docs/HONE_INTEGRATION.md

Rama main · réplica de lectura del repositorio original.

# Hone ↔ Ferryman integration plan

Status: **draft** — written for the Ferryman repo by an integration architect. Review before acting; the hone side touches a live testnet and a live coordination channel.

Scope: how `/srv/repos/hone` (+ `/srv/repos/hone-bridge`) and `/srv/repos/ferryman` work in conjunction. This answers, in order: (1) what hone already does that Ferryman does not and vice versa; (2) the concrete integration seams; (3) where the "marketplace" fits; (4) a phased migration plan. Everything below is sourced from real paths, files and routes in both repos, not invented.

## 1. What each system is

### 1.1 Hone — Proof-of-Compute chain + native protocol businesses

Hone is a blockchain where "mining" is useful work (AI inference, BLE tracker coverage, storage, clock). Canonical implementation is Rust:

- **Node:** `rust/hone-node/` — one binary (`main.rs`), libp2p gossipsub (port 6942), RocksDB state, Axum HTTP API (port 4242). Chain spec in `rust/hone-node/crates/hone-types/`.
- **CLI:** `rust/hone-cli/` (binary `hone`, `main.rs`).
- **SDK:** `rust/hone-sdk/` (`HoneClient`, manifest generator/sync).
- **Ledger entry model:** `rust/hone-node/crates/hone-types/src/entry.rs` — a single `LedgerEntry` enum (accounts, keys, transfers, stakes, sensors, Freeport, LinkGit, agent tasks, session marketplace, inference, oracle, VRF, bridge, TOTP …).
- **Agent layer (already in-tree):** `agent_registry.rs`, `agent_task.rs`, `agent_session.rs`, `agent_tools.rs`, `agent_worker.rs`, `memory_service.rs`, `session_market.rs`, plus the standalone `rust/hone-orchestrator/` crate (`RuntimeJob/Worker/Attempt/Span/Attestation`, docs/AGENT_ORCHESTRATION_LAYER.md).
- **Native protocols (docs/NATIVE_PROTOCOLS.md):** Freeport (sovereign marketplace: storefronts, products, orders, escrow, encrypted delivery), Verasens (sensor data), LinkGit (content-addressed git hosting).
- **Machine-readable API contract:** `GET /api/integration/manifest` (JSON) and `/api/integration/manifest.md`; the canonical generated manifest is `hone-manifest.json` at the repo root; `hone manifest generate/check` and consumer-side `hone sync` (writes `HONE.md` + `HONE.lock`) live in `rust/hone-sdk/src/manifest/`.

### 1.2 Ferryman — private, self-hosted coordination for an agent fleet

Ferryman coordinates agents across machines you own: work travels as signed files over a Syncthing folder with a private-Git fallback, no server in the middle.

- **Channel / data model:** `crates/ferryman-channel/src/lib.rs` — `ProjectRoute`, `AgentRoute`, `AgentIdentity`, `Order`, `Claim`, `TaskResult`, `Review`, `Recommendation`, `Message`/`Acknowledgement`, `TaskState`.
- **Attribution ledger:** `crates/ferryman-channel/src/ledger.rs` — append-only, signed, hash-chained `ledger.jsonl`.
- **Master / grants:** `crates/ferryman-channel/src/master.rs` — signed `master.json`, role/capability grants.
- **Skills / sources / learning / worktrees:** `skills.rs`, `source.rs`, `learning.rs`, `worktree.rs`.
- **Server (optional):** `crates/ferryman-server/src/lib.rs` (HTTP on 127.0.0.1:8787), worker SDK `crates/ferryman-worker-sdk/`.
- **CLI:** `crates/ferryman-cli/src/main.rs` (binary `ferry`).
- **Observability:** OTLP export in `crates/ferryman-ops/src/telemetry.rs` (`FERRYMAN_OTLP_ENDPOINT` / `OTEL_EXPORTER_OTLP_ENDPOINT`).

