACP only where the surface supports
them.
-2. Display the effective Rho tier and hard safety constraints.
+2. Display the effective Decoder tier and hard safety constraints.
3. Never let `yolo` bypass governance, hard-deny rules, destructive-command
blocks, or mandatory spec approval.
-4. Persist the canonical Rho representation, not an ambiguous alias.
+4. Persist the canonical Decoder representation, not an ambiguous alias.
5. Add migration and invalid-value diagnostics.
## P1: Subagent Lifecycle and Authority Observability
### Goal
-Adopt `fx`'s useful child-agent visibility while retaining Rho's continuable
+Adopt `fx`'s useful child-agent visibility while retaining Decoder's continuable
child sessions, worktree isolation, model routing, and delegated policy
inheritance.
@@ -319,7 +319,7 @@ inheritance.
### Goal
Improve discoverability and trust reporting using `fx`'s clear status model,
-without changing Rho's existing MCP and skills architecture.
+without changing Decoder's existing MCP and skills architecture.
### Required behavior
@@ -344,7 +344,7 @@ without changing Rho's existing MCP and skills architecture.
### Goal
Offer a supported embedding boundary inspired by `fx`'s ACP and WASM surfaces,
-without committing Rho to a WASM rewrite.
+without committing Decoder to a WASM rewrite.
### First implementation
@@ -417,12 +417,12 @@ make test-race
make vet
make lint
make security
-rho verify
+decoder verify
```
For sibling-repository changes, run that repository's own tests and boundary checks before
-updating the Rho pointer. Do not modify provider protocols or adapters in Rho;
-those belong in the Flux repository.
+updating the Decoder pointer. Do not modify provider protocols or adapters in Decoder;
+those belong in the Mux repository.
## Delivery Sequence
@@ -456,7 +456,7 @@ those belong in the Flux repository.
- Design and review the versioned swift artifact format in sibling `swift` (Swift).
- Implement recording, replay, redaction, and deterministic golden tests.
-- Integrate recording controls into Rho without coupling tape parsing to the
+- Integrate recording controls into Decoder without coupling tape parsing to the
agent loop.
### Milestone 5: Host integration and trust UX
@@ -469,18 +469,18 @@ those belong in the Flux repository.
## Deliberately Rejected
- Copying Zig implementation code from `vercel-labs/fx`.
-- Replacing Rho's Go runtime or independent ecosystem repositories.
+- Replacing Decoder's Go runtime or independent ecosystem repositories.
- Adding a second permission evaluator.
- Replacing Harrier with flat JSON memory.
- Replacing Swift session capture with terminal tapes.
-- Removing Rho's code intelligence, review, audit, token, or provider features
+- Removing Decoder's code intelligence, review, audit, token, or provider features
to target `fx`'s binary size.
- Automatically executing repository-local MCP servers or hooks.
- Adding WASM before daemon and ACP contracts are stable and proven.
## Success Criteria
-The adoption is successful when Rho can provide the operational clarity of
+The adoption is successful when Decoder can provide the operational clarity of
`fx` while retaining its stronger ecosystem architecture:
- Every persistent permission rule can be listed and revoked by stable ID.
@@ -488,7 +488,7 @@ The adoption is successful when Rho can provide the operational clarity of
- TUI failures can be reproduced from a credential-free terminal tape.
- Project configuration cannot silently grant private authority.
- Child-agent authority, lifecycle, model, and budget state are inspectable.
-- Existing Rho memory, provider, review, audit, MCP, ACP, and session behavior
+- Existing Decoder memory, provider, review, audit, MCP, ACP, and session behavior
remains intact.
## Implemented Scope
@@ -504,7 +504,7 @@ The adoption is successful when Rho can provide the operational clarity of
continuable children, and cold resume retained as the authoritative runtime.
The remaining items in this document are future refinements to the already
-implemented surfaces, not missing baseline features. Rho's subprocess LSP
+implemented surfaces, not missing baseline features. Decoder's subprocess LSP
manager remains a separate integration task: the current main `LSP` tool uses
the codegraph path, while `internal/lsp` provides the richer language-server
client and is not yet attached to the primary tool registry.
diff --git a/docs/plans/goose-adoption-plan.md b/docs/plans/goose-adoption-plan.md
index 2d6dd7c90..85a4cf61f 100644
--- a/docs/plans/goose-adoption-plan.md
+++ b/docs/plans/goose-adoption-plan.md
@@ -7,23 +7,23 @@ Linux Foundation / Agentic AI Foundation)
## Executive Decision
-Goose's audit against rho found that most of its runtime concepts already have
-a native rho implementation (providers via flux, sessions, MCP, ACP, skills,
-host-native policy, permissions). The genuinely novel, rho-relevant ideas are
+Goose's audit against decoder found that most of its runtime concepts already have
+a native decoder implementation (providers via mux, sessions, MCP, ACP, skills,
+host-native policy, permissions). The genuinely novel, decoder-relevant ideas are
adopted here in Go, without copying Rust code or adding a second execution
sandbox runtime.
-## Existing Rho Capabilities
+## Existing Decoder Capabilities
-| Goose package/concept | Rho implementation | Decision |
+| Goose package/concept | Decoder implementation | Decision |
|---|---|---|
-| Provider abstraction (~36) | sibling `flux` (28 built-in + 75+ live) | Keep rho |
-| Sessions (SQLite WAL) | `internal/session` JSONL+WAL+zstd + sibling `swift` (Swift) | Keep rho |
-| MCP (client+server) | `internal/mcp` + sibling `falcon` | Keep rho |
-| ACP | `internal/acp` | Keep rho |
-| Extensions/skills | `internal/plugin`, skills registry | Keep rho |
+| Provider abstraction (~36) | sibling `mux` (28 built-in + 75+ live) | Keep decoder |
+| Sessions (SQLite WAL) | `internal/session` JSONL+WAL+zstd + sibling `swift` (Swift) | Keep decoder |
+| MCP (client+server) | `internal/mcp` + sibling `falcon` | Keep decoder |
+| ACP | `internal/acp` | Keep decoder |
+| Extensions/skills | `internal/plugin`, skills registry | Keep decoder |
| Execution safety | `internal/engine/safety`, path guards, trust policy | Host-native, fail-closed |
-| OSV malware gate | `internal/permissions/osv_checker.go` (`CheckCommand`/`CheckPackage`) | Keep rho |
+| OSV malware gate | `internal/permissions/osv_checker.go` (`CheckCommand`/`CheckPackage`) | Keep decoder |
| Hints / AGENTS.md | `internal/config` AGENTS.md loader | **Adopt** @file references + subdir hints |
| Context compaction | sibling `shrike` (Shrike) + `internal/engine/compaction` | **Adopt** structured-summary retry ladder |
| Extension env safety | none (only OSV gate) | **Adopt** disallowed-env-var filter |
@@ -31,7 +31,7 @@ sandbox runtime.
## Priority Model
-- **P0:** Security-relevant, bounded, rho-native adoptions.
+- **P0:** Security-relevant, bounded, decoder-native adoptions.
- **P1:** High-value product improvements.
- **Defer:** Larger or cross-cutting changes needing an RFC.
@@ -50,7 +50,7 @@ or MCP stdio processes by filtering dangerous environment overrides
checker) — a `sanitizeEnv` / `SafeEnv` helper.
- Consumers: `internal/mcp` stdio launch path and `internal/plugin` package
execution.
-- No changes to sibling `flux`.
+- No changes to sibling `mux`.
### Required behavior
@@ -114,7 +114,7 @@ strict size/depth budgets — matching goose `hints/import_files.rs`.
### Goal
-Upgrade rho's context compaction to a structured summary with a progressive
+Upgrade decoder's context compaction to a structured summary with a progressive
tool-response-dropping retry ladder on overflow, and token-estimator-backed
accounting, matching `goose-context-management`.
@@ -142,18 +142,18 @@ accounting, matching `goose-context-management`.
## Deliberately Deferred
-- Goose's SQLite session store (`usage_ledger`, token/cost schema): rho's
+- Goose's SQLite session store (`usage_ledger`, token/cost schema): decoder's
JSONL/WAL + swift + cost tracker cover it; a schema migration is a larger
change and is tracked separately.
- MCP Apps / agent-provided HTML UIs: novel but requires UI-layer design.
- ACP-as-provider wrapping other CLIs: larger provider abstraction change.
-- Local-inference tool emulation / toolshim: depends on flux's local-model
+- Local-inference tool emulation / toolshim: depends on mux's local-model
path.
-- Recipe security scanner / cron recipes: rho already has schedule/cron.
+- Recipe security scanner / cron recipes: decoder already has schedule/cron.
## Verification
- `go test ./...` full suite.
-- `make vet`, `make lint`, `rho verify`.
+- `make vet`, `make lint`, `decoder verify`.
- Focused tests for the env filter, AGENTS.md references, and compaction retry.
- markdownlint on this document.
diff --git a/docs/plans/minimax-adoption-plan.md b/docs/plans/minimax-adoption-plan.md
index 0dc41b40a..d110114e1 100644
--- a/docs/plans/minimax-adoption-plan.md
+++ b/docs/plans/minimax-adoption-plan.md
@@ -1,40 +1,40 @@
-# MiniMax-AI → rho Adoption Plan
+# MiniMax-AI → decoder Adoption Plan
Status: Implemented in working tree; sibling-repository PRs and skills curation remain follow-ups
Date: 2026-08-21
Scope: Adopt the high-value, verified concepts from MiniMax-AI's open-source
-repos into the Rho ecosystem (Rho plus independent repositories: Flux, Eagle,
+repos into the Decoder ecosystem (Decoder plus independent repositories: Mux, Eagle,
Falcon, Kestrel, and Merlin).
## Findings summary
-Deep code review of 6 MiniMax-AI repos against Rho's existing sibling
+Deep code review of 6 MiniMax-AI repos against Decoder's existing sibling
repositories and
internals produced these adoptions, ordered by value:
| # | MiniMax repo | Adopt into | Action |
|---|---|---|---|
-| 1 | MiniMax-Provider-Verifier | sibling `flux` | Add provider-conformance metrics + wire the orphaned `verify` harness into CI |
+| 1 | MiniMax-Provider-Verifier | sibling `mux` | Add provider-conformance metrics + wire the orphaned `verify` harness into CI |
| 2 | MiniMax/skills | `starling` | Curate high-quality skill content (content, not mechanism) |
-| 3 | MiniMax-Coding-Plan-MCP | rho / `falcon` | MCP v2 no-network test pattern + image-source normalization (patterns only) |
-| 4 | minimax_search | rho tooling | Jina page→Markdown browse extractor + evidence-extraction prompt (pattern) |
-| 5 | Mini-Agent | rho engine | Cooperative-cancellation-with-cleanup + token-aware lossy summarization (patterns) |
+| 3 | MiniMax-Coding-Plan-MCP | decoder / `falcon` | MCP v2 no-network test pattern + image-source normalization (patterns only) |
+| 4 | minimax_search | decoder tooling | Jina page→Markdown browse extractor + evidence-extraction prompt (pattern) |
+| 5 | Mini-Agent | decoder engine | Cooperative-cancellation-with-cleanup + token-aware lossy summarization (patterns) |
| 6 | MiniMax-MCP / JS | — | Not adoptable (media generation, out of scope) |
-## 1. Flux provider-conformance metrics + CI wiring (highest value)
+## 1. Mux provider-conformance metrics + CI wiring (highest value)
-### Verified current state (flux repository)
+### Verified current state (mux repository)
-- `flux/verify/verify.go` — a complete behavioral conformance harness
+- `mux/verify/verify.go` — a complete behavioral conformance harness
exists: `Case`/`CaseResult`/`Expectation`/`Report`, `Run()`, `scoreResponse()`,
`ToolCallF1()`, `DiffBaseline()`, `Markdown()`.
-- `flux/verify/cases.go` — `CanonicalCases()` with 3 cases:
+- `mux/verify/cases.go` — `CanonicalCases()` with 3 cases:
`basic-chat`, `deterministic-answer`, `tool-call`.
-- `flux/verify/metrics.go` — `ToolCallF1()` already implemented.
+- `mux/verify/metrics.go` — `ToolCallF1()` already implemented.
- **Confirmed gap:** the `verify` package is referenced ONLY by its own tests.
It is not wired into any CLI, Makefile target, CI job, or provider-registration
gate. Only structural registry/parity tests are enforced.
-- flux already ships MiniMax providers (`minimax_token_plan`, `minimax_payg`)
+- mux already ships MiniMax providers (`minimax_token_plan`, `minimax_payg`)
as OpenAI-compatible adapters with `ThinkingFormat: "minimax"`.
- `client/structured.go` already has `ValidateStructuredOutput()` — a recursive
JSON-schema validator (`validateValue`, `validateObject`, `validateArray`)
@@ -43,7 +43,7 @@ internals produced these adoptions, ordered by value:
### What to implement
**A. Add a `SchemaValidate` helper (argument-level) — new file
-`flux/verify/schema.go`**
+`mux/verify/schema.go`**
Add `SchemaValidate(args map[string]any, schema map[string]any) error` that
checks tool-call arguments against the tool's `Parameters` JSON schema:
@@ -52,7 +52,7 @@ checks tool-call arguments against the tool's `Parameters` JSON schema:
This is the `ToolCalls-Schema-Accuracy` dimension from MiniMax-Provider-Verifier.
-**B. Add `MatchRate` to `Report` — edit `flux/verify/verify.go`**
+**B. Add `MatchRate` to `Report` — edit `mux/verify/verify.go`**
Compute the `ToolCalls-Match-Rate` (trigger-vs-stop correctness) alongside F1.
Extend `CaseResult` already has `ExpectedTool`/`CalledAnyTool`/`CorrectTool`, so
@@ -63,9 +63,9 @@ tool_calls_match_rate = (TP + TN) / expected_tool_call_total_count
mirroring MiniMax's confusion-matrix metric.
**C. Add a `verify` CLI entrypoint — new file
-`flux/cmd/verify/main.go`**
+`mux/cmd/verify/main.go`**
-A small `go run`-able binary (or a `verify` subcommand if flux has a cmd/) that
+A small `go run`-able binary (or a `verify` subcommand if mux has a cmd/) that
runs `verify.Run` against a provider endpoint (live or cassette) and exits
non-zero on unmet thresholds:
- `--model`, `--base-url`, `--api-key`, `--provider`
@@ -74,8 +74,8 @@ non-zero on unmet thresholds:
This makes the orphaned harness operational and enables CI gating.
-**D. Add a Makefile target + CI job — edit `flux/Makefile` and
-`flux/.github/workflows/ci.yml`**
+**D. Add a Makefile target + CI job — edit `mux/Makefile` and
+`mux/.github/workflows/ci.yml`**
- Makefile: `verify` target that runs the harness in cassette mode (no tokens)
and `verify-live` for manual live runs.
@@ -83,27 +83,27 @@ This makes the orphaned harness operational and enables CI gating.
on PRs, ensuring the harness is exercised and providers don't regress.
### Files
-- `flux/verify/schema.go` (new)
-- `flux/verify/schema_test.go` (new)
-- `flux/verify/verify.go` (add MatchRate)
-- `flux/verify/verify_test.go` (add tests)
-- `flux/cmd/verify/main.go` (new)
-- `flux/Makefile` (verify target)
-- `flux/.github/workflows/ci.yml` (verify job)
+- `mux/verify/schema.go` (new)
+- `mux/verify/schema_test.go` (new)
+- `mux/verify/verify.go` (add MatchRate)
+- `mux/verify/verify_test.go` (add tests)
+- `mux/cmd/verify/main.go` (new)
+- `mux/Makefile` (verify target)
+- `mux/.github/workflows/ci.yml` (verify job)
## 2. Curate MiniMax/skills content into starling
-### Verified current state (rho)
-- rho's skills system (`internal/plugin`) reads markdown+YAML-frontmatter skills
- from dirs (`~/.rho/skills`, `.claude/skills`, `.zero/skills`, `skills`) with a
- registry (`starling` repo, `rho skills search/install/list/remove`).
