# ADR-WPE-016 — Multi-Terminal T-Box Propagation Protocol **Status**: Proposed **Date**: 2026-07-05 **Register**: WPE-52 (ADR Register) **Successor to**: ADR-WPE-013 (Register-of-Record Orchestration Model, WPE-76) **Related**: ADR-WPE-017 (Skills.md Schema (T-box) Register — new WPE-89), TCR-2026-001 (bootstrap) **Labels**: `node:tbox`, `togaf-layer:governance`, `continuum-level:foundation` --- ## Context The Register-of-Record Orchestration Model (ADR-WPE-013) assumed a single orchestrator — Perplexity Computer — reading a T-box (skills) and writing an A-box (Jira). The enterprise is now moving to a multi-terminal topology: Perplexity Computer, Claude.ai (`tygrupel@gmail.com`), and one or more VPS-hosted agents (Hostinger stack: Traefik, LiteLLM Proxy, PostgreSQL/pgvector) operate concurrently against the same Jira A-box. Without governance, T-box drift between terminals is inevitable. A-box coherence is already guaranteed by Jira as sole source of record. T-box coherence is not, because terminal-local schema definitions, closed value sets, and mutation protocols age independently. Divergence in T-box interpretation silently corrupts A-box quality even when the A-box itself is consistent. ## Decision Adopt a T-Box Propagation Protocol with five properties: 1. **Single canonical source** — `wildpoppyclub/tbox` on GitHub is the authoritative T-box. Nothing runs on any terminal without a commit hash traceable to `main`. 2. **Monotonic versioning** — T-box version = short commit SHA on `main`. Every terminal exposes its running SHA and freshness timestamp on every session preamble. 3. **A-box-backed change control** — every T-box change becomes a T-Box Change Record (TCR) subtask under **WPE-89** (Skills.md Schema (T-box) Register, live in Jira, peer of WPE-38/52/74; WPE-75 Archived). No propagation without a TCR. 4. **Fan-out with verification** — after merge, each terminal applies the change through its native mechanism, then answers an identical Verification Prompt. Mismatched responses = failed verification. 5. **Coherence surveillance** — a scheduled coherence job diffs terminal responses weekly and files a TCR when divergence is detected. The protocol applies to **all terminals** — no per-operator exemptions. Standing rules (≤100-word cap, AU English, MECE reasoning) live in the T-box and activate for every terminal, not just the one talking to the principal. ## Consequences **Positive** - Terminals become interchangeable. Any intelligence with the current SHA is authoritative; any behind is advisory. - Employees and future operators inherit a governed onboarding path — they attach to a terminal, not to Ty's memory. - T-box evolution is itself subject to register discipline. Governance turtles-all-the-way-down. - Drift is detectable in ≤7 days by the coherence cron. **Negative / trade-offs** - Merge friction on the T-box repo. Every non-trivial change requires a TCR ticket + ADR mirror. - Per-terminal propagation is currently manual (Perplexity skill re-import, Claude project-instructions paste). Automation of pplx skill sync and Claude project-write API is deferred to a future ADR. - Rollback window (see below) defers `main`-branch garbage collection. **Second-order** - Adversarial review becomes cheap: any terminal not implicated in a TCR can be asked to critique it before merge. Reduces T-box capture risk. - The Monthly Architecture Retrospective gains an eighth surface (T-box coherence), lengthening the retro but tightening the loop. ## Terminal binding | Terminal | Identity | T-box landing mechanism | |---|---|---| | Perplexity Computer | `ty.grupel@helfie.ai` | Re-import skills from `tbox/skills/*.md` on every merge; skill frontmatter carries `tbox_sha` | | Claude.ai | `tygrupel@gmail.com` (account); Drive/Jira connectors auth as `wildpoppyclub@gmail.com` | Project instructions copied from `tbox/system-prompts/claude-orchestrator.md`; knowledge base carries grammars + bundles | | VPS agent(s) | Hostinger VPS via LiteLLM Proxy | System prompt baked from `tbox/system-prompts/vps-agent.md` at deploy; container pulls `main` on start; exports `TBOX_VERSION` env var | ## Open questions — resolved 1. **`TBOX_VERSION` exposed via MCP so terminals can query peers programmatically?