### 1.3 hone-bridge — the current manual coordination channel

`hone-bridge` is the private git+Syncthing message channel between the two hone dev machines (Wisp, Fang) and their agents (`orchestrator`, `claw`, `fang`). It is the thing Ferryman most directly replaces.

- **Layout/transport:** `wisp/`, `fang/`, `agents/orchestrator/`, `agents/claw/`; watchers `watch-*.sh`; `send.sh`. Transport is now Syncthing folder **`hone-ferryman`** (see `SYNCTHING.md`), not git.
- **Protocol:** `PROTOCOL.md` — per-file frontmatter (`id`, `from`, `to`, `type`, `created`, `in_reply_to`, `reply_expected`); the `reply_expected` field (not `type`) is what drives the watcher.
- **Derived index:** `FMN_LOG.md` (556 messages, generated by `tools/fmnlog.sh`, single-writer, do not hand-edit).
- **Shared state:** `SCOREBOARD.md` (milestones), `GO_LIVE_CYCLE.md` (the 4-gate consensus cycle), `nodes.md` (identity registry).
- **Worker adapter:** `worker-adapter/` already implements a bridge worker (register/lease/heartbeat/event/upload/complete) against the predecessor `estejosh/orchestrator-bridge`.

## 2. Capability matrix — what each already has

| Concern | Hone has (paths) | Ferryman has (paths) | Net |
|---|---|---|---|
| P2P/transport | libp2p gossipsub mesh (`rust/hone-node/src/net.rs`), HTTP API 4242 | Syncthing folder + private-Git fallback, outbox/quarantine/acks (`docs/COMMUNICATIONS.md`) | complementary: hone = public mesh; Ferryman = private NAT-friendly file channel |
| Signed work items | on-chain `LedgerEntry` variants, `AgentTaskPost/Bid/Assign/Submit/Verify/Settle` (`entry.rs:2041-2116`) | `Order`/`Claim`/`TaskResult`/`Review` files, signed (`lib.rs`) | complementary |
| Attribution/provenance | every entry signed, epochs as blocks, `state_root`; consensus finality in progress | append-only hash-chained `ledger.jsonl` (`ledger.rs`), `master.json` | Ferryman ledger is simpler + offline-verifiable; hone is global + consensus-backed |
| Review/approval gates | verifier commit-reveal majority (`agent_task.rs`) | `requires_review`, `requires_approval` (master-only accept), `Recommendation`, auto/confirm/off (`lib.rs`, `ferryman-ops/src/agent.rs`) | Ferryman is stronger for private gated work |
| Team memory | on-chain KV `memory:{account}:{key}` (`memory_service.rs`), `/api/memory/:account/:key` | SQLite + `MEMORY.md` mirror, append-only with `source` provenance (`docs/PROJECT_MEMORY.md`) | complementary |
| Skills | — | `SKILL.md` routing (`skills.rs`) | Ferryman |
| Always-on work sources | agent task marketplace is push/bid on-chain | `sources.toml` shell adapter + poll loop (`source.rs`) | complementary |
| Benchmark + learning | — | `bench.json` + `learnings.jsonl` (`ferryman-ops/src/eval.rs`, `learning.rs`) | Ferryman |
| Container sandbox / worktrees | runtime hosting `/api/runtime/*` (stateless compute/bundles/secrets/ingress) | `--sandbox` container + per-task git worktree (`worktree.rs`, `docs/CONTAINER.md`) | overlapping; hone = paid hosting, Ferryman = local isolation |
| Inference | embedded candle + `/v1/chat/completions` (OpenAI-compatible, paid in HONE) (`api.rs:364-366`) | provider-neutral; runs external agent CLI (`docs/WRITING_A_WORKER.md`) | hone = the paid inference backend |
| Paid work marketplace | agent task marketplace (`agent_task.rs`), inference marketplace, session marketplace (`session_market.rs`), Freeport (`docs/NATIVE_PROTOCOLS.md`) | none (no money) | hone |
| Registry/directory | `AgentRegister` on-chain registry (`agent_registry.rs`) | `AgentRoute` roster + agent profiles (`docs/AGENT_MODEL.md`) | hone = public discovery; Ferryman = private roster |
| Git/code hosting | LinkGit `/api/linkgit/repo/*`, `/git/:owner/:repo/*` | worktree + private-Git channel repo (not code hosting) | hone |
| Dashboard/explorer | `/app`, `/honescan`, `/network-viz`, `/api/explorer/*`, `/public/leaderboard` (`api.rs:188-327`) | no dashboard (a design target, `docs/ARCHITECTURE.md`) | hone |
| API contract drift guard | `GET /api/integration/manifest[.md]` + `hone-manifest.json` + `hone sync` (`HONE.md`/`HONE.lock`, exits 2 on breaking) | `STANDARD.toml` revision markers | hone (consume it) |
| OTLP/telemetry | — | `FERRYMAN_OTLP_ENDPOINT` (`ferryman-ops/src/telemetry.rs`) | Ferryman |
| Identity | Ed25519 account key roles owner/active/posting/memo/hide/seek (`entry.rs`) | Ed25519 `AgentIdentity` + master grants (`master.rs`, `portable_auth.rs`) | complementary |