+### Verified current state (decoder)
+- decoder's skills system (`internal/plugin`) reads markdown+YAML-frontmatter skills
+ from dirs (`~/.decoder/skills`, `.claude/skills`, `.zero/skills`, `skills`) with a
+ registry (`starling` repo, `decoder skills search/install/list/remove`).
- MiniMax/skills (13.4k★) has 18 high-quality skills in the same format
(frontmatter `name`/`description`/`license`/`metadata`), especially
`frontend-dev`, `fullstack-dev`, `shader-dev`, mobile guides, `vision-analysis`.
### What to implement
- Port the best MiniMax skills into `GrayCodeAI/starling` (separate
- repo), adapting frontmatter to rho's convention (`globs`, `alwaysApply`).
+ repo), adapting frontmatter to decoder's convention (`globs`, `alwaysApply`).
- This is a content curation task in a separate repo; tracked here for
completeness but implemented as a follow-up PR in `starling`.
@@ -113,10 +113,10 @@ This makes the orphaned harness operational and enables CI gating.
## 3. MCP v2 no-network test pattern + image-source normalization
-### Verified current state (rho)
+### Verified current state (decoder)
- `internal/mcp` implements its own JSON-RPC client + server and does NOT use the
shared `falcon` scaffolding (architectural divergence).
-- rho has `internal/attachment/image.go` for image decode, and `ScreenshotTool`
+- decoder has `internal/attachment/image.go` for image decode, and `ScreenshotTool`
/ `BrowserTool`. No image-source (URL/file/data-URL) normalization helper.
- MiniMax-Coding-Plan-MCP shows: MCP v2 tool registration + no-network test
harness (in-process `Client` + stdio `ClientSession` asserting exact payloads)
@@ -135,8 +135,8 @@ This makes the orphaned harness operational and enables CI gating.
## 4. Jina page→Markdown browse extractor
-### Verified current state (rho)
-- rho has `WebSearchTool` (6-provider cascade: Brave/SearXNG/DeepSeek/Exa/
+### Verified current state (decoder)
+- decoder has `WebSearchTool` (6-provider cascade: Brave/SearXNG/DeepSeek/Exa/
Perplexity/DDG), `AgenticFetchTool`, `WebFetchTool`, `DownloadTool`,
`engine/search/url_scraper.go`.
- No lightweight "URL → Markdown" extractor (Jina Reader pattern).
@@ -155,14 +155,14 @@ This makes the orphaned harness operational and enables CI gating.
## 5. Agent-loop robustness patterns (reference)
-### Verified current state (rho)
-- rho's `Session.agentLoop` (`internal/engine/stream.go:133`) is a complete
+### Verified current state (decoder)
+- decoder's `Session.agentLoop` (`internal/engine/stream.go:133`) is a complete
think→act→observe loop with memory, 70+ tools, sub-agents, multi-agent.
- No cooperative-cancellation-with-history-cleanup, and long-session compaction
uses truncation rather than "summarize between user turns".
### What to implement (small, low-risk)
-- Add `_cleanup_incomplete_messages` equivalent to rho's loop: on cancellation
+- Add `_cleanup_incomplete_messages` equivalent to decoder's loop: on cancellation
at a safe checkpoint, trim the partial assistant message + orphaned tool
results so message history stays valid.
- Add a token-limit-driven lossy summarization option (keep user intents,
@@ -175,27 +175,27 @@ This makes the orphaned harness operational and enables CI gating.
## Out of scope (not adopted)
- MiniMax-MCP / MiniMax-MCP-JS: media generation (TTS/image/video) — no
- relevance to code intelligence; rho has no TTS and that is a product decision.
-- minimax_search's search layer: redundant (rho has more providers).
-- Mini-Agent's core loop: outclassed by rho.
+ relevance to code intelligence; decoder has no TTS and that is a product decision.
+- minimax_search's search layer: redundant (decoder has more providers).
+- Mini-Agent's core loop: outclassed by decoder.
- The `verify` harness's live-token path: optional, off by default.
## Execution order
-1. Flux verify metrics + schema validation + tests (highest value)
-2. Flux verify CLI + Makefile + CI wiring
-3. rho image-source normalization helper + tests
-4. rho Jina browse extractor + tests
+1. Mux verify metrics + schema validation + tests (highest value)
+2. Mux verify CLI + Makefile + CI wiring
+3. decoder image-source normalization helper + tests
+4. decoder Jina browse extractor + tests
5. Agent-loop cancellation/summarization patterns
6. starling content curation (follow-up PR in separate repo)
## Implementation status
-- [x] Flux schema-accuracy validation and tool-call match-rate metrics.
-- [x] Flux verification CLI, deterministic Makefile target, and CI job.
-- [x] Rho image-source normalization for data URIs, URLs, local files, and raw base64.
-- [x] Rho Jina Reader page-to-Markdown client with opt-in configuration and tests.
-- [x] Rho cancellation cleanup for incomplete assistant tool-use/tool-result turns.
-- [x] Confirmed rho's existing `internal/engine/compact` already provides token-triggered
+- [x] Mux schema-accuracy validation and tool-call match-rate metrics.
+- [x] Mux verification CLI, deterministic Makefile target, and CI job.
+- [x] Decoder image-source normalization for data URIs, URLs, local files, and raw base64.
+- [x] Decoder Jina Reader page-to-Markdown client with opt-in configuration and tests.
+- [x] Decoder cancellation cleanup for incomplete assistant tool-use/tool-result turns.
+- [x] Confirmed decoder's existing `internal/engine/compact` already provides token-triggered
compaction; no duplicate summarizer was added.
-- [ ] Publish the Flux repository changes through its own feature branch and PR.
+- [ ] Publish the Mux repository changes through its own feature branch and PR.
- [ ] Curate MiniMax skills into `starling` through its own feature branch and PR.
diff --git a/docs/plans/pi-adoption-plan.md b/docs/plans/pi-adoption-plan.md
index 280a150ad..54153c5e2 100644
--- a/docs/plans/pi-adoption-plan.md
+++ b/docs/plans/pi-adoption-plan.md
@@ -4,17 +4,17 @@ Status: Proposed
Source: `https://github.com/earendil-works/pi` (MIT, TypeScript/Bun monorepo)
-This plan records the features identified as genuinely missing from rho while
-auditing the Pi agent harness against Rho and its independent ecosystem
+This plan records the features identified as genuinely missing from decoder while
+auditing the Pi agent harness against Decoder and its independent ecosystem
repositories. It is
-an adoption plan, not a code-porting plan: rho reimplements compatible behavior
+an adoption plan, not a code-porting plan: decoder reimplements compatible behavior
in Go and preserves its existing provider, session, permission, observability,
-and protocol boundaries. Rho executes tools directly on the host; it does not
+and protocol boundaries. Decoder executes tools directly on the host; it does not
ship a product sandbox runtime.
## Executive Decision
-Rho should adopt the following Pi features:
+Decoder should adopt the following Pi features:
1. A Go telemetry conformance suite that verifies emitted OpenTelemetry spans
and attributes match the documented schema.
@@ -26,24 +26,24 @@ Rho should adopt the following Pi features:
5. Kitty graphics protocol support for terminal images.
6. Session lease/ownership semantics in the daemon protocol.
-Rho should not copy Pi's TypeScript code, replace its Go runtime, or adopt Pi's
+Decoder should not copy Pi's TypeScript code, replace its Go runtime, or adopt Pi's
custom CBOR RPC protocol. Its host-native permission and path/trust policy is
the local safety boundary.
-## Existing Rho Capabilities
+## Existing Decoder Capabilities
-The audit found that rho already provides the foundation for most Pi features:
+The audit found that decoder already provides the foundation for most Pi features:
-| Pi package | Rho implementation | Current decision |
+| Pi package | Decoder implementation | Current decision |
|---|---|---|
-| `pi-ai` (multi-provider) | sibling `flux` client + engine facade + catalog + router + credentials | Keep rho (broader) |
-| `pi-agent-core` (agent loop) | `internal/engine` | Keep rho |
-| `pi-coding-agent` (CLI) | `cmd` TUI + CLI + daemon | Keep rho |
-| `pi-session-backends` (storage) | `internal/session` JSONL + zstd + WAL + SQLite index, sibling `swift` (Swift) | Keep rho |
-| `pi-server` (RPC) | `internal/daemon` + `internal/acp` + `internal/mcp` | Keep rho (broader) |
-| Permissions and trust | `internal/engine/safety`, path guards, `internal/trust`, `internal/env` | Keep rho's host-native boundary |
+| `pi-ai` (multi-provider) | sibling `mux` client + engine facade + catalog + router + credentials | Keep decoder (broader) |
+| `pi-agent-core` (agent loop) | `internal/engine` | Keep decoder |
+| `pi-coding-agent` (CLI) | `cmd` TUI + CLI + daemon | Keep decoder |
+| `pi-session-backends` (storage) | `internal/session` JSONL + zstd + WAL + SQLite index, sibling `swift` (Swift) | Keep decoder |
+| `pi-server` (RPC) | `internal/daemon` + `internal/acp` + `internal/mcp` | Keep decoder (broader) |
+| Permissions and trust | `internal/engine/safety`, path guards, `internal/trust`, `internal/env` | Keep decoder's host-native boundary |
| `pi-tui` differential rendering | Bubble Tea v2 full-frame redraw | Adopt line-diff engine |
-| `pi-telemetry` conformance | `docs/OTEL-CONVENTIONS.md`, flux `genai_semconv` pinning | Adopt conformance suite |
+| `pi-telemetry` conformance | `docs/OTEL-CONVENTIONS.md`, mux `genai_semconv` pinning | Adopt conformance suite |
| `pi-evals` agent-level eval | `internal/features/eval` (model benchmark only) | Adopt agent-runtime eval |
## Priority Model
@@ -59,16 +59,16 @@ The audit found that rho already provides the foundation for most Pi features:
Guarantee the emitted OpenTelemetry spans and attributes always match the
documented `gen_ai.*` / `cost.usd` / `tool.name` / `session.id` / `agent.id`
-contract, so the schema cannot silently drift across Rho and its independent
+contract, so the schema cannot silently drift across Decoder and its independent
ecosystem repositories.
### Scope and ownership
- Primary implementation: `internal/observability` and
- `flux/internal/observability` (the canonical `genai_semconv`
+ `mux/internal/observability` (the canonical `genai_semconv`
constants and their pinning test).
- Shared schema constants: sibling `eagle` if a cross-repo
- contract is needed, otherwise keep them in flux as today.
+ contract is needed, otherwise keep them in mux as today.
- No changes to `internal/mcp` or `internal/daemon` for telemetry adoption.
### Required behavior
@@ -84,24 +84,24 @@ ecosystem repositories.
- asserts sensitive attributes never carry raw prompt/response text,
- asserts parent/child span relationships and settlement semantics,
- is runner-independent (usable from any Go test harness).
-4. Wire the conformance harness into the rho and flux test suites so CI
+4. Wire the conformance harness into the decoder and mux test suites so CI
enforces the contract.
5. Keep the conformance layer passive and non-throwing: malformed or unreadable
telemetry payloads must not break agent execution.
### Acceptance criteria
-- Every span rho emits is covered by the schema.
+- Every span decoder emits is covered by the schema.
- A deliberate schema drift (adding a span or attribute) fails the conformance
test until the schema is updated.
- No raw prompt/response text appears in recorded attributes.
-- The conformance harness runs green in rho and flux CI.
+- The conformance harness runs green in decoder and mux CI.
## P0: Agent-Runtime Eval Harness
### Goal
-Evaluate the full rho agent end-to-end (real session, tool loop, planning,
+Evaluate the full decoder agent end-to-end (real session, tool loop, planning,
host policy) against tasks, and snapshot session data as artifacts — not just a
model-level benchmark.
@@ -276,7 +276,7 @@ Every implementation phase must preserve:
- Eval runs the real tool loop end-to-end in an isolated dir.
- Daemon and ACP parity for leased sessions.
- fxtape recording/replay across the new renderer.
-- Cross-repo telemetry conformance in rho and flux CI.
+- Cross-repo telemetry conformance in decoder and mux CI.
### Security tests
@@ -294,11 +294,11 @@ make test-race
make vet
make lint
make security
-rho verify
+decoder verify
```
For sibling-repository changes, run that repository's own tests and boundary checks before
-updating the Rho pointer.
+updating the Decoder pointer.
## Delivery Sequence
@@ -313,7 +313,7 @@ updating the Rho pointer.
- [x] Define the typed span/attribute schema.
- [x] Implement the conformance harness.
-- [x] Wire rho and flux CI.
+- [x] Wire decoder and mux CI.
- [x] Add schema-drift regression tests.
### Milestone 2: Agent-runtime eval (P0)
@@ -321,7 +321,7 @@ updating the Rho pointer.
- [x] Implement the loop runner over the real Session/tool loop.
- [x] Add isolated execution and session-JSONL artifacts.
- [ ] Add comparative and reproducibility reporting.
-- [x] Extend `rho eval` with a loop mode.
+- [x] Extend `decoder eval` with a loop mode.
### Milestone 3: Differential renderer (P1)
@@ -347,19 +347,19 @@ updating the Rho pointer.
## Deliberately Deferred
- Copying Pi's TypeScript code or adopting its custom CBOR RPC protocol in place
- of rho's ACP/MCP/daemon stack.
-- Replacing rho's native permission/sandbox model with Pi's container-only
+ of decoder's ACP/MCP/daemon stack.
+- Replacing decoder's native permission/sandbox model with Pi's container-only
approach.
-- Porting Pi's extension system verbatim; rho's plugin/hook/skills model already
+- Porting Pi's extension system verbatim; decoder's plugin/hook/skills model already
covers it.
- Adding a full agent-swarm/graph model beyond current subagent support.
## Success Criteria
-The adoption is successful when rho closes each confirmed gap while retaining
+The adoption is successful when decoder closes each confirmed gap while retaining
its stronger architecture:
-- Telemetry spans always conform to the documented schema across rho and its
+- Telemetry spans always conform to the documented schema across decoder and its
sibling repositories.
- The agent can be evaluated end-to-end through its real tool loop.
- The TUI re-renders only changed lines with synchronized output.
diff --git a/docs/plans/pi-renderer-and-eval-reporting.md b/docs/plans/pi-renderer-and-eval-reporting.md
index 61bd6349c..44a8d813a 100644
--- a/docs/plans/pi-renderer-and-eval-reporting.md
+++ b/docs/plans/pi-renderer-and-eval-reporting.md
@@ -8,7 +8,7 @@ the three merged Pi PRs (#226, #227, #228).
## Executive Decision
Two of the three remaining sub-items are **blocked by the rendering stack** and
-cannot be adopted cleanly in rho's current UI framework:
+cannot be adopted cleanly in decoder's current UI framework:
- Bubble Tea v2 exposes **no public `Renderer` interface** (its renderer is an
unexported type with internal methods; the only option is `WithoutRenderer`).
@@ -28,13 +28,13 @@ reporting** — is fully feasible and safe (non-TUI) and is adopted here.
config) so identical runs can be cached and compared.
- Add a comparative report across runs/models: pass rate, token/latency/cost
deltas, and per-run reproducibility hash.
-- Wire it into the existing `evalloop` package and `rho eval loop` output.
+- Wire it into the existing `evalloop` package and `decoder eval loop` output.
### Scope and ownership
- Primary: `internal/features/evalloop`.
- CLI: `cmd/eval.go` loop mode.
