Cards
Every proposal card in a chat, grouped by what the click does, what the operator sees and whether autopilot may press it, plus the cards no tool drafts, such as blocked and permission.
A card is a record in a chat's thread. The conductor drafts a propose_ card and the operator's click does the thing; the conductor can't press it. The window's POST routes are sorted into chores (a direct tool), presses (a card the operator clicks) and out (settings and config, which stay behind propose_config_edit) in windowRoutes.
01what every press card shows#
A press card carries the conductor's why, a one-line words text for what it will do, and the route's body. The click calls the route's own handler. The thread then gets done: <words>, or couldn't <words>: <error> when the handler refused, and the conductor is told either way. Only a press route with a propose_ card of its own can be pressed this way, so no card reaches a settings route.
Autopilot presses one proposal only: the conductor's newest open sync card, once, and never below stop 4. That is the autopilot column below. Where the code doesn't settle a cell it says not checked.
02runs and gates#
| card | what the click does | what the operator sees | autopilot |
|---|---|---|---|
propose_send_back, propose_reject |
sends a gated run back, or rejects it. See gates | a proposal card | no, only sync is pressed |
propose_retry, propose_run_again, propose_run_continue |
retry, run again, continue a run. See runs | a proposal card | no, only sync is pressed |
propose_pause, propose_continue, propose_stop |
the canvas's own control press on a run. See runs | a proposal card | no, only sync is pressed |
propose_sync, propose_accept_pr |
sync the landed work, or accept its pull request. See land-and-sync | a proposal card | sync yes, at stop 4; accept_pr no |
propose_template |
saves a template. See templates | a proposal card | no, only sync is pressed |
For propose_run_again and propose_run_continue the click only drafts a fresh launch or continue card, and the operator still presses go on it.
03chats#
| card | what the click does | what the operator sees | autopilot |
|---|---|---|---|
propose_archive, propose_conversation_move, propose_conversation_trash |
archive a chat, move it to another project, or move its files to the trash. See chats | a proposal card | no, only sync is pressed |
propose_conversation_compact, propose_conversation_clear |
compact or clear a chat's conductor session. See chats | a proposal card | no, only sync is pressed |
propose_manager_pin, propose_manager_fresh |
pin a chat as its project's manager, or start a fresh manager. See chats | a proposal card | no, only sync is pressed |
propose_worktree_cleanup |
remove leftover run worktrees in a project's clone; the card lists each tree and what removing it loses. A live run is refused | a proposal card | no, only sync is pressed |
04discord#
The first two are the bridge's own: on or off, and the chat the operator's DMs talk to. The other four act in the calling chat's project's server. The page for them is discord.
| card | what the click does | what the operator sees | autopilot |
|---|---|---|---|
propose_discord |
switches the bridge on or off | a proposal card | no, only sync is pressed |
propose_discord_chat |
sets which chat the operator's DMs talk to | a proposal card | no, only sync is pressed |
propose_discord_delete |
deletes a channel, thread or message | a proposal card | no, only sync is pressed |
propose_discord_roles |
creates, edits, assigns or unassigns a role, or sets a channel overwrite | a proposal card | no, only sync is pressed |
propose_discord_member |
kicks or bans a member | a proposal card | no, only sync is pressed |
propose_discord_server |
renames the server | a proposal card | no, only sync is pressed |
05projects and assets#
| card | what the click does | what the operator sees | autopilot |
|---|---|---|---|
propose_project_new |
makes a project: a record on the tracker (empty is local) and a local half here. path is optional, an existing git repo's top folder to link, refused as the settings page refuses it. The summary needs 200 or more characters |
a proposal card with name, summary, tracker and path | no, only sync is pressed |
propose_project_switch |
switches the desk to another project folder, and smith restarts on it | a proposal card with the folder | no, only sync is pressed |
propose_asset_retire |
retires an asset. It leaves the listings, and its versions, blobs and record stay | a proposal card with the asset id | no, only sync is pressed |
For assets in general see assets. A project's two halves are in projects.
06desk and app#
| card | what the click does | what the operator sees | autopilot |
|---|---|---|---|
propose_autopilot_on, propose_autopilot_off |
switch autopilot on or off for a project. See autopilot | a proposal card | no, only sync is pressed |
propose_restart, propose_update |
restart smith, or install an update. See updates | a proposal card | no, only sync is pressed |
propose_root_command |
runs one frozen command as root on a host in the project record's root_hosts | a root card: the operator reads the command, types their password on it and presses run | never. Nothing else reaches the run: not a click on the proposal route, not discord, not autopilot, not any tool |
The description of propose_root_command says it is refused for an unknown host, an empty command or a bad replaces. The password is held in memory for that one run and is never in argv, env, disk, a log or the journal. propose_config_edit is covered in config-edits.
07cards no tool drafts#
These records come from the desk itself.
blocked
Auto mode's classifier refused a call outright, so it never reached a permission card. The operator picks ask me instead or leave it.
- Ask me instead puts that chat in manual mode for the one call and tells the conductor to retry it unchanged, so it arrives as a permission card. If the retry doesn't come within the window (5 minutes), the session goes back to auto. A second window is refused while one is open.
- Leave it dismisses the card, and the conductor is told not to retry or work around it.
See conductor.
permission
In auto mode claude asks before a call it won't make on its own, and the operator answers on a card. The ask holds the conductor's turn until they do. The answers are allow once, allow for this session, or deny. If nobody answers within the wait, the ask is denied and the thread says so. A question card is the same record carrying questions: the operator answers each, and skipping is a dismiss.
carry on codex
When a claude session hits its limit the desk puts this card in that chat: claude is at its limit until a time, carry on on codex? Only a chat that runs on claude gets one. Its do moves that one chat to codex and nothing else.
quarantine
One record in a project's pinned manager chat for each open ticket an install filed or commented on that still waits for the operator's accept. It is a plain message, not a proposal or a press card, and the conductor is told nothing until the operator accepts the ticket. The desk looks for new ones about once a minute. Accepting is on the ticket's page, not on a card the conductor can press. See quarantine-and-reports.
report issue
report_issue drafts a problem report as a card, and nothing is sent until the operator presses send. See quarantine-and-reports.
launch
A launch card proposes runs and go starts them. Its routes are go, hold, dismiss, preview, refresh and keep, plus a card drafted from the tickets page and one that re-derives a stale asset. See launch. Autopilot has its own tool to press go on a launch card's ticket while autopilot is on, refused past its limits.
template
A template card has save, hold and reset. See templates.
gate
The gate card is the gate's decision. Autopilot has its own tool to approve a run it started and can never send one back.