**Summary:** hone is the *global, paid, trust-minimized* layer (marketplace, inference, memory, LinkGit, hosting, dashboard). Ferryman is the *private, offline-capable, gated* layer (signed orders/reviews, ledger, master/grants, skills, learning, sandbox). The two are not competitors; hone's own day-to-day development is currently coordinated by the manual `hone-bridge`, which is exactly the job Ferryman productizes.

## 3. Concrete integration seams

There is already a real hand-hold: hone-bridge's transport folder is literally named `hone-ferryman` (`SYNCTHING.md`), its derived index is `FMN_LOG.md` ("Ferryman message set"), and its `worker-adapter/` targets `estejosh/orchestrator-bridge` — the predecessor of Ferryman. So this is a migration of an existing, mostly-manual seam into the product.

### Seam A — Ferryman replaces hone-bridge as hone's coordination/provenance/memory backend

Direct mapping:

| hone-bridge (current) | Ferryman (target) |
|---|---|
| Syncthing folder `hone-ferryman` (`SYNCTHING.md`) | channel folder `<workspace>/.ferryman/ferryman` (`docs/COMMUNICATIONS.md`) |
| `wisp/`, `fang/`, `agents/*/` message folders | `messages/<project>/*.json` + per-agent inbox |
| frontmatter `id/from/to/type/created/in_reply_to/reply_expected` (`PROTOCOL.md`) | signed `Message` v2 (`portable_auth.rs`) with `reply_required` + acknowledgement; or `Order` for work |
| `watch-*.sh` + `reply_expected` watcher rule | `ferry agent run` / `ferry agent review` / `ferry channel watch` |
| `FMN_LOG.md` (556 messages, `tools/fmnlog.sh`) | `ledger.jsonl` (`ledger.rs`) + `ferry channel report` timeline |
| `SCOREBOARD.md` / `GO_LIVE_CYCLE.md` milestones + gates | team memory (`docs/PROJECT_MEMORY.md`) + open orders with `result_contract` |
| `nodes.md` identities (`wisp`, `fang`, `orchestrator`, `claw`, `fang`) | `agents/` roster (`AgentRoute`) + `master.json` grants (`master.rs`) |
| hard guardrails in `PROTOCOL.md` | `requires_approval` orders (master-only accept) + human `pending` queue |

Why this is the right first move: hone-bridge is a proven protocol but it is hand-watchers + a generated Markdown index; Ferryman gives it signed, tamper-evident provenance (`ledger.jsonl`), a real review state machine, and crash-safe delivery (`runtime/outbox`, `quarantine`, acks) that hone-bridge's polling watchers lack.