-- No changes to a local sandbox runtime (none ships in rho), `internal/session`,
+- No changes to a local sandbox runtime (none ships in decoder), `internal/session`,
or `internal/daemon`.
### Required behavior
@@ -44,7 +44,7 @@ reporting** — is fully feasible and safe (non-TUI) and is adopted here.
result transcript.
3. A `Compare` helper aggregates multiple results and reports pass-rate and
per-metric deltas (tokens, cost, duration).
-4. `rho eval loop --report` prints the comparative summary.
+4. `decoder eval loop --report` prints the comparative summary.
### Acceptance criteria
@@ -65,6 +65,6 @@ reporting** — is fully feasible and safe (non-TUI) and is adopted here.
## Verification
- `go test ./...` full suite.
-- `make vet`, `make lint`, `rho verify`.
+- `make vet`, `make lint`, `decoder verify`.
- Focused `internal/features/evalloop` tests.
- markdownlint on this document.
diff --git a/docs/plans/qwen-code-adoption-plan.md b/docs/plans/qwen-code-adoption-plan.md
index 0f41d70eb..6a8b7b752 100644
--- a/docs/plans/qwen-code-adoption-plan.md
+++ b/docs/plans/qwen-code-adoption-plan.md
@@ -1,18 +1,18 @@
# Qwen Code Adoption Plan
-Status: Implemented selectively in the current Rho feature branch.
+Status: Implemented selectively in the current Decoder feature branch.
## Guardrails
-Qwen Code is Apache-2.0 TypeScript software with a Gemini-shaped core. Rho
-will independently reimplement behavioral contracts in Go, preserve the Flux
-provider boundary, and retain Rho's event-sourced sessions and OS sandbox.
+Qwen Code is Apache-2.0 TypeScript software with a Gemini-shaped core. Decoder
+will independently reimplement behavioral contracts in Go, preserve the Mux
+provider boundary, and retain Decoder's event-sourced sessions and OS sandbox.
No Qwen source or dependency is vendored.
-## Existing Rho Capabilities
+## Existing Decoder Capabilities
-Rho already has durable sessions, event logging, WAL/recovery, branching,
-review contracts, provider routing in Flux, MCP integration, skills, memory,
+Decoder already has durable sessions, event logging, WAL/recovery, branching,
+review contracts, provider routing in Mux, MCP integration, skills, memory,
context compaction, policy snapshots, subagents, daemon security, and
filesystem/process sandboxing. These systems will not be duplicated.
@@ -24,7 +24,7 @@ filesystem/process sandboxing. These systems will not be duplicated.
2. Added terminal reasons for permission denial, approval denial, unknown tool,
pipeline failure, timeout, cancellation, execution failure, and success.
3. Added regression coverage for the lifecycle contract.
-4. Preserved Rho's existing cancellation transcript cleanup and compaction.
+4. Preserved Decoder's existing cancellation transcript cleanup and compaction.
5. Preserved policy-snapshot inheritance and subagent cleanup already present.
6. Added explicit `StreamEvent` tool lifecycle state and terminal-reason fields,
with execution-path transitions and regression coverage.
@@ -47,7 +47,7 @@ filesystem/process sandboxing. These systems will not be duplicated.
### P2: Declarative extensibility
-- Map Markdown subagent frontmatter to Rho's typed SpawnRequest.
+- Map Markdown subagent frontmatter to Decoder's typed SpawnRequest.
- Add path-conditional skill activation and parse-error diagnostics.
- Add hot reload with bounded activation listeners.
- Scope child hooks and MCP resources by session/agent ID.
@@ -61,6 +61,6 @@ filesystem/process sandboxing. These systems will not be duplicated.
## Verification
- Focused lifecycle, skills, engine, and command tests.
-- Full Rho build, vet, and test suite.
+- Full Decoder build, vet, and test suite.
- Independent second verification pass.
- Final diff and sibling-repository status inspection.
diff --git a/docs/plans/tau-feature-parity.md b/docs/plans/tau-feature-parity.md
index 65edf68db..20082a9bb 100644
--- a/docs/plans/tau-feature-parity.md
+++ b/docs/plans/tau-feature-parity.md
@@ -1,17 +1,17 @@
-# Plan: bring Tau's feature set into Rho (Go)
+# Plan: bring Tau's feature set into Decoder (Go)
Status: in progress
-Branch: `feat/rename-rho`
+Branch: `feat/rename-decoder`
## Principle
-Tau's features must exist in Rho **without leaving Go**. Rho already has a
+Tau's features must exist in Decoder **without leaving Go**. Decoder already has a
superset of Tau's agent capabilities; this plan closes the specific gaps where
-Tau offers a documented feature Rho does not.
+Tau offers a documented feature Decoder does not.
-## Gap analysis (Tau feature → Rho status)
+## Gap analysis (Tau feature → Decoder status)
-| Tau feature | Rho status | Action |
+| Tau feature | Decoder status | Action |
|---|---|---|
| Interactive TUI | ✅ Bubble Tea TUI | none |
| `-p` print mode | ✅ `-p` | none |
@@ -20,13 +20,13 @@ Tau offers a documented feature Rho does not.
| Durable JSONL sessions + resume + branching | ✅ JSONL + DAG branching | none |
| Slash commands (login, model, sessions, compaction, export, theme) | ✅ `/login` added | none |
| `AGENTS.md` project instructions | ✅ | none |
-| `.tau/` project resources | ✅ `.rho/` | none |
+| `.tau/` project resources | ✅ `.decoder/` | none |
| `.agents/` shared resources | ✅ skills/providers/recipes/hooks/rules/workflows + `.agents/AGENTS.md` instructions | none |
| User skills, prompt templates, themes | ✅ | none |
| Context accounting + manual/auto compaction | ✅ | none |
| Provider-neutral output: text, JSON, transcript | ✅ text + json + stream-json + transcript | none |
-| `~/.tau/catalog.toml` custom providers/models, no code changes | ❌ missing | **flux-side** (see below) |
-| `tau update` | ✅ `rho update` | none |
+| `~/.tau/catalog.toml` custom providers/models, no code changes | ❌ missing | **mux-side** (see below) |
+| `tau update` | ✅ `decoder update` | none |
| Installers | ✅ `install.sh` | none |
## Work items
@@ -34,11 +34,11 @@ Tau offers a documented feature Rho does not.
1. ~~**`--cwd` global flag**~~ — done (`cmd/root.go`, applied to interactive, `-p`, and `exec`).
2. ~~**`/login` slash command**~~ — done (`cmd/chat_subcommand_login.go`).
3. ~~**`transcript` output format**~~ — done (`--output-format transcript`).
-4. **User catalog `~/.rho/catalog.toml`** — NOT implemented. The model catalog
- is owned by the flux engine (`github.com/GrayCodeAI/flux/catalog`), whose
+4. **User catalog `~/.decoder/catalog.toml`** — NOT implemented. The model catalog
+ is owned by the mux engine (`github.com/GrayCodeAI/mux/catalog`), whose
`LoadCatalogOptions` has no user-catalog override. Per `AGENTS.md`
- (provider/catalog ownership lives in flux), this must be added in flux and
- surfaced through the engine facade before rho can consume it.
+ (provider/catalog ownership lives in mux), this must be added in mux and
+ surfaced through the engine facade before decoder can consume it.
5. ~~**`.agents/` instruction resources**~~ — done (`.agents/AGENTS.md` is in
the instruction search path in `internal/config/config.go`).
@@ -50,5 +50,5 @@ Tau offers a documented feature Rho does not.
## Out of scope
-- Python/Textual port. Rho stays Go.
-- Removing Rho's larger feature surface.
\ No newline at end of file
+- Python/Textual port. Decoder stays Go.
+- Removing Decoder's larger feature surface.
\ No newline at end of file
diff --git a/docs/plans/toolbench-comparison-vs-top20.md b/docs/plans/toolbench-comparison-vs-top20.md
index 0463dce79..663111420 100644
--- a/docs/plans/toolbench-comparison-vs-top20.md
+++ b/docs/plans/toolbench-comparison-vs-top20.md
@@ -1,17 +1,17 @@
-# Toolbench Comparison: rho vs the Top-20 OSS Coding Agents (2026)
+# Toolbench Comparison: decoder vs the Top-20 OSS Coding Agents (2026)
> Status: analysis complete
-> Scope: built-in tool inventory of rho and the leading open-source coding agents
+> Scope: built-in tool inventory of decoder and the leading open-source coding agents
> Related issue: browser/screenshot automation gap
## Executive summary
-rho ships **69 built-in agent tools** — more than any top-20 OSS rival — and covers every capability category the leader board demands (file I/O, shell, web, search, memory, planning, MCP, sub-agents). The only genuine gaps versus the field are:
+decoder ships **69 built-in agent tools** — more than any top-20 OSS rival — and covers every capability category the leader board demands (file I/O, shell, web, search, memory, planning, MCP, sub-agents). The only genuine gaps versus the field are:
1. **Browser / computer-use automation** — now closed (see this plan's outcome).
-2. **IDE surfaces** — Cline/Continue/Zed are editor-native; rho remains terminal-first by design.
+2. **IDE surfaces** — Cline/Continue/Zed are editor-native; decoder remains terminal-first by design.
-rho's tool count exceeds the field (OpenCode ~10, Claude Code 18, Qwen Code ~26, Codex ~9+), but count alone is not the point: rho matches **Qwen Code** tool-for-tool *and* adds a spec/planning suite, persistent core memory, impact/codegraph/git tools, and an in-tree linter toolchain (`nilaway`, `revive`) that the others leave to MCP.
+decoder's tool count exceeds the field (OpenCode ~10, Claude Code 18, Qwen Code ~26, Codex ~9+), but count alone is not the point: decoder matches **Qwen Code** tool-for-tool *and* adds a spec/planning suite, persistent core memory, impact/codegraph/git tools, and an in-tree linter toolchain (`nilaway`, `revive`) that the others leave to MCP.
## Top-20 OSS coding agents by tool surface (2026 star snapshots)
@@ -19,7 +19,7 @@ Star counts are approximate (GitHub, ~July 2026): OpenCode ~172k, Gemini CLI ~99
| Agent | Built-in tools | Categories covered |
|---|---|---|
-| rho | **69** (+Power, +MCP) | all |
+| decoder | **69** (+Power, +MCP) | all |
| Qwen Code | 26 + computer_use | all; computer use, cron, worktree |
| Claude Code | 18 | all; notebook_edit, skills, hooks |
| Kilo Code | ~15 + Playwright MCP | all + browser via MCP |
@@ -36,7 +36,7 @@ Star counts are approximate (GitHub, ~July 2026): OpenCode ~172k, Gemini CLI ~99
| Continue | ~10 | editor |
| Plandex | ~5 | planning + git |
-## rho's current tool set
+## decoder's current tool set
See `cmd/chat_tools.go` for the registry construction.
@@ -48,23 +48,23 @@ Spec/planning suite (`plan`, `spec_*`, `approve_implementation`, `clarify`, `con
## The browser gap and how it was closed
-Every browser-native competitor drives a real browser: Cline bundles Puppeteer, Kilo bundles the Playwright MCP server, Codex CLI ships a Chrome extension + in-app browser, Qwen Code exposes `computer_use_*`, OpenManus embeds browser/crawl4ai. rho previously had only file/shell/web tools.
+Every browser-native competitor drives a real browser: Cline bundles Puppeteer, Kilo bundles the Playwright MCP server, Codex CLI ships a Chrome extension + in-app browser, Qwen Code exposes `computer_use_*`, OpenManus embeds browser/crawl4ai. decoder previously had only file/shell/web tools.
-**Outcome:** added `internal/tool/browser.go` and `internal/tool/screenshot.go`, exposed through rho's existing `tool.Tool` interface:
+**Outcome:** added `internal/tool/browser.go` and `internal/tool/screenshot.go`, exposed through decoder's existing `tool.Tool` interface:
- `BrowserTool` — headless-Chrome CDP driver with actions `navigate`, `content` (text/HTML, selector-scoped), `screenshot`, `click`, `type` (with clear), `title`, `location`, `close`. Risk level `high`; URL scheme validation restricts to `http(s)` (localhost/LAN included).
- `ScreenshotTool` — single-shot full-page PNG capture to a path (defaults to a temp file).
-Implementation uses `github.com/chromedp/chromedp` v0.16.0, the canonical pure-Go Chrome DevTools client, and reuses rho's existing `validatePathAllowed` guard for the output path. A lazily-allocated, mutex-guarded browser process is shared across calls (closed via `Browser … action:"close"` or `releaseBrowser()` in tests).
+Implementation uses `github.com/chromedp/chromedp` v0.16.0, the canonical pure-Go Chrome DevTools client, and reuses decoder's existing `validatePathAllowed` guard for the output path. A lazily-allocated, mutex-guarded browser process is shared across calls (closed via `Browser … action:"close"` or `releaseBrowser()` in tests).
-A live end-to-end test (`TestBrowserLive`, opt-in via `RHO_LIVE_BROWSER=1`) navigates `example.com`, captures a screenshot, and reads the page title against a real Chrome install — it passes.
+A live end-to-end test (`TestBrowserLive`, opt-in via `DECODER_LIVE_BROWSER=1`) navigates `example.com`, captures a screenshot, and reads the page title against a real Chrome install — it passes.
## Category parity vs the field
-| Category | rho | Field leaders |
+| Category | decoder | Field leaders |
|---|---|---|
-| File ops | read/write/edit/structured/multi/notebook (Go) | Claude Code/Qwen have notebook_edit; rho has it |
-| Search | grep/glob/ls + LSP + code_search/code_graph | OpenCode LSP; rho code_graph exceeds |
+| File ops | read/write/edit/structured/multi/notebook (Go) | Claude Code/Qwen have notebook_edit; decoder has it |
+| Search | grep/glob/ls + LSP + code_search/code_graph | OpenCode LSP; decoder code_graph exceeds |
| Shell | bash (+PowerShell on Windows) + monitor/kill/wait | all |
| Web | web_fetch/web_search/agentic_fetch/download | all |
| Memory | **persistent core_memory_\* (Harrier)** | only Qwen/Claude have persistence |
@@ -77,10 +77,10 @@ A live end-to-end test (`TestBrowserLive`, opt-in via `RHO_LIVE_BROWSER=1`) navi
## Remaining deltas (out of scope here)
- VS Code / JetBrains extension (planned in `docs/IMPLEMENTATION-ROADMAP.md`).
-- Auto-commit-per-edit discipline à la Aider (rho uses AGENTS.md branch rules instead).
+- Auto-commit-per-edit discipline à la Aider (decoder uses AGENTS.md branch rules instead).
## Verification
- `go build ./internal/tool/... ./cmd/...` — clean after adding the tools.
-- `go test ./internal/tool/` — unit tests pass; live browser test passes with `RHO_LIVE_BROWSER=1`.
+- `go test ./internal/tool/` — unit tests pass; live browser test passes with `DECODER_LIVE_BROWSER=1`.
- `/tools` REPL command now reports essential/optional breakdown (enhanced in this change; see `cmd/diagnostics.go`).
diff --git a/docs/platform-capabilities.json b/docs/platform-capabilities.json
index df481c4fb..36b054bb9 100644
--- a/docs/platform-capabilities.json
+++ b/docs/platform-capabilities.json
@@ -136,6 +136,6 @@
]
},
"ecosystem_compatibility": {
- "rho+flux": "full"
+ "decoder+mux": "full"
}
}
diff --git a/docs/plugin-development.md b/docs/plugin-development.md
index 99b2d1886..753a14909 100644
--- a/docs/plugin-development.md
+++ b/docs/plugin-development.md
@@ -2,10 +2,10 @@
## Overview
-Rho supports three plugin types:
+Decoder supports three plugin types:
1. **Simple plugins** — shell scripts with a `plugin.json` manifest. Tools are executed as one-shot subprocesses via stdin/stdout.
