Skip to content
PointSav Digital Systems

Revision as of · f76ce0d5

Historical revision — this record as it stood on 12 May 2026, not the current version. View the current record →

Totebox Session

A Totebox Session is an AI-assisted contributor session opened within a single Totebox Archive. It is scoped to the archive's declared repositories and cannot write outside them. From the contributor's perspective, opening a Totebox Session is how every development task in Totebox Orchestration begins. The session protocol mirrors the customer experience: the contributor's entry point in the workspace and the customer's entry point through os-console perform the same function.

This article describes how a session is opened, what it can and cannot do, the four permission tiers, and the inbox-and-outbox protocol that coordinates work across archives.

How to open a session

The intended entry point is bin/open-archive.sh <archive-name>, planned for invocation from the Command Session. When invoked, it is intended to:

  1. Read the archive manifest at clones/<archive>/.agent/manifest.md
  2. Print the archive name, tetrad status, AI gateway endpoint, and count of pending inbox messages
  3. Check the contributor's permission tier against the personnel record (see personnel-permissions)
  4. Set the FOUNDRY_ARCHIVE and FOUNDRY_MODULE_ID environment variables
  5. Open an AI session at the archive's root directory

This mirrors the customer experience: a community member or customer opens a Totebox Archive through os-console. The development workflow uses the same entry point, adapted for the workspace.

Session scope

A Totebox Session:

  • Writes to any repository declared in the archive's manifest
  • Commits to the archive's staging branch (never directly to the canonical main)
  • Routes inference through the shared service-slm access-control gateway using the archive's module identifier
  • Sends cross-archive requests as messages to the Command Session (never writes to other archives)
  • Stages wiki drafts in .agent/drafts-outbound/ for the editorial pipeline

A Totebox Session does not:

  • Write workspace files (CLAUDE.md, AGENT.md, bin/, pairings.yaml)
  • Write to the identity store
  • Access the canonical vendor/ or customer/ trees directly (those receive content by promotion, not direct write)
  • Open connections to sibling archive sessions

The Project Tetrad

Every Totebox Archive declares four legs of the Project Tetrad. A session's work contributes to all four:

Leg Session writes to
vendor Feature code in the archive's pointsav-monorepo clone
customer Operational guides in the archive's woodfine-fleet-deployment clone
deployment Provisioning the running instance in ~/Foundry/deployments/
wiki TOPIC draft files staged in .agent/drafts-outbound/

The Command Session ratifies tetrad completeness when all four legs are present.

The AI session coordination protocol

Sessions communicate through the inbox-and-outbox file protocol:

  • Each archive holds .agent/inbox.md and .agent/outbox.md files
  • A Totebox Session reads its inbox at session start and archives actioned messages
  • Outbound requests to other archives or to the Command Session are prepended to .agent/outbox.md (newest on top)
  • The Command Session sweeps cluster outboxes during workspace review and routes messages

In the planned next phase, app-orchestration-command (CommandCentre) is intended to broker all cross-archive messages by HTTP, with each message transiting the access-control gateway and the immutable ledger automatically. The file-based protocol is intended to remain as the fallback and the development-mode mechanism.

Permission tiers

Four tiers govern what a contributor — and the session they open — can do:

Tier Label Pairing set
P1 System Administrator Command + every archive + every infrastructure node
P2 Package Manager Specific archives plus Stage 6 promotion paths
P3 User Specific archives; no Command pairing; read-only cross-archive
P4 Interface Read-only API surface only

Tiers are enforced by pairings, not string comparisons. A P3 contributor's os-console is not paired to the Command — the connection does not exist. See pairing-as-permission for the formal mechanism.

Relationship to os-console

os-console is the customer-facing entry point for opening a Totebox Archive. In the workspace, bin/open-archive.sh is the equivalent. Both are intended to perform the same function: read the archive manifest, validate the contributor's permission scope, set the session context, and open a working session inside the archive. The development environment uses the same pattern the customer is intended to use.

See also

References

  • DOCTRINE.md — Foundry constitutional charter.
  • conventions/project-tetrad-discipline.md — ratified Project Tetrad specification.
Important Information

Important Information

Corporate structure. PointSav Digital Systems ("PointSav") is a trade name of Woodfine Capital Projects Inc. ("Woodfine"). PointSav does not itself offer, sell, or solicit any security. Any securities offering associated with Woodfine's real-property direct-hold solutions is made exclusively by Woodfine, and only by means of the applicable Private Placement Memorandum.

No investment advice. This wiki's content is provided for engineering, operational, research, and development purposes. Nothing on this wiki constitutes investment advice or a solicitation to invest in any Woodfine partnership or direct-hold solution.

Intellectual property. The PointSav name, trade name, wordmark, and marks, together with all current and future PointSav- and Totebox-branded products, services, and offerings — and the software, source code, documentation, design system, and all related materials — are proprietary to Woodfine and its affiliates, except for components identified as open source. No rights are granted except as expressly set out in a written license or agreement. See TRADEMARK.md in this repository for the full trademark notice.

Open source components. Portions of the platform are made available under permissive open-source licenses identified in the accompanying repository. Use of those components is governed by their respective license terms.

No warranty; informational use. Content on this wiki is provided for general informational purposes only and does not constitute a representation, warranty, or commitment with respect to product functionality, availability, pricing, or roadmap. Some articles describe planned or intended features, capabilities, and milestones — language such as "planned," "intended," "targeted," "may," and "expected" marks this forward-looking content, which is subject to change and does not constitute a commitment regarding future performance.

Confidentiality. Where an article describes an operational or deployment detail that is not intended for public disclosure, that article is not published on this wiki. Content here is general-purpose engineering documentation, not customer-specific configuration.

Jurisdiction. Woodfine Capital Projects Inc. is organized in British Columbia, Canada. References to the Sovereign Data Foundation on this wiki describe a planned or intended initiative only, not a current equity holder or active governance body.

Changes to this notice. PointSav may update this notice from time to time; the version posted on this page governs.

Not a filing system. This wiki is not a securities filing system, an electronic disclosure repository, or a substitute for SEDAR+ or any other regulatory filing system. Formal securities filings are made through the applicable regulatory filing system, not through this wiki.

Full disclaimer. This notice supplements, and does not replace, the full Disclaimers article. In the event of any conflict, the full Disclaimers article governs.

Read the full disclaimer →