Require --ai-thread at start: thread-keyed registry, reuse-instead-of-respawn, per-thread snapshots

by adom

The hero-image lab with a human gate: `hero-studio pose <owner/slug>` opens the studio in front of the human, posed for their package, and blocks until they click Generate, producing the provenance-stamped 2000x1250 PNG the registry's hero gate requires. The image carries the title and artwork; the exported image also bakes the type pill (top right) and full wiki slug (bottom right); the page shows the hero bare, and only the homepage marquee overlays its own dynamic info. Every hero wears its P

Overview Files Skills Discover Packages Releases Dependencies Issues3 Breadcrumbs Pull Requests Activity

Closed general

John Lauer · 2mo ago ·closed by Colby Knox

Same 2026-08-11 field report as the idle-shutdown issue: of 13 accumulated instances, adom/pup-bridge had THREE separate studios and two other pages had two each, because a thread that forgets its own studio just spawns another. Worse, all instances share one generated/state-snapshot.json, so 13 debounced writers clobbered each other and one studio (port 8856) ended up posing adom/pup-bridge while wearing an adom-desktop-puppeteer-bridge approval record. The in-memory isolation that #15 built multi-instance for does not exist at the persistence layer.

Proposal, following the caller-identity pattern ab and pup bridge already use (identity is self-reported attribution, never authorization):

hero-studio start requires --ai-thread "". State-changing HTTP calls carry X-Adom-Thread (or a top-level aiThread field); anonymous calls get a teaching refusal (errorCode caller_identity_required) whose hint shows the exact retry, so the calling AI self-corrects on the next call.
Each instance writes a registry entry (~/.adom/instances/hero-studio/.json: pid, port, thread, page, version, lastActivity). hero-studio ls lists live studios, prunes dead pids, and flags version drift against the on-disk package (the stale-fleet failure above).
start with a thread that already has a live instance prints "already running on port NNNN, use that one" and exits instead of spawning. A different thread posing the same page gets a warning.
Snapshots become per-thread files, which fixes the shared-snapshot clobber outright.

Full pattern spec with refusal payloads and a Node reference implementation: the app-creator-server-lifecycle sub-skill on the App Creator page.

1 Reply

Colby Knox · 2mo ago

Shipped in 0.17.0, following the settled ai-thread contract (app-creator-ai-thread-name):

--ai-thread required at start (teaching refusal at boot without it) and on every state-changing call: the CLI takes the global flag before any verb and merges a top-level aiThread field into every POST; anonymous POSTs get errorCode caller_identity_required with the exact retry in the hint. Read-only verbs and GETs stay open. The studio PAGE attributes its own posts to the owning instance's thread automatically (served in GET /state), so the human clicking checkboxes is attributed correctly. Accepted calls log as thread "": POST /path in the console ring.
Registry at ~/.adom/instances/hero-studio/.json (pid, port, thread, task, version, startedAt, lastActivity), refreshed every minute. hero-studio ls lists live instances, liveness-checks pids, prunes dead entries, and flags version drift against the on-disk package with the exact stop command.
Reuse instead of respawn: starting with a thread that has a live instance prints "OK: already running on port N ... Use that instance." and exits 0; pose does the same (adopts the thread's existing port) and warns when a DIFFERENT thread is already posing the same page.
Snapshots are per-thread files under ~/.adom/instances/hero-studio/snapshots/. Verified live: thread A's headline+theme survive a stop/restart; thread B starting fresh gets clean defaults; the shared-file clobber (your port-8856 wrong-approval case) is structurally impossible now.

Also --port auto (OS-picked port, real port in the boot line and registry). Identity remains attribution only, never authorization.