-2. **Managed subprocess plugins** — binary executables managed by `PluginManager`. Supports security scanning, timeout enforcement, and auto-discovery from `~/.rho/plugins/`.
+2. **Managed subprocess plugins** — binary executables managed by `PluginManager`. Supports security scanning, timeout enforcement, and auto-discovery from `~/.decoder/plugins/`.
3. **Daemon plugins** — long-lived processes communicating via JSON-RPC 2.0 over stdin/stdout. Managed by `DynamicPluginManager` with full lifecycle (Discover → Load → Activate → Failed/Disabled).
## Plugin Manifest
@@ -51,7 +51,7 @@ For hooks, daemon mode, dependencies, and configuration:
#### Hook priority
-Hooks can specify `priority` (higher runs first). Event data is passed as environment variables (`RHO_EVENT=file.write`, `RHO_FILE_PATH=/path/to/file`).
+Hooks can specify `priority` (higher runs first). Event data is passed as environment variables (`DECODER_EVENT=file.write`, `DECODER_FILE_PATH=/path/to/file`).
#### Daemon mode
@@ -59,7 +59,7 @@ Set `"mode": "daemon"` with `"entrypoint": "./my-daemon"`. The daemon receives J
## Skills
-Skills are Markdown files with YAML frontmatter placed in `.rho/skills//SKILL.md`:
+Skills are Markdown files with YAML frontmatter placed in `.decoder/skills//SKILL.md`:
```yaml
---
@@ -81,7 +81,7 @@ Skill instructions here using markdown...
- **Auto-invoke**: Skills with `auto-invoke: true` and matching path/context globs are automatically activated.
- **Chaining**: Skills can declare `chain.before` and `chain.after` for ordered execution.
- **References**: Use `@ref(path/to/doc.md)` to reference supporting documents within a skill.
-- **Cross-agent compatibility**: Skills follow the Agent Skills spec (agentskills.io) and work with rho, Claude Code, and Codex.
+- **Cross-agent compatibility**: Skills follow the Agent Skills spec (agentskills.io) and work with decoder, Claude Code, and Codex.
## Event Hooks
@@ -89,27 +89,27 @@ Available events for plugin and skill hooks:
| Event | Data | Description |
|-------|------|-------------|
-| `session.start` | `RHO_SESSION_ID` | Session began |
-| `session.end` | `RHO_SESSION_ID`, `RHO_DURATION_MS` | Session ended |
-| `turn.start` | `RHO_TURN_NUM` | Agent turn started |
-| `turn.end` | `RHO_TURN_NUM`, `RHO_TOOL_COUNT` | Agent turn ended |
-| `tool_call.start` | `RHO_TOOL_NAME`, `RHO_TOOL_INPUT` | Tool execution started |
-| `tool_call.end` | `RHO_TOOL_NAME`, `RHO_TOOL_RESULT` | Tool execution finished |
-| `tool_call.error` | `RHO_TOOL_NAME`, `RHO_ERROR` | Tool execution failed |
-| `file.read` | `RHO_FILE_PATH` | File was read |
-| `file.write` | `RHO_FILE_PATH` | File was written |
-| `file.edit` | `RHO_FILE_PATH` | File was edited |
-| `file.delete` | `RHO_FILE_PATH` | File was deleted |
-| `compaction.start` | `RHO_COMPACTION_REASON` | Context compaction began |
-| `compaction.end` | `RHO_COMPACTION_NEW_LENGTH` | Context compaction finished |
-| `budget.warning` | `RHO_BUDGET_USAGE_PCT` | Token/cost budget warning |
-| `budget.exceeded` | `RHO_BUDGET_TYPE` | Budget exceeded (hard stop) |
-| `error.occurred` | `RHO_ERROR_TYPE` | Error occurred |
-| `error.recovered` | `RHO_RECOVERY_STRATEGY` | Error was recovered |
-| `model.switch` | `RHO_NEW_MODEL` | Active model changed |
-| `provider.switch` | `RHO_NEW_PROVIDER` | Active provider changed |
-| `user.input` | `RHO_USER_MESSAGE` | User sent a message |
-| `agent.response` | `RHO_RESPONSE_LENGTH` | Agent generated a response |
+| `session.start` | `DECODER_SESSION_ID` | Session began |
+| `session.end` | `DECODER_SESSION_ID`, `DECODER_DURATION_MS` | Session ended |
+| `turn.start` | `DECODER_TURN_NUM` | Agent turn started |
+| `turn.end` | `DECODER_TURN_NUM`, `DECODER_TOOL_COUNT` | Agent turn ended |
+| `tool_call.start` | `DECODER_TOOL_NAME`, `DECODER_TOOL_INPUT` | Tool execution started |
+| `tool_call.end` | `DECODER_TOOL_NAME`, `DECODER_TOOL_RESULT` | Tool execution finished |
+| `tool_call.error` | `DECODER_TOOL_NAME`, `DECODER_ERROR` | Tool execution failed |
+| `file.read` | `DECODER_FILE_PATH` | File was read |
+| `file.write` | `DECODER_FILE_PATH` | File was written |
+| `file.edit` | `DECODER_FILE_PATH` | File was edited |
+| `file.delete` | `DECODER_FILE_PATH` | File was deleted |
+| `compaction.start` | `DECODER_COMPACTION_REASON` | Context compaction began |
+| `compaction.end` | `DECODER_COMPACTION_NEW_LENGTH` | Context compaction finished |
+| `budget.warning` | `DECODER_BUDGET_USAGE_PCT` | Token/cost budget warning |
+| `budget.exceeded` | `DECODER_BUDGET_TYPE` | Budget exceeded (hard stop) |
+| `error.occurred` | `DECODER_ERROR_TYPE` | Error occurred |
+| `error.recovered` | `DECODER_RECOVERY_STRATEGY` | Error was recovered |
+| `model.switch` | `DECODER_NEW_MODEL` | Active model changed |
+| `provider.switch` | `DECODER_NEW_PROVIDER` | Active provider changed |
+| `user.input` | `DECODER_USER_MESSAGE` | User sent a message |
+| `agent.response` | `DECODER_RESPONSE_LENGTH` | Agent generated a response |
## Security
@@ -123,16 +123,16 @@ All plugins are scanned on install for:
1. Push your plugin to a public GitHub repository.
2. The registry index (maintained at `starling/registry.json`) is periodically refreshed.
-3. Users discover plugins via `rho plugin search `.
-4. Users install via `rho plugin install `.
+3. Users discover plugins via `decoder plugin search `.
+4. Users install via `decoder plugin install `.
5. Registry installation includes automatic audit and security scanning.
## Local Development
```bash
# Create a plugin directory
-mkdir -p ~/.rho/plugins/my-plugin
-cd ~/.rho/plugins/my-plugin
+mkdir -p ~/.decoder/plugins/my-plugin
+cd ~/.decoder/plugins/my-plugin
# Create a manifest
cat > plugin.json << 'EOF'
@@ -147,14 +147,14 @@ cat > plugin.json << 'EOF'
EOF
# List installed plugins
-rho plugin list
+decoder plugin list
# Run a plugin command
-rho plugin exec my-plugin hello
+decoder plugin exec my-plugin hello
# Create a skill (project-local)
-mkdir -p .rho/skills/my-skill
-cat > .rho/skills/my-skill/SKILL.md << 'EOF'
+mkdir -p .decoder/skills/my-skill
+cat > .decoder/skills/my-skill/SKILL.md << 'EOF'
---
name: my-skill
description: My first skill
@@ -165,4 +165,4 @@ EOF
## Feedback and Learning
-Users can rate skills (1–5 stars) using `/skill rate `. Ratings are stored in `~/.rho/feedback.json` and used by the `/learn` command to recommend skills based on project signals.
+Users can rate skills (1–5 stars) using `/skill rate `. Ratings are stored in `~/.decoder/feedback.json` and used by the `/learn` command to recommend skills based on project signals.
diff --git a/docs/session-decomposition.md b/docs/session-decomposition.md
index a9ca457b1..9de93578d 100644
--- a/docs/session-decomposition.md
+++ b/docs/session-decomposition.md
@@ -6,11 +6,11 @@
> into their owning services.
> Author: opencode session
> Date: 2026-06-12
-> Scope: `rho/internal/engine/session.go` (the 35-collaborator `Session` struct)
+> Scope: `decoder/internal/engine/session.go` (the 35-collaborator `Session` struct)
## Problem
-`Session` at `rho/internal/engine/session.go:42-141` is a god object:
+`Session` at `decoder/internal/engine/session.go:42-141` is a god object:
- 35 fields, ~30 of them `*T` pointer collaborators with optional behavior
- Every new feature adds a field (Beliefs, Critic, Trajectory, Steering, etc.)
@@ -84,13 +84,13 @@ backends without an explicit migration and recovery decision.
**Owns:** `client ChatClient`, `provider string`, `model string`, `apiKeys map[string]string`, `Router *modelPkg.Router`, `DeploymentRouting bool`, `RateLimiter *ratelimit.Limiter`, `OutputSchema string`, `GLMThinkingEnabled *bool`, `ContCfg types.ContinuationConfig`, `ChatOptions{}` builder.
**Methods:**
-- `BuildOptions(systemPrompt string, tools []client.FluxTool, activeModel string, maxTokens int) types.ChatOptions`
-- `Chat(ctx, msgs, opts) (*types.FluxResponse, error)` — non-streaming, used by background goroutines
+- `BuildOptions(systemPrompt string, tools []client.MuxTool, activeModel string, maxTokens int) types.ChatOptions`
+- `Chat(ctx, msgs, opts) (*types.MuxResponse, error)` — non-streaming, used by background goroutines
- `Stream(ctx, msgs, opts) (*types.StreamResult, error)` — with retry, circuit-breaker record, rate-limit wait
- `RecordSuccess(latency time.Duration)` / `RecordFailure(err error)`
- `BuildContinuationConfig() types.ContinuationConfig`
-**File:** `rho/internal/engine/chat_service.go` (~150 LOC)
+**File:** `decoder/internal/engine/chat_service.go` (~150 LOC)
### 2. `MemoryService` — owns memory recall/remember
@@ -99,12 +99,12 @@ backends without an explicit migration and recovery decision.
**Methods:**
- `RecallContext(ctx, lastUserMsg string, budget int) string` — unifies backend recall behind one nil-safe call
- `Remember(ctx, content, category string)` — wraps memory.Remember
-- `RunSleeptimeConsolidation(ctx, provider ChatService, messages []types.FluxMessage)` — background
+- `RunSleeptimeConsolidation(ctx, provider ChatService, messages []types.MuxMessage)` — background
- `RunSkillDistillation(ctx, provider ChatService, ...)` — background
- `RecordFeedback(ctx, content string, action string)` — wraps EnhancedMemory feedback
- `ShouldRemember(text string) bool` — heuristic for auto-remember
-**File:** `rho/internal/engine/memory_service.go` (~200 LOC)
+**File:** `decoder/internal/engine/memory_service.go` (~200 LOC)
### 3. `ToolService` — owns the registry + tool execution
@@ -117,7 +117,7 @@ backends without an explicit migration and recovery decision.
- `SpawnBackgroundAgent(ctx, prompt string) (id string, err error)`
- `PollBackgroundAgent(id string) (output string, done bool, err error)`
-**File:** `rho/internal/engine/tool_service.go` (~400 LOC — biggest, owns the 15-stage pipeline)
+**File:** `decoder/internal/engine/tool_service.go` (~400 LOC — biggest, owns the 15-stage pipeline)
### 4. `PermissionService` — owns the safety layer
@@ -131,7 +131,7 @@ backends without an explicit migration and recovery decision.
- `SetMode(mode string) error` — validates + applies
- `SetMaxTurns(n int)`, `SetMaxBudgetUSD(usd float64)`
-**File:** `rho/internal/engine/permission_service.go` (~150 LOC)
+**File:** `decoder/internal/engine/permission_service.go` (~150 LOC)
### 5. `LifecycleService` — owns the self-improvement loop
@@ -139,16 +139,16 @@ backends without an explicit migration and recovery decision.
**Methods:**
- `OnSessionStart(ctx, lastUserMsg string) (learnedCtx string)`
-- `OnSessionEnd(ctx, success bool, duration time.Duration, messages []types.FluxMessage)`
+- `OnSessionEnd(ctx, success bool, duration time.Duration, messages []types.MuxMessage)`
- `SelectModel(taskType, currentModel, hint string) string` — wraps Cascade
-- `OnToolFailure(ctx, intent string, history []types.FluxMessage, errOutput string) (*Reflection, error)`
-- `RecordDecision(turn int, toolNames string, msgs []types.FluxMessage)`
+- `OnToolFailure(ctx, intent string, history []types.MuxMessage, errOutput string) (*Reflection, error)`
+- `RecordDecision(turn int, toolNames string, msgs []types.MuxMessage)`
- `CheckLimits(turnCount int) (cont bool, reason string)` — wraps Limits
- `RecordTurn(turn int)`, `RecordToolCall(name string)`
- `DetectDoomLoop(steps []ToolStep) bool`
-- `InjectSteering(messages []types.FluxMessage) []types.FluxMessage`
+- `InjectSteering(messages []types.MuxMessage) []types.MuxMessage`
-**File:** `rho/internal/engine/lifecycle_service.go` (~250 LOC)
+**File:** `decoder/internal/engine/lifecycle_service.go` (~250 LOC)
### 6. `PersistenceService` — owns checkpoint and session state
@@ -161,13 +161,13 @@ backends without an explicit migration and recovery decision.
- `AddUser(content string)`, `AddAssistant(content string)`, `AddUserWithImage(...)`, `AddUserWithAttachment(...)`
- `AddUserWithDocumentText(content, label, extracted string)`
- `AppendSystemContext(content string)`, `ReplaceSystemContextSection(header, content string)`
-- `Messages() []types.FluxMessage`, `RawMessages()`, `MessageCount()`, `LoadMessages([]types.FluxMessage)`
+- `Messages() []types.MuxMessage`, `RawMessages()`, `MessageCount()`, `LoadMessages([]types.MuxMessage)`
- `RemoveLastExchange()`
- `ConvoHead() string`, `ForkConversation(nodeID string) (string, error)`, `SwitchBranch(nodeID string) error`, `ListBranches(nodeID string) ([]*storage.DAGNode, error)`
- `CheckpointOnCompaction(strategy string, before, after int, manual bool)`
- `TokenTracking() (prompt, completion int)`, `RecordAPIUsage(prompt, completion int)`
-**File:** `rho/internal/engine/persistence_service.go` (~300 LOC)
+**File:** `decoder/internal/engine/persistence_service.go` (~300 LOC)
## What stays on `Session`
@@ -222,7 +222,7 @@ func (s *Session) agentLoop(ctx context.Context, ch chan<- StreamEvent) {
for turn := 0; ; turn++ {
if !s.Lifecycle.CheckLimits(turn) { return }
- opts := s.Chat.BuildOptions(s.system, s.Tools.Registry().FluxTools(), activeModel, maxTok)
+ opts := s.Chat.BuildOptions(s.system, s.Tools.Registry().MuxTools(), activeModel, maxTok)
result, err := s.Chat.Stream(ctx, s.Persistence.Messages(), opts)
if err != nil { /* error path */ }
defer result.Close()
@@ -256,7 +256,7 @@ The loop body shrinks from 800 lines to ~250 because:
3. **Phase 3**: extract `MemoryService` (most fields, but only consumed in the preamble/postamble of `agentLoop`).
4. **Phase 4**: extract `PermissionService` (smallest surface).
5. **Phase 5**: extract `LifecycleService` (biggest behavioral surface, but mostly reads `messages` and `tools`).