### Seam B — hone as Ferryman's paid orchestration / inference backend

Ferryman deliberately ships no model (`docs/WRITING_A_WORKER.md`). hone is already an OpenAI-compatible, HONE-denominated inference endpoint:

- `POST /v1/chat/completions` (auth `Bearer $HONE_API_KEY`, `usage.fee_dreams` in the response), `GET /v1/models`, `GET /v1/pricing` (`api.rs:364-366`).
- Rust: `HoneClient::from_env()` → `chat_completions(...)`, `balance(...)`, `faucet_claim(...)` in `rust/hone-sdk` (`docs/AGENT_INTEGRATION.md`).

The swap point is the reference worker: `crates/ferryman-worker-sdk/examples/agent_worker.rs` shells out to `claude -p "<prompt>"`. Replace the agent CLI with a thin hone worker (or extend `hone-bridge/worker-adapter/` to speak the Ferryman worker SDK) that calls `hone-sdk` and handles `402` by claiming the faucet and retrying once (the documented pattern in `docs/AGENT_INTEGRATION.md`). Record `usage.fee_dreams` and the review outcome into Ferryman's `learnings.jsonl` so engine cost and acceptance rate are tracked together.

### Seam C — hone as Ferryman's marketplace front (paid work)

Ferryman coordinates a *private, trusted* fleet; hone is where *public, escrowed* work is priced and settled. The two meet at the hone agent task marketplace (`agent_task.rs`):

- `POST /api/agent/register` (`AgentRegister`, `agent_registry.rs`) advertises a Ferryman worker's tools/model/min_fee publicly.
- `POST /api/agent/task/post` → `bid` → `assign` → `submit` → `verify/commit` → `verify/reveal` → `AgentTaskSettle` (`api.rs:426-441`, `entry.rs:2041-2116`) is the public, escrowed lifecycle.
- Ferryman's `source.rs` (`TaskSource::Shell`, `sources.toml`) can poll `GET /api/agent/tasks` and import open hone tasks as *signed Ferryman orders*; a Ferryman worker does the work privately, then a submitter writes the result back to hone `/api/agent/task/:id/submit`.

Direction is important: hone owns the *escrow and settlement*; Ferryman owns the *private execution + review* before anything is committed on-chain.

### Seam D — hone memory + LinkGit as Ferryman's shared backend

- **Memory:** hone's on-chain KV (`memory_service.rs`, `POST/GET/DELETE /api/memory/:account/:key`) is a second, cross-machine-verifiable tier under Ferryman's local `MEMORY.md`/SQLite. Useful when a team wants memory that survives losing both the workspace and the Syncthing folder.
- **LinkGit:** `/api/linkgit/repo/create`, `/api/linkgit/repo/ref/update`, `/api/linkgit/repo/access/grant|revoke` and the smart-HTTP endpoints `/git/:owner/:repo/*` (`api.rs:217-246`) are a content-addressed store for the artifacts Ferryman produces. A Ferryman `git worktree` branch (`worktree.rs`) can push to a LinkGit remote so the reviewed commit has a censorship-resistant record.

### Seam E — hone as Ferryman's dashboard/observability front

Ferryman has no dashboard (`docs/ARCHITECTURE.md` lists it as a roadmap item). hone already serves `/app`, `/honescan`, `/network-viz`, `/api/explorer/*`, `/public/leaderboard` (`api.rs:188-327`). A thin read-only adapter can render Ferryman's `ledger.jsonl` + `learnings.jsonl` + task state into one of these pages, giving hone a "fleet view" and Ferryman a dashboard with zero new frontend.

### Seam F — cross-signing / provenance anchor

Minimal, high-value: after a Ferryman review accepts a result, write the acceptance into hone as an anchor so the two provenance systems agree:

- `POST /api/memory/<account>/ferryman-review/<order_id>` with the review hash (memory is the cheapest anchor), or
- a LinkGit ref update recording the review (`/api/linkgit/repo/ref/update`), or
- a future hone `LedgerEntry` variant carrying a Ferryman `ledger.jsonl` line hash.

The reverse direction is also available: hone's `AgentTaskSettle` / `AgentRegister` entries can be imported into Ferryman's ledger as evidence when a public hone task is executed by a private Ferryman worker.