** — **Yes.** Build `sbb:tbox-verify` as a hosted MCP on the VPS. Every terminal registers this MCP and can call `verify(peer)` returning `{sha, freshness, verification_response}`. 2. **TCR — dedicated Jira project or subtask hierarchy?** — **Subtask hierarchy under WPE-89** (Skills.md Schema (T-box) Register), mirroring WPE-38/52/74. WPE-75 (LGM) is Archived and not part of the live register set. 3. **Does the ≤100-word rule apply to all terminals or only those talking to Ty?** — **All terminals.** Rule lives in the T-box and is unconditional. C-box may extend for specific workstreams but may not relax. 4. **Rollback window** — **Rollback stays open until the next Monthly Architecture Retrospective.** Retro closes the window by explicit sign-off in the T-box coherence page (see §Retro extension below). ## Retro extension The Monthly Architecture Retrospective (skill `wpe-monthly-retrospective`) gains a new surface page: **Page 8 — T-box Ontology** Contents: - Current SHA on `main` and per-terminal SHA table - TCRs opened this month (count, list, status per terminal) - TCRs verified this month (count, close-out) - Open rollback windows (list with days remaining) - Divergence incidents detected by the coherence cron - Explicit sign-off: `Rollback window for TCR-YYYY-NNN CLOSED as of ` - Deltas to grammars, register schemas, or system prompts - Second-order effects to flag for the next retro The retro is the sole authority that closes rollback windows. ## Kill-switch If two terminals disagree on T-box interpretation in a way that affects live A-box work: 1. Freeze A-box writes on the affected register (JQL guard: `labels != tbox-frozen-`). 2. Roll every terminal back to the previous `main` SHA. 3. Open a P0 TCR under WPE-89. 4. Resolve in the next retro. No hotfixes to production T-box. ## Migration plan Ordered, each step gated by the previous. 1. Create `wildpoppyclub/tbox` repo with the structure defined in the T-Box Propagation Protocol (`tbox-propagation-protocol.md` §4). 2. WPE-89 already exists as the register parent (repurposed 2026-07-09). ADR-WPE-017 formalises the register spec if needed; the ticket itself is live. 3. Seed `tbox/` from current Perplexity skill store and Brain notes (single initial commit). 4. Land TCR-2026-001: bootstrap the protocol itself. Verification prompt run on Perplexity Computer only (Claude and VPS not yet online). 5. Provision Claude.ai Team plan; attach Atlassian/GitHub/Drive MCPs; paste `tbox/system-prompts/claude-orchestrator.md`. 6. Provision VPS agent per `wpe_vps_stack`; deploy with baked `tbox/system-prompts/vps-agent.md`. 7. Land TCR-2026-002: three-terminal verification. All three answer Verification Prompt identically. 8. Enable weekly coherence cron (see requirements doc `tbox-coherence-cron.md`). 9. Land ADR-WPE-018: retro extension — Page 8 (T-box Ontology) added to `wpe-monthly-retrospective`. 10. First multi-terminal retro closes rollback windows for TCR-2026-001 and TCR-2026-002. ## Links - Protocol: `handover-pack/tbox-propagation-protocol.md` - Coherence cron requirements: `handover-pack/tbox-coherence-cron.md` - Skills.md Schema (T-box) register spec: `handover-pack/wpe-89-skills-schema-register.md` - Retro extension: `handover-pack/retro-page-8-tbox-ontology.md` --- **Jira ticket body (paste into WPE-52 subtask)** Title: ADR-WPE-016 — Multi-Terminal T-Box Propagation Protocol Labels: `adr:accepted-pending`, `node:tbox`, `togaf-layer:governance`, `continuum-level:foundation` Links: successor of WPE-76 (ADR-WPE-013); parent WPE-52; related WPE-89 Body: paste §Context, §Decision, §Consequences, §Kill-switch, §Migration plan above.