-6. **Phase 6**: extract `PersistenceService` (last because it owns the `messages []types.FluxMessage` field which is touched everywhere).
+6. **Phase 6**: extract `PersistenceService` (last because it owns the `messages []types.MuxMessage` field which is touched everywhere).
7. **Phase 7**: extract `ToolService` (depends on 4, 5; do last).
8. **Phase 8**: delete fields from `Session`, add backwards-compatible shims that delegate to the new services, mark for removal in v0.2.0.
diff --git a/docs/terminal-icons.md b/docs/terminal-icons.md
index 4b76ab924..7bc837df5 100644
--- a/docs/terminal-icons.md
+++ b/docs/terminal-icons.md
@@ -1,6 +1,6 @@
# Terminal icons
-Rho uses current Nerd Font Codicon glyphs for interactive terminal output.
+Decoder uses current Nerd Font Codicon glyphs for interactive terminal output.
The application does not try to infer the installed font from `TERM`: terminal
names do not report the active font, and guessing can produce tiny fallback
boxes or missing glyphs.
@@ -10,14 +10,14 @@ Interactive TTYs use Nerd Font icons by default. Captured output, CI, and
```bash
# Real icons (requires a Nerd Font configured in the terminal profile)
-RHO_ICONS=nerd ./bin/rho
+DECODER_ICONS=nerd ./bin/decoder
# Portable text-only output
-RHO_ICONS=ascii ./bin/rho
+DECODER_ICONS=ascii ./bin/decoder
```
-For the real icons, configure the terminal profile—not Rho's Go code—with a
+For the real icons, configure the terminal profile—not Decoder's Go code—with a
patched font such as `JetBrainsMono Nerd Font` or `Symbols Nerd Font Mono`.
-Font size and glyph scale are controlled by that profile. Rho applies bold
+Font size and glyph scale are controlled by that profile. Decoder applies bold
weight to status icons for contrast, but there is no portable ANSI escape that
can resize one glyph independently of the surrounding text.
diff --git a/docs/troubleshooting-guide.md b/docs/troubleshooting-guide.md
index 1b6ed3168..c2d32bca8 100644
--- a/docs/troubleshooting-guide.md
+++ b/docs/troubleshooting-guide.md
@@ -1,6 +1,6 @@
# Troubleshooting Guide
-A practical guide for diagnosing common rho daemon and CLI issues.
+A practical guide for diagnosing common decoder daemon and CLI issues.
## Table of Contents
@@ -29,27 +29,27 @@ because the auth middleware would be open to the network.
**Fix:** Set an API key:
```bash
-export RHO_DAEMON_API_KEY=$(openssl rand -base64 32)
-rho daemon start --host 0.0.0.0 --port 4590
+export DECODER_DAEMON_API_KEY=$(openssl rand -base64 32)
+decoder daemon start --host 0.0.0.0 --port 4590
```
Or bind to loopback only (no API key required, but not remotely accessible):
```bash
-rho daemon start --host 127.0.0.1 --port 4590
+decoder daemon start --host 127.0.0.1 --port 4590
```
### "permission denied" on state directory
-The daemon writes logs, PID files, and the audit log to `~/.rho/state/`.
+The daemon writes logs, PID files, and the audit log to `~/.decoder/state/`.
**Fix:**
```bash
-mkdir -p ~/.rho/state
-chmod 750 ~/.rho/state
-# If running under systemd as user 'rho', ensure ownership:
-chown -R rho:rho ~/.rho
+mkdir -p ~/.decoder/state
+chmod 750 ~/.decoder/state
+# If running under systemd as user 'decoder', ensure ownership:
+chown -R decoder:decoder ~/.decoder
```
### "port already in use"
@@ -63,7 +63,7 @@ Another process is using port 4590.
lsof -i :4590
# Or use a different port
-rho daemon start --port 4591
+decoder daemon start --port 4591
```
---
@@ -72,7 +72,7 @@ rho daemon start --port 4591
### `GET /v1/ready` returns 503
-The readiness probe fails when Flux's local preflight doesn't pass. This
+The readiness probe fails when Mux's local preflight doesn't pass. This
checks provider state, catalog, credentials, and model selection.
**Diagnosis:**
@@ -83,9 +83,9 @@ curl -v http://localhost:4590/v1/ready
Check the response body for the specific failed check. Common causes:
-- No model configured — set `RHO_MODEL` or provider credentials.
-- Flux catalog not initialized — the Go modules are independent sibling
- repositories; from a full parent workspace, run `make setup` in rho to
+- No model configured — set `DECODER_MODEL` or provider credentials.
+- Mux catalog not initialized — the Go modules are independent sibling
+ repositories; from a full parent workspace, run `make setup` in decoder to
regenerate the parent `go.work`:
```bash
make setup
@@ -102,11 +102,11 @@ failed to start.
```bash
# Check if the process is running
-ps aux | grep rho
+ps aux | grep decoder
# Check logs
-journalctl -u rho-daemon -n 50
-tail -50 ~/.rho/state/daemon.log
+journalctl -u decoder-daemon -n 50
+tail -50 ~/.decoder/state/daemon.log
```
---
@@ -120,7 +120,7 @@ The daemon requires `Authorization: Bearer ` or `X-API-Key: `.
**Fix:**
```bash
-curl -H "X-API-Key: $RHO_DAEMON_API_KEY" http://localhost:4590/v1/stats
+curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" http://localhost:4590/v1/stats
```
### "constant time comparison" errors in logs
@@ -131,16 +131,16 @@ No action needed.
### Forgotten API key
-The API key is written to `~/.rho/state/daemon.key` (permissions 0600).
+The API key is written to `~/.decoder/state/daemon.key` (permissions 0600).
```bash
-cat ~/.rho/state/daemon.key
+cat ~/.decoder/state/daemon.key
```
**Security note:** Remove this file in production after initial testing:
```bash
-rm ~/.rho/state/daemon.key
+rm ~/.decoder/state/daemon.key
```
---
@@ -152,7 +152,7 @@ your request. The default limits are:
- **General API**: 10 req/min, burst 4
- **Chat**: 30 req/min, burst 6
-- **Concurrent chat sessions**: 4 (configurable via `RHO_DAEMON_MAX_CONCURRENT`)
+- **Concurrent chat sessions**: 4 (configurable via `DECODER_DAEMON_MAX_CONCURRENT`)
**Fix:**
@@ -170,7 +170,7 @@ your request. The default limits are:
CORS is **disabled by default**. Enable it when serving browser-based clients:
```bash
-rho daemon start --cors https://app.example.com --cors https://admin.example.com
+decoder daemon start --cors https://app.example.com --cors https://admin.example.com
```
Use `--cors '*'` only for development — it allows any origin.
@@ -181,7 +181,7 @@ The CORS middleware handles OPTIONS preflight automatically when the `cors`
feature flag is enabled. If you're getting 405, ensure CORS is enabled:
```bash
-export RHO_FEATURE_CORS=1
+export DECODER_FEATURE_CORS=1
```
---
@@ -197,7 +197,7 @@ mode) or when the engine is not ready (daemon mode).
curl http://localhost:4590/v1/ready
```
-If readiness fails, the session factory exists but Flux preflight is not
+If readiness fails, the session factory exists but Mux preflight is not
satisfied (missing model, credentials, etc.).
---
@@ -210,7 +210,7 @@ The metrics endpoint is protected by the same API key authentication as other
endpoints.
```bash
-curl -H "X-API-Key: $RHO_DAEMON_API_KEY" http://localhost:4590/v1/metrics
+curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" http://localhost:4590/v1/metrics
```
### Metrics output is empty
@@ -226,7 +226,7 @@ Prometheus version supports this format (Prometheus 2.20+).
For troubleshooting, try the JSON format:
```bash
-curl -H "X-API-Key: $RHO_DAEMON_API_KEY" \
+curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" \
"http://localhost:4590/v1/metrics?format=json"
```
@@ -239,13 +239,13 @@ curl -H "X-API-Key: $RHO_DAEMON_API_KEY" \
Telemetry is **opt-in**. You must explicitly enable it:
```bash
-export RHO_ENABLE_TELEMETRY=1
+export DECODER_ENABLE_TELEMETRY=1
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
-rho daemon start
+decoder daemon start
```
**Important**: Setting `OTEL_EXPORTER_OTLP_ENDPOINT` alone does **not**
-enable telemetry. The `RHO_ENABLE_TELEMETRY=1` flag is required.
+enable telemetry. The `DECODER_ENABLE_TELEMETRY=1` flag is required.
### "telemetry initialization failed" warning in logs
@@ -264,7 +264,7 @@ curl -v http://localhost:4318/v1/traces
The OTel SDK uses a batch span processor with a 5-second flush interval.
On shutdown, the daemon waits up to 2 seconds (configurable via
-`RHO_OTEL_SHUTDOWN_TIMEOUT_MS`) to flush pending spans.
+`DECODER_OTEL_SHUTDOWN_TIMEOUT_MS`) to flush pending spans.
To force a flush, send SIGTERM to the daemon — it will flush telemetry
before shutting down.
@@ -275,25 +275,25 @@ before shutting down.
### Security log won't open
-The audit log is stored in `~/.rho/state/securitylog/`. If the directory
+The audit log is stored in `~/.decoder/state/securitylog/`. If the directory
doesn't exist or isn't writable:
```bash
-mkdir -p ~/.rho/state/securitylog
-chmod 700 ~/.rho/state/securitylog
+mkdir -p ~/.decoder/state/securitylog
+chmod 700 ~/.decoder/state/securitylog
```
### "log tail does not match head pointer (truncated or tampered)"
This error means the security log has been modified or truncated. The
tamper-evident design detected an inconsistency. Restore from a backup
-of the `~/.rho/state/securitylog/` directory.
+of the `~/.decoder/state/securitylog/` directory.
### Lost the HMAC key
The HMAC key (`sel.key`) is required to verify the audit log. If it's
lost, all entries become unverifiable. **Always back up the entire
-`~/.rho/state/securitylog/` directory.**
+`~/.decoder/state/securitylog/` directory.**
---
@@ -312,13 +312,13 @@ audit log for the `denied` event type.
1. Check the metrics endpoint for request duration:
```bash
- curl -H "X-API-Key: $RHO_DAEMON_API_KEY" \
+ curl -H "X-API-Key: $DECODER_DAEMON_API_KEY" \
"http://localhost:4590/v1/metrics?format=json"
```
-2. Check concurrent sessions: `rho_daemon_chat_concurrency_used`
+2. Check concurrent sessions: `decoder_daemon_chat_concurrency_used`
3. If at capacity, increase the concurrency limit:
```bash
- export RHO_DAEMON_MAX_CONCURRENT=8
+ export DECODER_DAEMON_MAX_CONCURRENT=8
```
### High memory usage
@@ -334,41 +334,41 @@ large contexts can consume significant memory. Consider:
## Systemd Issues
-### "Failed to start rho-daemon.service: Unit not found"
+### "Failed to start decoder-daemon.service: Unit not found"
Install the unit file, the service user and the binary it runs:
```bash
-sudo useradd --system --home-dir /var/lib/rho --shell /usr/sbin/nologin rho
-sudo install -m 0755 ~/.rho/bin/rho /usr/local/bin/rho
-sudo cp packaging/systemd/rho-daemon.service /etc/systemd/system/
-# Optional: sudo install -D -m 0600 /dev/null /etc/rho/daemon.env, then add
-# RHO_DAEMON_API_KEY= (the key is read from the environment, not argv).
+sudo useradd --system --home-dir /var/lib/decoder --shell /usr/sbin/nologin decoder
+sudo install -m 0755 ~/.decoder/bin/decoder /usr/local/bin/decoder
+sudo cp packaging/systemd/decoder-daemon.service /etc/systemd/system/
+# Optional: sudo install -D -m 0600 /dev/null /etc/decoder/daemon.env, then add
+# DECODER_DAEMON_API_KEY= (the key is read from the environment, not argv).
sudo systemctl daemon-reload
-sudo systemctl enable --now rho-daemon
+sudo systemctl enable --now decoder-daemon
```
### "Permission denied" accessing state directory
-The unit runs as user `rho` with `ProtectSystem=strict` and
+The unit runs as user `decoder` with `ProtectSystem=strict` and
`ProtectHome=true`, so the only writable locations are the directories
-systemd creates for it (`StateDirectory=rho`, `CacheDirectory=rho`) and a
-private `/tmp`. Config lives in `/var/lib/rho/config`, state (sessions, security
-log, `run/daemon.log`) in `/var/lib/rho/state`, and cache in `/var/cache/rho`.
+systemd creates for it (`StateDirectory=decoder`, `CacheDirectory=decoder`) and a
+private `/tmp`. Config lives in `/var/lib/decoder/config`, state (sessions, security
+log, `run/daemon.log`) in `/var/lib/decoder/state`, and cache in `/var/cache/decoder`.
Home directories are hidden from the service, so do not point
-`ReadWritePaths=` or the `RHO_*_DIR` variables at `/home`, `/root` or `%h`
+`ReadWritePaths=` or the `DECODER_*_DIR` variables at `/home`, `/root` or `%h`
(`%h` is always `/root` in a system unit). To let the agent edit project
checkouts, add them explicitly, for example `ReadWritePaths=/srv/projects`
-in a drop-in (`sudo systemctl edit rho-daemon`).
+in a drop-in (`sudo systemctl edit decoder-daemon`).
### Daemon not logging to journald
If using the systemd unit, logs go to both journald (stdout/stderr) and
-`/var/lib/rho/state/run/daemon.log`. Check:
+`/var/lib/decoder/state/run/daemon.log`. Check:
```bash
-journalctl -u rho-daemon -f
-sudo tail -f /var/lib/rho/state/run/daemon.log
+journalctl -u decoder-daemon -f
+sudo tail -f /var/lib/decoder/state/run/daemon.log
```
If journald logs are missing, verify that stdout/stderr are not being
diff --git a/docs/user-guide/01-getting-started.md b/docs/user-guide/01-getting-started.md
index df787591c..a7a984bee 100644
--- a/docs/user-guide/01-getting-started.md
+++ b/docs/user-guide/01-getting-started.md
@@ -1,25 +1,25 @@
# Getting Started
-Rho is an AI-powered coding agent for your terminal, built for developers by GrayCode AI. It understands your codebase, executes shell commands, edits files, searches the web, and manages tasks — all through natural language.
+Decoder is an AI-powered coding agent for your terminal, built for developers by GrayCode AI. It understands your codebase, executes shell commands, edits files, searches the web, and manages tasks — all through natural language.
-You can use Rho interactively as a full-screen TUI, run it headlessly for scripting and CI/CD, or integrate it into editors via the Agent Client Protocol (ACP).
+You can use Decoder interactively as a full-screen TUI, run it headlessly for scripting and CI/CD, or integrate it into editors via the Agent Client Protocol (ACP).
---
## Installation
-Rho is currently in active development. Contributor source builds are the primary path while we harden the product in the open.
+Decoder is currently in active development. Contributor source builds are the primary path while we harden the product in the open.
### From Source (Recommended for Contributors)
```bash
-git clone https://github.com/GrayCodeAI/rho && cd rho
-GOWORK=off go build -o rho ./cmd/rho
-./rho
+git clone https://github.com/GrayCodeAI/decoder && cd decoder
+GOWORK=off go build -o decoder ./cmd/decoder
+./decoder
```
For full cross-repository development, place the nine Go repositories beside
-Rho in a parent workspace and run `make setup` from `rho`; `graycode-eco` is
+Decoder in a parent workspace and run `make setup` from `decoder`; `graycode-eco` is
only a local folder name, not a repository containing those modules.
### Verification
@@ -27,7 +27,7 @@ only a local folder name, not a repository containing those modules.