## 4. Where the "marketplace" fits

"Marketplace" is not a single thing in hone; it is several native ledgers. The integration should treat them as *demand/supply layers* on top of Ferryman, not as a replacement for Ferryman's private coordination.

Three-layer model:

1. **Private fleet coordination = Ferryman.** Trusted, signed, gated, no money. This stays Ferryman for anything where the work, the code, or the review must not be public.
2. **Public, escrowed work = hone.** `AgentTaskPost → Settle` (`agent_task.rs`) prices, escrows, and settles work between strangers with commit-reveal verifiers.
3. **Marketplace supply = a reviewed Ferryman deliverable.** A Ferryman worker's result that has passed `requires_review` is the only thing worth listing publicly; the review is the quality signal.

Concrete marketplace fits, in order of leverage:

- **Agent task marketplace** (`rust/hone-node/src/agent_task.rs`, routes `api.rs:426-441`): Ferryman is the private executor/reviewer behind a public hone task; hone holds the escrow and pays out on `AgentTaskSettle`.
- **Inference marketplace** (`/v1/chat/completions`, `/api/task/*` in `api.rs:169-180` and `364-366`): Ferryman workers buy inference by the token with HONE; this is the immediate "make Ferryman agents actually run" seam.
- **Session marketplace** (`session_market.rs`, `/api/sessions/*` in `api.rs:415-419`): a Ferryman team can sell a verified, summarized agent-session context (≤6k-token rolling summary) as a `SessionListing`.
- **Freeport** (`docs/NATIVE_PROTOCOLS.md`, `/api/commerce/storefront*` in `api.rs:490-492`): reviewed Ferryman artifacts/deliverables are listed as digital products; Freeport's escrow + hide/seek encrypted delivery already exists.
- **Node hosting / runtime** (`/api/service/node-hosting/*`, `/api/runtime/*` in `api.rs:145-147, 353-362`): host Ferryman workers on hone's paid runtime so a fleet does not need always-on home machines.

Key design rule: **Ferryman never becomes the escrow layer, and hone never becomes the private review layer.** Ferryman issues signed work and records provenance; hone prices and settles. Each keeps the trust model it is good at.

## 5. Phased migration plan

Guiding principle: **move coordination first (Ferryman over hone-bridge), then make Ferryman workers earn (hone inference), then expose the marketplace, then anchor provenance.** At no point is hone's `main` branch or a mainnet launch touched.

### Phase 0 — Recon, pinning, safety (no writes beyond read-only artifacts)

1. **Ferryman side:** read `docs/OPERATOR_BRIEF.md` (mandatory) and run the read-only safety scan before any attach/update. Pin Ferryman project-standard revision 2 (`STANDARD.toml`).
2. **hone side:** pin the surface. Run `hone manifest generate --repo .` (or fetch `GET /api/integration/manifest`) and commit the manifest; in the consumer repo run `hone sync --node <node>` to produce `HONE.md` + `HONE.lock` so CI can fail on breaking changes (`docs/HONE_INTEGRATION_MANIFEST.md`).
3. **hone-bridge side:** regenerate `FMN_LOG.md` with `tools/fmnlog.sh > FMN_LOG.md` (single-writer: fang) and record the chain hash. Inventory the 179 open `reply_expected: true` threads — these become the initial order backlog.

Deliverable: version-pinned contract (`HONE.lock`) + an inventory of open threads → order candidates.

### Phase 1 — Ferryman becomes hone's dev coordination (move hone-bridge first)

**What runs where:** hone-bridge goes read-only; Ferryman is the writer. Both watchers keep *reading* during the cutover so nothing is silently lost.