Run the developer path check to verify your setup:
```bash
-./rho path
+./decoder path
```
This checks setup and security readiness.
@@ -36,15 +36,15 @@ This checks setup and security readiness.
## First Launch
-Start Rho by running:
+Start Decoder by running:
```bash
-rho
+decoder
```
-On first launch, Rho opens a TUI where you can configure credentials. Press `/config` (or `/autonomy`) to open the configuration picker. Your API keys are stored in your OS keychain (macOS Keychain or Linux keyring), never in plain text.
+On first launch, Decoder opens a TUI where you can configure credentials. Press `/config` (or `/autonomy`) to open the configuration picker. Your API keys are stored in your OS keychain (macOS Keychain or Linux keyring), never in plain text.
-Rho supports multiple providers:
+Decoder supports multiple providers:
- **xAI Grok** — `XAI_API_KEY`
- **Anthropic Claude** — `ANTHROPIC_API_KEY`
@@ -58,12 +58,12 @@ See [Authentication](02-authentication.md) for the full set of auth options incl
## Basic Interaction
-Once authenticated, Rho presents a full-screen TUI powered by Bubble Tea with two main areas:
+Once authenticated, Decoder presents a full-screen TUI powered by Bubble Tea with two main areas:
-- **Scrollback** — the conversation history showing your prompts, Rho's responses, tool calls, file edits, and more
+- **Scrollback** — the conversation history showing your prompts, Decoder's responses, tool calls, file edits, and more
- **Prompt** — the input area at the bottom where you type messages
-Type a message and press `Enter` to send it. Rho reads files, runs commands, and edits code as needed. Each tool run streams into the scrollback in real time.
+Type a message and press `Enter` to send it. Decoder reads files, runs commands, and edits code as needed. Each tool run streams into the scrollback in real time.
Press `Tab` to move focus between the prompt and the scrollback. While a turn is running, `Ctrl+C` cancels it. In Vim mode, use `j`/`k` to navigate and `h`/`l` to collapse/expand entries.
@@ -81,7 +81,7 @@ The `@` operator opens a fuzzy file picker. By default it respects `.gitignore`
### Permissions
-Rho exposes two independent control surfaces:
+Decoder exposes two independent control surfaces:
- **`/autonomy`** — Controls the trust tier (Always Ask, Scout, Builder, Operator, Autonomous)
- **`/spec`** — A workflow gate that blocks Write/Edit/Bash until you approve implementation
@@ -105,21 +105,21 @@ Every conversation is a **session**. Sessions are automatically saved and can be
- Start a new session: `Ctrl+N` or `/new`
- Resume a previous session: `/resume` in the TUI, or `--resume ` from the CLI
-- Continue the most recent session: `rho -c`
+- Continue the most recent session: `decoder -c`
### Scrollback
The scrollback shows:
- **User prompts** — your messages, rendered as sticky headers
-- **Agent messages** — Rho's responses with markdown rendering
-- **Thinking blocks** — Rho's reasoning process (collapsible)
+- **Agent messages** — Decoder's responses with markdown rendering
+- **Thinking blocks** — Decoder's reasoning process (collapsible)
- **Tool calls** — file edits, command executions, search results
- **Task lists** — TODO items tracking progress
### Tools
-Rho has built-in tools for:
+Decoder has built-in tools for:
| Tool | Description |
|------|-------------|
@@ -152,44 +152,44 @@ See [Slash Commands](04-slash-commands.md) for the complete reference.
```bash
# Start the interactive TUI
-rho
+decoder
# Submit an initial prompt as the first turn
-rho "fix the failing auth test and run it"
+decoder "fix the failing auth test and run it"
# Start in a specific project directory
-rho --cwd ~/projects/my-app
+decoder --cwd ~/projects/my-app
# Resume a previous session
-rho -r abc123
+decoder -r abc123
# Continue the most recent session
-rho -c
+decoder -c
# Use a specific provider/model
-rho --provider openai --model gpt-4o
+decoder --provider openai --model gpt-4o
# Isolated worktree for changes
-rho --worktree "refactor module X"
+decoder --worktree "refactor module X"
# Non-interactive (headless) mode
-rho -p "Explain this codebase"
+decoder -p "Explain this codebase"
# Full auto mode
-rho exec --auto full "add error handling"
+decoder exec --auto full "add error handling"
# Dry-run mode (denies all tools)
-rho exec --autonomy dry-run "What would this do?"
+decoder exec --autonomy dry-run "What would this do?"
```
---
## Headless Mode
-Run Rho non-interactively for scripting, CI/CD, and automation:
+Run Decoder non-interactively for scripting, CI/CD, and automation:
```bash
-rho -p "Your prompt here"
+decoder -p "Your prompt here"
```
Output formats:
@@ -204,15 +204,15 @@ Output formats:
## Project Rules (AGENTS.md)
-Add per-project instructions by creating an `AGENTS.md` file in your repository. Rho reads these files and injects their contents as a project-instructions message at the start of the conversation:
+Add per-project instructions by creating an `AGENTS.md` file in your repository. Decoder reads these files and injects their contents as a project-instructions message at the start of the conversation:
```
-~/.rho/AGENTS.md # Global rules (apply to all projects)
+~/.decoder/AGENTS.md # Global rules (apply to all projects)
/AGENTS.md # Repository-level rules
/AGENTS.md # Directory-level rules (highest priority)
```
-Deeper files take precedence. Rho also reads `CLAUDE.md` files for compatibility.
+Deeper files take precedence. Decoder also reads `CLAUDE.md` files for compatibility.
---
diff --git a/docs/user-guide/02-authentication.md b/docs/user-guide/02-authentication.md
index 8f36e99a6..bec9288ec 100644
--- a/docs/user-guide/02-authentication.md
+++ b/docs/user-guide/02-authentication.md
@@ -1,14 +1,14 @@
# Authentication
-Rho supports several authentication methods, including API key configuration through the TUI and multi-provider support via Flux.
+Decoder supports several authentication methods, including API key configuration through the TUI and multi-provider support via Mux.
---
## API Key Configuration
-On first launch, Rho opens the TUI where you can configure credentials. Press `/config` or `/autonomy` to open the configuration picker. Your API keys are stored in your OS keychain (macOS Keychain or Linux keyring), never in plain text or environment variables.
+On first launch, Decoder opens the TUI where you can configure credentials. Press `/config` or `/autonomy` to open the configuration picker. Your API keys are stored in your OS keychain (macOS Keychain or Linux keyring), never in plain text or environment variables.
-Rho supports multiple providers:
+Decoder supports multiple providers:
| Provider | ID | Key |
|----------|----|-----|
@@ -24,10 +24,10 @@ Rho supports multiple providers:
```bash
# Verify credential status
-rho credentials status
+decoder credentials status
# Run the TUI and use /config to set keys interactively
-rho
+decoder
```
### Environment Variables (Fallback)
@@ -36,7 +36,7 @@ For CI/CD or headless environments, you can set API keys as environment variable
```bash
export XAI_API_KEY="xai-..."
-rho
+decoder
```
Fireworks uses its OpenAI-compatible API. Set `FIREWORKS_API_KEY`; the default
@@ -49,19 +49,19 @@ base URL is `https://api.fireworks.ai/inference/v1`. See the official
## Provider Configuration
-Rho uses Flux for provider routing, health checks, and retry logic. To configure providers:
+Decoder uses Mux for provider routing, health checks, and retry logic. To configure providers:
```bash
# In the TUI, press /config to open provider settings
-rho
+decoder
# Or validate readiness
-rho path
+decoder path
```
### Deployment-Aware Routing
-For deployment-aware routing, set in `.rho/settings.json`:
+For deployment-aware routing, set in `.decoder/settings.json`:
```json
{
@@ -72,10 +72,10 @@ For deployment-aware routing, set in `.rho/settings.json`:
Or export:
```bash
-export RHO_DEPLOYMENT_ROUTING=true
+export DECODER_DEPLOYMENT_ROUTING=true
```
-Rho will route canonical model IDs through Flux's deployment catalog. Refresh the catalog with:
+Decoder will route canonical model IDs through Mux's deployment catalog. Refresh the catalog with:
```
/refresh-model-catalog
@@ -90,7 +90,7 @@ Authenticate developers through your own Identity Provider (IdP) — such as Okt
### Configure via Settings
```json
-// .rho/settings.json
+// .decoder/settings.json
{
"oidc": {
"issuer": "https://acme.okta.com",
@@ -99,7 +99,7 @@ Authenticate developers through your own Identity Provider (IdP) — such as Okt
}
```
-Rho discovers endpoints via `{issuer}/.well-known/openid-configuration`, opens the IdP login page, and stores tokens in the keychain. Tokens auto-refresh silently via the stored `refresh_token`.
+Decoder discovers endpoints via `{issuer}/.well-known/openid-configuration`, opens the IdP login page, and stores tokens in the keychain. Tokens auto-refresh silently via the stored `refresh_token`.
### Required Scopes
@@ -116,7 +116,7 @@ When browser-based login isn't possible — for example, on sandboxed VMs, CI ru
### How It Works
-1. Rho runs your command via `sh -c ""`
+1. Decoder runs your command via `sh -c ""`
2. Your binary runs whatever auth flow it needs
3. **stdout** is captured and parsed as an access token
4. **stderr** carries human-readable output surfaced to the user
@@ -139,7 +139,7 @@ JSON with optional refresh token:
### Configuration
```json
-// .rho/settings.json
+// .decoder/settings.json
{
"auth_provider_command": "/usr/local/bin/my-auth-provider",
"auth_provider_label": "Acme Corp"
@@ -149,17 +149,17 @@ JSON with optional refresh token:
Or via environment variables:
```bash
-export RHO_AUTH_PROVIDER_COMMAND="/usr/local/bin/my-auth-provider"
-export RHO_AUTH_PROVIDER_LABEL="Acme Corp"
+export DECODER_AUTH_PROVIDER_COMMAND="/usr/local/bin/my-auth-provider"
+export DECODER_AUTH_PROVIDER_LABEL="Acme Corp"
```
### Token Refresh
-When Rho needs to refresh an expired token, it re-runs your binary with `RHO_AUTH_EXPIRED=1` set in the environment:
+When Decoder needs to refresh an expired token, it re-runs your binary with `DECODER_AUTH_EXPIRED=1` set in the environment:
```bash
#!/bin/sh
-if [ "$RHO_AUTH_EXPIRED" = "1" ]; then
+if [ "$DECODER_AUTH_EXPIRED" = "1" ]; then
echo "Refreshing token..." >&2
TOKEN=$(my-company-auth --refresh --silent)
else
@@ -182,16 +182,16 @@ echo "{\"access_token\": \"$TOKEN\", \"expires_in\": 3600}"
Check credential status at any time:
```bash
-rho credentials status
+decoder credentials status
```
-This verifies keychain entries and validates Flux's provider status.
+This verifies keychain entries and validates Mux's provider status.
---
## Credential Precedence
-Rho resolves credentials in this order:
+Decoder resolves credentials in this order:
1. **Per-model configuration** — set via `/config` or settings
2. **Keychain entry** — obtained through TUI configuration
@@ -203,7 +203,7 @@ During a session, the active method handles all refreshes.
## Multi-Provider Support
-Rho works with any LLM provider through Flux's adapter system:
+Decoder works with any LLM provider through Mux's adapter system:
| Provider | Status |
|----------|--------|
diff --git a/docs/user-guide/03-keyboard-shortcuts.md b/docs/user-guide/03-keyboard-shortcuts.md
index 6af07dd38..c0456c243 100644
--- a/docs/user-guide/03-keyboard-shortcuts.md
+++ b/docs/user-guide/03-keyboard-shortcuts.md
@@ -1,12 +1,12 @@
# Keyboard Shortcuts
-Reference for key bindings in the Rho TUI. Bindings are built-in and cannot currently be remapped.
+Reference for key bindings in the Decoder TUI. Bindings are built-in and cannot currently be remapped.
---
## Input Modes
-Rho has two input modes that control how you navigate the scrollback:
+Decoder has two input modes that control how you navigate the scrollback:
- **Simple mode** (default): Arrow keys for navigation, `Shift+Arrow` for turn navigation, `Space` to focus the prompt
- **Vim mode** (opt-in): `j`/`k` for navigation, `H`/`L` for turn navigation, `h`/`l` for fold, `Tab` to focus the prompt
@@ -17,7 +17,7 @@ Simple mode is active by default. To switch to Vim mode:
/vim-mode
```
-Or set `vim_mode = true` under `[ui]` in `~/.rho/settings.json`:
+Or set `vim_mode = true` under `[ui]` in `~/.decoder/settings.json`:
```json
{
diff --git a/docs/user-guide/04-slash-commands.md b/docs/user-guide/04-slash-commands.md
index c5877c978..6656ea70d 100644
--- a/docs/user-guide/04-slash-commands.md
+++ b/docs/user-guide/04-slash-commands.md
@@ -186,7 +186,7 @@ Install a skill from a source.
```
/skills install go-review
-rho skills install go-review
+decoder skills install go-review
```
### `/skills audit`
@@ -195,7 +195,7 @@ Security scan installed skills.
```
/skills audit
-rho skills audit
+decoder skills audit
```
---
@@ -317,7 +317,7 @@ Quick ready-to-chat check.
### `/ecosystem`
-Show ecosystem component status (Flux and the token pipeline).
+Show ecosystem component status (Mux and the token pipeline).
```
/ecosystem
@@ -413,7 +413,7 @@ Toggle vim-style keybindings.
### `/refresh-model-catalog`
-Fetch the latest deployment-aware model catalog from Flux.
+Fetch the latest deployment-aware model catalog from Mux.
```
/refresh-model-catalog
diff --git a/docs/user-guide/05-configuration.md b/docs/user-guide/05-configuration.md
index aed869a04..53e2a975c 100644
--- a/docs/user-guide/05-configuration.md
+++ b/docs/user-guide/05-configuration.md
@@ -1,6 +1,6 @@
# Configuration
-Rho reads configuration from settings files, environment variables, and has defaults for all options. This document covers the common configuration options.
+Decoder reads configuration from settings files, environment variables, and has defaults for all options. This document covers the common configuration options.
---
@@ -11,18 +11,18 @@ Configuration is resolved in this order (highest priority first):
1. **CLI `--settings` JSON override** (`LoadSettingsWithOverride`)
2. **Per-command CLI flags** (e.g., `--provider`, `--model`)
3. **Environment variables** (only where explicitly read; there is no global env layer)
-4. **Project settings** (`.rho/settings.json`, repository-safe subset only —
+4. **Project settings** (`.decoder/settings.json`, repository-safe subset only —
`model`, `provider`, permissions, MCP servers and providers are stripped)
-5. **User settings** (`~/.rho/settings.json`)
+5. **User settings** (`~/.decoder/settings.json`)
6. **Built-in defaults**
---
## Settings File
-Location: `~/.rho/settings.json`
+Location: `~/.decoder/settings.json`
-This is the main configuration file. Rho writes to it when you save changes via `/config` or `/autonomy save`.
+This is the main configuration file. Decoder writes to it when you save changes via `/config` or `/autonomy save`.
### Basic Settings
@@ -106,34 +106,34 @@ Key environment variables for configuration.
| Variable | Description |
|----------|-------------|
-| `RHO_Y0_FOLDER_TRUST` | Folder trust feature flag (default: `1`) |
-| `RHO_Y0_MARKETPLACE` | Marketplace feature flag (default: `1`, set `0` to disable remote installs) |
-| `RHO_DEPLOYMENT_ROUTING` | Not an environment variable: set `deployment_routing` in `settings.json` |
+| `DECODER_Y0_FOLDER_TRUST` | Folder trust feature flag (default: `1`) |
+| `DECODER_Y0_MARKETPLACE` | Marketplace feature flag (default: `1`, set `0` to disable remote installs) |
+| `DECODER_DEPLOYMENT_ROUTING` | Not an environment variable: set `deployment_routing` in `settings.json` |
### Paths
| Variable | Description |
|----------|-------------|
-| `RHO_HOME` | Harness home override used by identity only (default: `~/.rho`); most config paths honor `RHO_CONFIG_DIR` / `RHO_STATE_DIR` / `RHO_CACHE_DIR` instead |
+| `DECODER_HOME` | Harness home override used by identity only (default: `~/.decoder`); most config paths honor `DECODER_CONFIG_DIR` / `DECODER_STATE_DIR` / `DECODER_CACHE_DIR` instead |
---
## Project Configuration
-Place configuration in `.rho/` within your repository:
+Place configuration in `.decoder/` within your repository:
| File | Purpose |
|------|---------|
-| `.rho/settings.json` | Project settings (autonomy, rules) |
-| `.rho/lsp.json` | LSP server configuration |
+| `.decoder/settings.json` | Project settings (autonomy, rules) |
+| `.decoder/lsp.json` | LSP server configuration |
| `AGENTS.md` | Project instructions |
---
## MCP Servers
-Configure MCP servers in global `~/.rho/settings.json` only — project
-`.rho/settings.json` cannot register MCP servers (stripped by
+Configure MCP servers in global `~/.decoder/settings.json` only — project
+`.decoder/settings.json` cannot register MCP servers (stripped by
`projectSafeSettings`; project automation additionally requires folder trust,
see below):
@@ -169,7 +169,7 @@ Folder trust controls whether project automation (hooks, plugins, MCP, LSP) can
### Trust Store
-Location: `~/.rho/trusted_folders.toml`
+Location: `~/.decoder/trusted_folders.toml`
```toml
[[folders]]
diff --git a/docs/user-guide/06-theming.md b/docs/user-guide/06-theming.md
index 10533c6a5..0260d1e30 100644
--- a/docs/user-guide/06-theming.md
+++ b/docs/user-guide/06-theming.md
@@ -1,16 +1,16 @@
# Theming and Appearance Customization
-Rho draws all TUI colors from a central theme. You can switch themes while running, follow your operating system's light or dark appearance, and adjust scroll speed and compact mode through slash commands or settings.
+Decoder draws all TUI colors from a central theme. You can switch themes while running, follow your operating system's light or dark appearance, and adjust scroll speed and compact mode through slash commands or settings.
---
## Available Themes
-Rho includes 17 built-in themes, plus an `auto` option that follows your system appearance:
+Decoder includes 17 built-in themes, plus an `auto` option that follows your system appearance:
| Theme | Description |
|-------|-------------|
-| **dark** | Neutral dark base with Rho's Talon Gold accent. Default theme. |
+| **dark** | Neutral dark base with Decoder's Talon Gold accent. Default theme. |
| **dracula** | The Dracula color scheme with muted violet surfaces. |
| **nord** | Arctic cold blue palette. |
| **gruvbox** | Warm retro browns with olive-green accent. |
@@ -37,7 +37,7 @@ Theme names are case-insensitive.
### In the TUI
-Run the `/theme` slash command to open the theme picker. As you move through the list with the arrow keys, Rho previews each theme in real time:
+Run the `/theme` slash command to open the theme picker. As you move through the list with the arrow keys, Decoder previews each theme in real time:
```
/theme
@@ -54,7 +54,7 @@ Submitting `/theme` on its own opens the picker.
### Via Settings
-Set the theme in `~/.rho/settings.json`:
+Set the theme in `~/.decoder/settings.json`:
```json
{
@@ -66,7 +66,7 @@ Set the theme in `~/.rho/settings.json`:
## Auto Theme (System Appearance)
-Set `theme: "auto"` to have Rho follow your operating system's light/dark appearance and switch themes automatically:
+Set `theme: "auto"` to have Decoder follow your operating system's light/dark appearance and switch themes automatically:
```json
{
@@ -93,13 +93,13 @@ By default, dark mode maps to the **dark** theme and light mode maps to the **li
| **Windows** | Reads the system personalization registry via PowerShell. |
| **SSH / headless** | Defaults to dark theme when detection fails. |
-Once running, Rho checks for appearance changes when you explicitly switch themes (no continuous polling to avoid resource drain).
+Once running, Decoder checks for appearance changes when you explicitly switch themes (no continuous polling to avoid resource drain).
---
## Color Support Detection
-On startup, Rho detects your terminal's color capability:
+On startup, Decoder detects your terminal's color capability:
| Level | Description |
|-------|-------------|
@@ -107,7 +107,7 @@ On startup, Rho detects your terminal's color capability:
| **256-color** | Indexed palette. Colors are mapped to the nearest index. |
| **16-color** | ANSI names only. Colors map to the closest ANSI color. |
-When `COLORTERM=truecolor` is set, Rho uses truecolor mode. When `TERM` contains `256color`, it uses 256-color mode. When `NO_COLOR` is set, Rho renders in monochrome.
+When `COLORTERM=truecolor` is set, Decoder uses truecolor mode. When `TERM` contains `256color`, it uses 256-color mode. When `NO_COLOR` is set, Decoder renders in monochrome.
---
@@ -192,7 +192,7 @@ View terminal configuration recommendations and current capabilities:
/terminal-setup
```
-This shows detected color support, current settings, and tips for optimal Rho experience.
+This shows detected color support, current settings, and tips for optimal Decoder experience.
---
diff --git a/docs/user-guide/07-mcp-servers.md b/docs/user-guide/07-mcp-servers.md
index bf919ed1a..b4bcba0d7 100644
--- a/docs/user-guide/07-mcp-servers.md
+++ b/docs/user-guide/07-mcp-servers.md
@@ -1,12 +1,12 @@
# MCP Servers
-MCP (Model Context Protocol) servers extend Rho with external tool integrations. They let Rho interact with any service that implements the MCP standard.
+MCP (Model Context Protocol) servers extend Decoder with external tool integrations. They let Decoder interact with any service that implements the MCP standard.
---
## What Are MCP Servers?
-An MCP server is a process that exposes tools to Rho over a standardized protocol. When you configure an MCP server, its tools become available to the model alongside Rho's built-in tools. The model can discover and call these tools during a session.
+An MCP server is a process that exposes tools to Decoder over a standardized protocol. When you configure an MCP server, its tools become available to the model alongside Decoder's built-in tools. The model can discover and call these tools during a session.
For example, a GitHub MCP server might expose tools like `create_issue`, `list_pull_requests`, and `search_code`. A database server might expose `query`, `list_tables`, and `describe_schema`.
@@ -16,11 +16,11 @@ See the [MCP specification](https://modelcontextprotocol.io) for protocol detail
## Configuration
-MCP servers are configured in `.rho/settings.json` under the `mcp_servers` key.
+MCP servers are configured in `.decoder/settings.json` under the `mcp_servers` key.
### stdio Transport (Local Process)
-Rho spawns a local process and communicates over stdin/stdout:
+Decoder spawns a local process and communicates over stdin/stdout:
```json
{
@@ -64,40 +64,40 @@ Manage MCP servers from the command line:
```bash
# List configured MCP servers
-rho mcp list
+decoder mcp list
# Add a stdio server
-rho mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem /path/to/dir
+decoder mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem /path/to/dir
# Add a remote HTTP server
-rho mcp add linear --transport http https://mcp.linear.app/mcp
+decoder mcp add linear --transport http https://mcp.linear.app/mcp
# Remove a server
-rho mcp remove github
+decoder mcp remove github
# Diagnose server configuration
-rho mcp doctor
-rho mcp doctor
+decoder mcp doctor
+decoder mcp doctor
```
-Use `--scope project` to write to `.rho/settings.json` in the current directory instead of the user config.
+Use `--scope project` to write to `.decoder/settings.json` in the current directory instead of the user config.
---
## Project-Scoped MCP Servers
-MCP servers can be configured per-project in `.rho/settings.json`:
+MCP servers can be configured per-project in `.decoder/settings.json`:
```
my-project/
- .rho/
+ .decoder/
settings.json
src/
...
```
```json
-// .rho/settings.json
+// .decoder/settings.json
{
"mcp_servers": {
"linear": {
@@ -125,7 +125,7 @@ MCP tools are namespaced with the server name to avoid collisions:
## Discovering and Using Tools
-Rho provides built-in tools to work with MCP servers:
+Decoder provides built-in tools to work with MCP servers:
- **`search_tool`** — Discover available integration tools across all enabled MCP servers
- **`use_tool`** — Call an integration tool discovered via `search_tool`
diff --git a/docs/user-guide/08-skills.md b/docs/user-guide/08-skills.md
index 519c5f1a4..58adaa97f 100644
--- a/docs/user-guide/08-skills.md
+++ b/docs/user-guide/08-skills.md
@@ -1,26 +1,26 @@
# Skills
-Skills are reusable prompt packages that extend Rho with task-specific instructions. They let you capture a repeatable procedure once, instead of re-explaining it each session.
+Skills are reusable prompt packages that extend Decoder with task-specific instructions. They let you capture a repeatable procedure once, instead of re-explaining it each session.
---
## What Are Skills?
-A skill is a directory containing a `SKILL.md` file. Its markdown body tells Rho how to handle a specific type of task: step-by-step instructions, conventions, and tool-usage patterns.
+A skill is a directory containing a `SKILL.md` file. Its markdown body tells Decoder how to handle a specific type of task: step-by-step instructions, conventions, and tool-usage patterns.
-Use a skill for a repeatable procedure that's too specific for AGENTS.md but too long to retype each time. Rho activates a skill when it applies to your current task.
+Use a skill for a repeatable procedure that's too specific for AGENTS.md but too long to retype each time. Decoder activates a skill when it applies to your current task.
---
## Skill Locations
-Rho discovers skills from these directories, in priority order:
+Decoder discovers skills from these directories, in priority order:
| Location | Scope | Priority |
|----------|-------|----------|
-| `.rho/skills/`, `.rho/commands/` | Local (CWD) | Highest |
-| `/.rho/skills/` | Repo | Medium |
-| `~/.rho/skills/` | User | Lowest |
+| `.decoder/skills/`, `.decoder/commands/` | Local (CWD) | Highest |
+| `/.decoder/skills/` | Repo | Medium |
+| `~/.decoder/skills/` | User | Lowest |
Higher-priority locations override skills with the same name.
@@ -33,7 +33,7 @@ Higher-priority locations override skills with the same name.
Each skill lives in its own directory with a `SKILL.md` file:
```
-~/.rho/skills/
+~/.decoder/skills/
commit/
SKILL.md
review-pr/
@@ -103,13 +103,13 @@ Pass arguments after the name:
When names collide, use qualified forms:
```
-/local:commit # From ./.rho/skills/
-/user:commit # From ~/.rho/skills/
+/local:commit # From ./.decoder/skills/
+/user:commit # From ~/.decoder/skills/
```
### Automatic Invocation
-Rho can invoke a skill automatically when it recognizes a relevant task. Write specific descriptions in the `description` and `when-to-use` fields.
+Decoder can invoke a skill automatically when it recognizes a relevant task. Write specific descriptions in the `description` and `when-to-use` fields.
---
@@ -119,26 +119,26 @@ Manage skills from the command line:
```bash
# Search the community registry
-rho skills search go
+decoder skills search go
# Install a skill from a source
-rho skills install go-review
+decoder skills install go-review
# Audit installed skills for security
-rho skills audit
+decoder skills audit
```
---
## Installing Skills
-Rho ships **no bundled skills** by default. Skills are installed on demand
+Decoder ships **no bundled skills** by default. Skills are installed on demand
from the separate `GrayCodeAI/starling` repo (or any GitHub repo):
```bash
-rho skills search # find a skill in the registry
-rho skills install [skill] # install after user approval
-rho skills audit # security-scan installed skills
+decoder skills search # find a skill in the registry
+decoder skills install [skill] # install after user approval
+decoder skills audit # security-scan installed skills
```
Once installed, skills are discovered from the locations listed above.
diff --git a/docs/user-guide/09-plugins.md b/docs/user-guide/09-plugins.md
index bdcbdec16..a8c01fc80 100644
--- a/docs/user-guide/09-plugins.md
+++ b/docs/user-guide/09-plugins.md
@@ -20,12 +20,12 @@ For example, a `team-tools` plugin might include a deploy skill, a code-review a
## Plugin Locations
-Rho discovers plugins from these locations, in priority order:
+Decoder discovers plugins from these locations, in priority order:
| Location | Scope | Trust Required |
|----------|-------|----------------|
-| `.rho/plugins/` | Project | Yes |
-| `~/.rho/plugins/` | User | No |
+| `.decoder/plugins/` | Project | Yes |
+| `~/.decoder/plugins/` | User | No |
| `--plugin-dir` | Process | No |
When two plugins share a name, the higher-priority location wins.
@@ -38,21 +38,21 @@ Manage plugins from the command line:
```bash
# List installed plugins
-rho plugins list
+decoder plugins list
# Install a plugin
-rho plugins install user/repo
-rho plugins install user/repo@v1.0
-rho plugins install /path/to/local/plugin
+decoder plugins install user/repo
+decoder plugins install user/repo@v1.0
+decoder plugins install /path/to/local/plugin
# Install with trust (required for project plugins)
-rho plugins install user/repo --trust
+decoder plugins install user/repo --trust
# Uninstall a plugin
-rho plugins uninstall my-plugin
+decoder plugins uninstall my-plugin
# Update plugins
-rho plugins update
+decoder plugins update
```
---
@@ -63,15 +63,15 @@ Browse and install plugins from the community marketplace:
```bash
# Search marketplace
-rho plugins search go
+decoder plugins search go
# Install from marketplace
-rho plugins install go-review --trust
+decoder plugins install go-review --trust
```
### Adding Marketplace Sources
-Configure additional marketplaces in `~/.rho/settings.json`:
+Configure additional marketplaces in `~/.decoder/settings.json`:
```json
{
@@ -90,13 +90,13 @@ Configure additional marketplaces in `~/.rho/settings.json`:
## Trust Model
-- **User plugins** (`~/.rho/plugins/`) — Trusted automatically
-- **Project plugins** (`.rho/plugins/`) — Require explicit trust before activation
+- **User plugins** (`~/.decoder/plugins/`) — Trusted automatically
+- **Project plugins** (`.decoder/plugins/`) — Require explicit trust before activation
Trust is required because plugins can execute code via hooks and MCP servers. To trust a plugin:
```bash
-rho plugins install --trust
+decoder plugins install --trust
```
---
diff --git a/docs/user-guide/10-hooks.md b/docs/user-guide/10-hooks.md
index f7430a1c6..38c128b02 100644
--- a/docs/user-guide/10-hooks.md
+++ b/docs/user-guide/10-hooks.md
@@ -1,12 +1,12 @@
# Hooks
-Hooks let you run code at key moments in a Rho session. Use them to automate tasks, enforce safety checks, log activity, and integrate custom tools.
+Hooks let you run code at key moments in a Decoder session. Use them to automate tasks, enforce safety checks, log activity, and integrate custom tools.
---
## What Are Hooks?
-A hook is a shell command or HTTP endpoint that Rho calls when a specific lifecycle event occurs. Hooks can:
+A hook is a shell command or HTTP endpoint that Decoder calls when a specific lifecycle event occurs. Hooks can:
- **Block actions** — A `PreToolUse` hook can deny a dangerous command before it runs
- **React to events** — A `PostToolUse` hook can log every tool execution
@@ -36,7 +36,7 @@ Only `PreToolUse` can block a tool call. All other events are passive.