1. Attach the hone project: `ferry enable --workspace /srv/repos/hone --project hone --agent wisp --email <contact> --role orchestrator --master` (Wisp is the hub, per `SYNCTHING.md`; `--master` makes it the signed master).
2. Register the fleet as agents (`AgentRoute` roster): `fang` (adversarial verify), `orchestrator` (persistent brain), `claw` (local build/run), `fang` (interactive, human-in-the-loop). Grant roles/capabilities via `ferry channel master grant` (`master.rs`).
3. Reuse the existing `hone-ferryman` Syncthing folder ID (`SYNCTHING.md`) as the shared channel folder; keep `.stignore` intact (never weaken it).
4. **Move first — the go-live gates** (`GO_LIVE_CYCLE.md` gates 1–4): issue them as `Order`s with a `result_contract` requiring the four gate results; this is the highest-value, lowest-risk work and exercises `requires_review`.
5. Migrate `FMN_LOG.md` open threads → Ferryman orders (one order per thread that still expects a reply); `SCOREBOARD.md` milestones → team memory (`ferry memory add` / `docs/PROJECT_MEMORY.md`).
6. Run `ferry agent run` (worker loop) and `ferry agent review` (review loop) in parallel with the old hone-bridge watchers for one full go-live cycle; then retire `watch-*.sh`.

**Exit criterion:** a full GO_LIVE_CYCLE pass (gates 1–4) is issued, executed, reviewed, and accepted entirely through Ferryman orders, with every transition visible in `ledger.jsonl`.

### Phase 2 — hone as the inference backend for Ferryman workers

1. Port `hone-bridge/worker-adapter/` to `ferryman-worker-sdk` (`WorkerClient` register/lease/event/complete/artifact), replacing its `orchestrator-bridge` HTTP calls. Note the adapter's documented lease-TTL caveat (`worker-adapter/README.md`: 60s TTL, no renewal) — verify against Ferryman's lease semantics before trusting long agent runs.
2. Swap the agent command from `claude` to a hone client: set `HONE_ACCOUNT`, `HONE_API_KEY`, `HONE_API_URL` and call `hone-sdk` `chat_completions` (`docs/AGENT_INTEGRATION.md`); handle `402` with faucet-claim-and-retry.
3. Record each job's `usage.fee_dreams` + review outcome into `learnings.jsonl` (`learning.rs`) so the fleet's learning database now tracks engine cost vs acceptance.

**Exit criterion:** a real Ferryman order is executed against hone inference, reviewed, and its cost/acceptance is visible in `learnings.jsonl`.

### Phase 3 — hone as the marketplace + memory + provenance backend

1. Register a Ferryman worker publicly: `POST /api/agent/register` (`AgentRegister`, `agent_registry.rs`).
2. Configure a Ferryman task source (`sources.toml`, `source.rs`) to poll `GET /api/agent/tasks` and import open public tasks as signed orders; add a submit path back to `/api/agent/task/:id/submit`.
3. Mirror chosen Ferryman team-memory entries into hone memory (`POST /api/memory/:account/:key`, `memory_service.rs`); keep Ferryman `MEMORY.md` as the authoritative local copy.
4. Anchor accepted reviews into hone (`POST /api/memory/<account>/ferryman-review/<order_id>` or a LinkGit ref update) so public provenance covers private review.

**Exit criterion:** one public hone task is imported into Ferryman, executed privately, reviewed, submitted back, and settled on-chain, with the review hash anchored.

### Phase 4 — hone as the dashboard / marketplace front

1. Publish Ferryman's `ledger.jsonl` + `learnings.jsonl` + task state as a read-only feed into one of hone's existing pages (`/app`, `/honescan`, `/network-viz`, `/public/leaderboard`), filling the dashboard gap Ferryman has not built (`docs/ARCHITECTURE.md`).
2. Optionally list a reviewed Ferryman deliverable as a Freeport product (`/api/commerce/storefront`, `docs/NATIVE_PROTOCOLS.md`).

**Exit criterion:** an operator can see fleet task state and provenance from a hone-served page; one reviewed deliverable is listed in Freeport.

### Phase 5 — Consolidation and hardening

1. Decide the permanent boundary: private/gated work stays Ferryman; public/paid work is hone's agent task marketplace. Do not re-implement hone's escrow in Ferryman or hone's review gates on-chain.
2. Add the cross-signing type properly (a hone `LedgerEntry` variant carrying a Ferryman `ledger.jsonl` line hash, or a signed Ferryman review envelope that hone can verify) rather than the memory-anchor shortcut from Phase 3.
3. Wire hone's manifest CI gate (`hone sync`, exits 2 on breaking) into the Ferryman adapter's CI so the integration never rots silently.
4. Only after the above: evaluate hone runtime hosting (`/api/runtime/*`) as a place to run Ferryman workers for redundancy.

## 6. Guardrails (non-negotiable on both sides)

Ferryman side — `docs/OPERATOR_BRIEF.md`:

- Read-only safety scan before any attach/update; stop on `FAIL`.
- Never change the main project Git remote; never weaken the channel `.stignore`; never make a GitHub repo public; never delete an old communications checkout during attach/update; never unregister while an outbox is non-empty.
- Never inspect/print/copy/rewrite secrets (`.ferryman/token`, `.env`, `HONE_API_KEY`, mnemonics).

hone side — `hone-bridge/PROTOCOL.md` + `GO_LIVE_CYCLE.md` + `CLAUDE.md`:

- Nothing to hone `main`, and no mainnet launch, without Shin's in-the-moment go-ahead; testnet only.
- Commit author = Shin Devlin, no AI attribution.
- No secrets (keys, seeds, PATs) in any channel, internal or external.
- Reward finalization requires real quorum ≥2; P2P zero-peer hardline: a zero-peer node rejects all user submissions.
- Gated/ambiguous/value-adjacent → leave unactioned, flag `reply_expected: true`, make sure Shin sees it.

Cutover guardrail: `FMN_LOG.md` is generated and single-writer (fang). During the Phase 1 transition, do not hand-edit it; treat it as the read-only source while Ferryman's `ledger.jsonl` becomes the new writer-side record.

## 7. Open questions to resolve before/at each phase

1. Phase 1: does the `hone-ferryman` Syncthing folder become the Ferryman channel root directly, or a new folder with a one-time migration of the 556 messages? (Recommendation: new Ferryman channel root; keep `hone-ferryman` as the archive until the exit criterion is met.)
2. Phase 2: who holds the hone account/API key for fleet-wide inference — one project account, or per-worker accounts for per-agent cost attribution?
3. Phase 3: is the public hone agent-task marketplace acceptable for real hone code work, or should public tasks be restricted to non-value, non-security work while private orders carry everything else?
4. Phase 5: where does the signed Ferryman review envelope live long-term — a new hone `LedgerEntry`, a LinkGit ref, or hone memory only?

_End of plan. Sources read: `hone/README.md`, `hone/CLAUDE.md`, `hone/docs/AGENT_INTEGRATION.md`, `hone/docs/AGENT_ORCHESTRATION_LAYER.md`, `hone/docs/AGENT_WORKFLOWS_PLAN.md`, `hone/docs/HONE_INTEGRATION_MANIFEST.md`, `hone/docs/NATIVE_PROTOCOLS.md`, `hone/rust/hone-node/src/{api.rs,agent_task.rs,agent_registry.rs,memory_service.rs,session_market.rs}`, `hone/rust/hone-node/crates/hone-types/src/entry.rs`, `hone/rust/hone-cli/src/main.rs`, `hone-bridge/{README.md,PROTOCOL.md,ORCHESTRATION.md,SYNCTHING.md,SCOREBOARD.md,GO_LIVE_CYCLE.md,nodes.md,worker-adapter/README.md}`, and `ferryman/{README.md, docs/{ARCHITECTURE.md,OPERATING_MODEL.md,AGENT_MODEL.md,PROJECT_MEMORY.md,WRITING_A_WORKER.md,COMMUNICATIONS.md,OPERATOR_BRIEF.md}, crates/ferryman-channel/src/{lib.rs,ledger.rs,master.rs,skills.rs,source.rs,learning.rs,worktree.rs,contract.rs}, crates/ferryman-cli/src/main.rs, crates/ferryman-server/src/lib.rs, crates/ferryman-worker-sdk/src/lib.rs, crates/ferryman-ops/src/{telemetry.rs,eval.rs}}`._