## Hook Configuration
-Create hooks in `.rho/hooks/hooks.json`:
+Create hooks in `.decoder/hooks/hooks.json`:
```json
{
@@ -100,8 +100,8 @@ Exit code `2` also signals denial. Any other exit code is fail-open (tool is all
## Trust Model
-- **User hooks** (`~/.rho/hooks/`) — Always trusted
-- **Project hooks** (`.rho/hooks/`) — Require folder trust
+- **User hooks** (`~/.decoder/hooks/`) — Always trusted
+- **Project hooks** (`.decoder/hooks/`) — Require folder trust
Project hooks are blocked until you trust the folder:
@@ -114,15 +114,15 @@ Project hooks are blocked until you trust the folder:
## Environment Variables
-Rho sets these variables for every hook:
+Decoder sets these variables for every hook:
| Variable | Description |
|----------|-------------|
-| `RHO_HOOK_EVENT` | Event name (e.g., `PreToolUse`) |
-| `RHO_SESSION_ID` | Current session ID |
-| `RHO_WORKSPACE_ROOT` | Project root path |
-| `RHO_PLUGIN_ROOT` | Plugin directory (for plugin hooks) |
-| `RHO_PLUGIN_DATA` | Plugin data directory |
+| `DECODER_HOOK_EVENT` | Event name (e.g., `PreToolUse`) |
+| `DECODER_SESSION_ID` | Current session ID |
+| `DECODER_WORKSPACE_ROOT` | Project root path |
+| `DECODER_PLUGIN_ROOT` | Plugin directory (for plugin hooks) |
+| `DECODER_PLUGIN_DATA` | Plugin data directory |
---
@@ -130,20 +130,20 @@ Rho sets these variables for every hook:
```bash
# List hooks
-rho hooks list
+decoder hooks list
# Trust project hooks
-rho hooks trust
+decoder hooks trust
# Untrust project hooks
-rho hooks untrust
+decoder hooks untrust
```
---
## Example: Safe Shell Guard
-Create `.rho/hooks/safety.json`:
+Create `.decoder/hooks/safety.json`:
```json
{
diff --git a/docs/user-guide/11-custom-models.md b/docs/user-guide/11-custom-models.md
index 1ce0e2f4a..c11870512 100644
--- a/docs/user-guide/11-custom-models.md
+++ b/docs/user-guide/11-custom-models.md
@@ -1,12 +1,12 @@
# Custom Models
-Rho connects to custom model endpoints through Flux for alternative providers, self-hosted models, and overriding built-in settings.
+Decoder connects to custom model endpoints through Mux for alternative providers, self-hosted models, and overriding built-in settings.
---
## Supported Providers
-Rho works with any LLM provider. Built-in support includes:
+Decoder works with any LLM provider. Built-in support includes:
| Provider | ID | Key |
|----------|-----|-----|
@@ -24,7 +24,7 @@ Rho works with any LLM provider. Built-in support includes:
### CLI Flag
```bash
-rho -m gpt-4o -p "Hello"
+decoder -m gpt-4o -p "Hello"
```
### Slash Command
@@ -39,7 +39,7 @@ In the TUI:
### Config Default
```json
-// ~/.rho/settings.json
+// ~/.decoder/settings.json
{
"default_provider": "openai",
"default_model": "gpt-4o"
@@ -50,7 +50,7 @@ In the TUI:
## Configuring Custom Models
-Add custom models in `~/.rho/settings.json`:
+Add custom models in `~/.decoder/settings.json`:
```json
{
@@ -73,7 +73,7 @@ Add custom models in `~/.rho/settings.json`:
### Credential Resolution
-Rho resolves credentials in this order:
+Decoder resolves credentials in this order:
1. Per-model `api_key` field
2. Environment variable (`env_key`)
@@ -127,11 +127,11 @@ ollama pull llama-3.1-70b
## Deployment-Aware Routing
-Enable deployment-aware routing to use Flux's model catalog:
+Enable deployment-aware routing to use Mux's model catalog:
```bash
-export RHO_DEPLOYMENT_ROUTING=true
-rho
+export DECODER_DEPLOYMENT_ROUTING=true
+decoder
```
Or in settings:
diff --git a/docs/user-guide/12-project-rules.md b/docs/user-guide/12-project-rules.md
index 32dc93fad..f710b464a 100644
--- a/docs/user-guide/12-project-rules.md
+++ b/docs/user-guide/12-project-rules.md
@@ -1,12 +1,12 @@
# Project Rules (AGENTS.md)
-Project rules let you configure Rho per project or directory. By placing an AGENTS.md file in your repository, you can set coding conventions, build instructions, and style guides that Rho follows automatically.
+Project rules let you configure Decoder per project or directory. By placing an AGENTS.md file in your repository, you can set coding conventions, build instructions, and style guides that Decoder follows automatically.
---
## Supported File Names
-Rho checks for these filenames in each directory (from repo root to CWD):
+Decoder checks for these filenames in each directory (from repo root to CWD):
- `AGENTS.md`
- `Agents.md`
@@ -14,26 +14,26 @@ Rho checks for these filenames in each directory (from repo root to CWD):
- `Claude.md`
- `AGENT.md`
-Rho loads all matching files. Deeper files take precedence when instructions conflict.
+Decoder loads all matching files. Deeper files take precedence when instructions conflict.
---
## Rules Directories
-Rho also scans for `*.md` files in rules directories:
+Decoder also scans for `*.md` files in rules directories:
| Location | Purpose |
|----------|---------|
-| `/.rho/rules/` | Always scanned |
+| `/.decoder/rules/` | Always scanned |
| `/.claude/rules/` | Claude compatibility |
---
## How Discovery Works
-Rho scans rules in this order:
+Decoder scans rules in this order:
-1. **Global rules**: `~/.rho/AGENTS.md` (applies to all projects)
+1. **Global rules**: `~/.decoder/AGENTS.md` (applies to all projects)
2. **Repo rules**: Every directory from git root to CWD (inclusive)
3. **CWD-only**: If not in a git repo, only current directory
@@ -49,7 +49,7 @@ my-monorepo/
AGENTS.md # "Use Express. Follow REST conventions."
```
-When Rho runs in `packages/frontend/`, it loads all instructions. The frontend-specific rules appear later and take precedence.
+When Decoder runs in `packages/frontend/`, it loads all instructions. The frontend-specific rules appear later and take precedence.
---
@@ -108,7 +108,7 @@ my-monorepo/
For one-off rules without editing files:
```bash
-rho --rules "Always use TypeScript" -p "Implement feature"
+decoder --rules "Always use TypeScript" -p "Implement feature"
```
---
diff --git a/docs/user-guide/13-memory.md b/docs/user-guide/13-memory.md
index b3d8ad9b6..45806ca31 100644
--- a/docs/user-guide/13-memory.md
+++ b/docs/user-guide/13-memory.md
@@ -1,20 +1,20 @@
# Memory
-Memory lets Rho recall facts, decisions, and patterns from earlier sessions. Rho indexes saved information and searches it automatically, so new sessions can reuse relevant context.
+Memory lets Decoder recall facts, decisions, and patterns from earlier sessions. Decoder indexes saved information and searches it automatically, so new sessions can reuse relevant context.
---
## What Is Memory?
-Without memory, each Rho session starts fresh. When memory is enabled, Rho can:
+Without memory, each Decoder session starts fresh. When memory is enabled, Decoder can:
- Recall project conventions you explained before
- Reuse debugging steps that worked
- Carry architectural decisions forward across sessions
- Avoid re-asking questions it already has answers to
-Memory is a local subsystem built into Rho. It stores memories as files under
-Rho's state directory; no external service is required.
+Memory is a local subsystem built into Decoder. It stores memories as files under
+Decoder's state directory; no external service is required.
---
@@ -29,7 +29,7 @@ Memory is on by default. To inspect what has been stored:
### Settings
```json
-// ~/.rho/settings.json
+// ~/.decoder/settings.json
{
"memory": {
"enabled": true
@@ -41,14 +41,14 @@ Memory is on by default. To inspect what has been stored:
## How Memory Is Stored
-Memory is stored under Rho's state directory (`~/.rho/` by default).
+Memory is stored under Decoder's state directory (`~/.decoder/` by default).
| Location | Scope | Description |
|----------|-------|-------------|
-| `~/.rho/memories/` | Global | Core memories and preferences |
-| `~/.rho/` state files | Workspace | Project-specific memory and lessons |
+| `~/.decoder/memories/` | Global | Core memories and preferences |
+| `~/.decoder/` state files | Workspace | Project-specific memory and lessons |
-Rho combines core memories, automatic captures, evolving guidelines, and
+Decoder combines core memories, automatic captures, evolving guidelines, and
retrieval metrics to rank what is relevant to the current turn.
---
@@ -57,17 +57,17 @@ retrieval metrics to rank what is relevant to the current turn.
### Remember
-Ask Rho to remember something:
+Ask Decoder to remember something:
```
/remember always open PR links after pushing
```
-Rho records entries as durable statements organized by topic.
+Decoder records entries as durable statements organized by topic.
### Forget
-Ask what Rho should forget:
+Ask what Decoder should forget:
```
/forget the snake_case convention
@@ -77,13 +77,13 @@ Forget is best-effort.
### Recall
-Ask what Rho remembers:
+Ask what Decoder remembers:
```
/what do you remember about auth?
```
-Rho searches across all memory sources and summarizes.
+Decoder searches across all memory sources and summarizes.
---
@@ -99,7 +99,7 @@ Lessons learned are surfaced through:
## First-Turn Injection
-On the first turn of each session, Rho automatically searches memory for content relevant to the current project and injects it as context.
+On the first turn of each session, Decoder automatically searches memory for content relevant to the current project and injects it as context.
Configure injection:
diff --git a/docs/user-guide/14-headless-mode.md b/docs/user-guide/14-headless-mode.md
index 8d7d43a38..3a8b86642 100644
--- a/docs/user-guide/14-headless-mode.md
+++ b/docs/user-guide/14-headless-mode.md
@@ -1,6 +1,6 @@
# Headless Mode and Scripting
-Headless mode runs Rho non-interactively from the command line. It accepts a prompt, executes tools, and returns results — ideal for automation and CI/CD.
+Headless mode runs Decoder non-interactively from the command line. It accepts a prompt, executes tools, and returns results — ideal for automation and CI/CD.
---
@@ -9,10 +9,10 @@ Headless mode runs Rho non-interactively from the command line. It accepts a pro
Pass a prompt to run headless:
```bash
-rho -p "Your prompt here"
+decoder -p "Your prompt here"
```
-Rho processes the prompt and prints the result to stdout.
+Decoder processes the prompt and prints the result to stdout.
---
@@ -23,7 +23,7 @@ Rho processes the prompt and prints the result to stdout.
Human-readable text:
```bash
-rho -p "Summarize this codebase"
+decoder -p "Summarize this codebase"
```
### json
@@ -31,7 +31,7 @@ rho -p "Summarize this codebase"
Single JSON object after completion:
```bash
-rho -p "Summarize this codebase" --output-format json | jq -r '.response'
+decoder -p "Summarize this codebase" --output-format json | jq -r '.response'
```
Output includes:
@@ -44,7 +44,7 @@ Output includes:
NDJSON events in real time:
```bash
-rho -p "Summarize" --output-format stream-json | jq -r 'select(.type=="content") | .content'
+decoder -p "Summarize" --output-format stream-json | jq -r 'select(.type=="content") | .content'
```
Event types:
@@ -59,20 +59,20 @@ Event types:
### Named Session
-Each `rho -p` creates a fresh session by default. To continue a session:
+Each `decoder -p` creates a fresh session by default. To continue a session:
```bash
# Get session ID
-rho -p "Initial prompt" --output-format json | jq -r '.sessionId'
+decoder -p "Initial prompt" --output-format json | jq -r '.sessionId'
# Resume the session
-rho -p "Follow-up" --resume
+decoder -p "Follow-up" --resume
```
### Continue Most Recent
```bash
-rho -p "Continue" --continue
+decoder -p "Continue" --continue
```
---
@@ -83,10 +83,10 @@ Restrict available tools:
```bash
# Allow only read tools
-rho -p "Explain this" --tools "Read,Grep,LS"
+decoder -p "Explain this" --tools "Read,Grep,LS"
# Deny specific tools
-rho -p "Review" --disallowed-tools "Bash,WebSearch"
+decoder -p "Review" --disallowed-tools "Bash,WebSearch"
```
---
@@ -97,10 +97,10 @@ Control tool permissions:
```bash
# Allow shell commands through the explicit tool policy flag
-rho -p "Build" --allowed-tools "Bash(git:*) Bash(npm:*)"
+decoder -p "Build" --allowed-tools "Bash(git:*) Bash(npm:*)"
# Deny dangerous commands
-rho -p "Clean" --disallowed-tools "Bash(rm:*) Bash(sudo:*)"
+decoder -p "Clean" --disallowed-tools "Bash(rm:*) Bash(sudo:*)"
```
---
@@ -110,8 +110,8 @@ rho -p "Clean" --disallowed-tools "Bash(rm:*) Bash(sudo:*)"
Use `--auto` for fully automated runs:
```bash
-rho -p "Format all files" --dangerously-skip-permissions
-rho exec --auto full "Add error handling"
+decoder -p "Format all files" --dangerously-skip-permissions
+decoder exec --auto full "Add error handling"
```
**Warning:** This grants full autonomy. Use only in trusted environments.
@@ -124,14 +124,14 @@ rho exec --auto full "Add error handling"
```bash
#!/bin/bash
-rho -p "Review staged changes for bugs. Reply OK if fine." \
+decoder -p "Review staged changes for bugs. Reply OK if fine." \
--dangerously-skip-permissions --output-format json | jq -r '.response' | grep -q "^OK" || exit 1
```
### Code Review
```bash
-rho -p "Review PR for security issues" \
+decoder -p "Review PR for security issues" \
--output-format json --dangerously-skip-permissions | jq -r '.response' > review.md
```
@@ -139,7 +139,7 @@ rho -p "Review PR for security issues" \
```bash
for file in src/*.go; do
- rho -p "Format $file" --auto
+ decoder -p "Format $file" --auto
done
```
@@ -149,8 +149,8 @@ done
```bash
export XAI_API_KEY="xai-..." # API key
-export RHO_HOME="/path" # Custom config location
-export RHO_LOG_FILE="/tmp/rho.log" # Log file
+export DECODER_HOME="/path" # Custom config location
+export DECODER_LOG_FILE="/tmp/decoder.log" # Log file
```
---
diff --git a/docs/user-guide/15-agent-mode.md b/docs/user-guide/15-agent-mode.md
index 6837cdb96..d968e2290 100644
--- a/docs/user-guide/15-agent-mode.md
+++ b/docs/user-guide/15-agent-mode.md
@@ -1,6 +1,6 @@
# Agent Mode (ACP) and IDE Integration
-Agent mode runs Rho as an ACP (Agent Client Protocol) server for IDE integration and custom tooling.
+Agent mode runs Decoder as an ACP (Agent Client Protocol) server for IDE integration and custom tooling.
---
@@ -17,10 +17,10 @@ The [Agent Client Protocol (ACP)](https://agentclientprotocol.com) is a standard
## stdio Transport
-Run Rho as an ACP server over stdio:
+Run Decoder as an ACP server over stdio:
```bash
-rho agent stdio
+decoder agent stdio
```
Clients include:
@@ -31,9 +31,9 @@ Clients include:
### Options
```bash
-rho agent --model gpt-4o stdio
-rho agent --auto stdio
-rho agent --agent-profile path/to/profile.yaml stdio
+decoder agent --model gpt-4o stdio
+decoder agent --auto stdio
+decoder agent --agent-profile path/to/profile.yaml stdio
```
| Flag | Description |
@@ -49,7 +49,7 @@ rho agent --agent-profile path/to/profile.yaml stdio
### WebSocket Server
```bash
-rho agent serve --bind 127.0.0.1:2419 --secret