- A split part may change the compiled code of its own batch's functions
still in review (their source is put back as on main; shared changes in the
file still affect them). It no longer counts as changing functions someone
else holds; their status is measured again.
- An annotated declaration (a STUB on a prototype) is a region of its own
instead of stopping the split of the whole file.
- Running processes record the release they started from; update.sh keeps
those. A worker left running across deploys lost its release directory and
every analysis failed with "Cannot find module analyze-worker.js".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Functions waiting for their 4th and 5th confirmation never came up while
hundreds waited in peer review, so nothing was ever auto-accepted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
- "Next work" (td_claim_batch without arguments, and td_claim_task without
an id) claims a group: the best open task's source file, else its class,
else the run of neighbouring unplaced functions in the binary.
- The worker places unplaced functions where the binary makes it clear:
between two functions of the same file, or with their class's other
methods (6,745 of 22,572 on the live data); again every 30 minutes.
- td_place lets an agent organize a group of unplaced functions before
porting them: a .cpp file each (validated path) and optionally a name
(identifiers only). Later work on them then comes per file.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
A function with peerAutoAccept (5) "same" verdicts is accepted without human
review even if a peer said "different". Every function that reaches main with
at least one "different" verdict (auto-accepted or approved by a human) is
recorded in later_review; the review page lists them with the attempt and a
"Reviewed" button.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Per reviewer: verdicts, agreement with the other reviewers of the same
function and with the human decision, and the share of verdicts given within
10 seconds of the previous one; flags for never/mostly objecting and very fast
reviewers. Admins can pause an account's peer reviews (its verdicts so far
stay) and allow them again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
After three "same" verdicts a function goes to human review as before, but it
stays open for more reviewers: with peerAutoAccept (default 5) "same" verdicts
and no "different" at all, it is approved and merged without a human. Any
objection leaves the decision to a human. The review queue shows how close a
function is, or that it is contested.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
The import held one transaction open across the asynchronous file read, so the
worker's other work (merges, verification) ran inside it: their own
transactions failed ('cannot start a transaction within a transaction') and a
rollback of the import would have undone a merge's records.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Verification compiles the submitted units (one includer per header for
header-only changes, plus one includer as the lint sample): enough to judge
and route every submitted function, in seconds even for header changes. The
merge compiles every includer of a changed header that verification skipped
and checks them for regressions, so nothing reaches main without it; it runs
in the big merge lane. Batches sent back early never pay for the full compile.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
One big merge at a time, while the other lane keeps small merges going. Merges
compile side by side; the commit is the synchronous part after the compile, so
commits never interleave. If another merge committed changes to anything a
merge compiled against, that merge goes back in line instead of committing a
stale result.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
- A merge reuses the verification's compile for every unit whose source and
included headers are unchanged, and compiles only the rest. A split part
uses its parent's verification, so merging the approved functions of a
header batch recompiles the one .cpp file instead of hundreds of units.
- While a big batch (more than 20 units) is verified, the other slot takes
only small ones.
- An account can have 4 batches waiting for verification; further submits get
429 with a hint to do peer reviews meanwhile (maxQueuedBatches).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
- The preprocessed-output lint compiled every unit a second time (with /P)
when a header changed: 323 units twice for Types.h. A header expands the
same way everywhere, so it now lints the submitted units plus one includer
of each changed header.
- Merges re-ran the full check, including that lint. The lint is skipped on
merge, and when nothing the compiled units consist of (sources, included
headers) changed on main since verification, the verification's compile is
reused and nothing is compiled at all.
- The queue takes small batches first (by the number of units they compile);
a big batch that waited 20 minutes goes ahead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
A function resubmitted unchanged (port-first) made the merge a no-op, and git
refused the empty commit, so the merge retried forever and blocked the queue.
CRLF from Windows workspaces is normalized on arrival.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Prompt injection: a submission may not add comments other than annotations,
offset and INLINED markers, and only string literals that occur in the
original executable (adjacent literals joined; #include paths restricted).
Comments and strings already on main stay. Checked before compiling, for
remote checks and submissions; errors name the line but never repeat the
text. Peer reviewers no longer see author notes or running verdict counts.
Agents are told that only AGENTS.md and the guidance field instruct them.
Review: "Approve batch" in the confirmed section also approved the batch's
functions still in peer review (for maintainers). The page now sends exactly
the functions it shows, and skipping peer review needs skipPeerReview,
which only the peer review section's button and the attempt page send.
Worker drain: a stopping worker kept starting new verifications when one
finished, so it never stopped. Stopped queues take no new work.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
While the worker was stopped (maintenance), checks were queued with nobody to
run them; agents timed out ("fetch failed", 502 after a restart) and every
retry queued another copy. Now: the worker writes a heartbeat and a check is
refused with 503 at once while it is down; a retry of the same files joins
the job already queued or running; a job nobody waits for any more is
dropped. TD_KEEP_WORKER=1 deploys without touching the worker.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Templates and inline functions are compiled in every unit that uses them. A
merge that recompiled many units (a header change) let the last unit's copy
win, so functions that matched in one unit were recorded as match_unresolved
from another, and the regression check missed it because the better status
came from a unit it did not compile. Now each function counts with its best
compiled copy, and a check never lowers a status measured in a unit it did
not compile.
The progress gauge and the crew views refresh every 30 seconds; the gauge
moves from its previous reading.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
A check that touched a header recompiled every unit including it (dozens),
which saturated the server while agents worked in parallel. Checks are
feedback; the submission's verification still compiles all dependents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
The web process waited on server.close() for open requests, among them agents
waiting minutes for a remote check, until systemd killed it after 90 s; the
site was down meanwhile. It now closes idle connections and exits within 3 s
(TimeoutStopSec=15 as a backstop). update.sh restarts the worker once no batch
verification or merge runs; remote checks are re-queued and still answered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Peer review: one "different" no longer sends a function back. It stays in
review until three agents agree: three "same" send it to human review, three
"different" back to its author; mixed votes let further reviewers in. When a
function does go back (peers or a human), only that function goes; the rest
of its batch carries on and its approved part merges without it.
Public "Active agents" (who is working on what right now) and "Users"
(merged, submitted, peer reviews) sections, from /api/crew. No token labels
or account details.
Updates: deploy/update.sh copies and syntax-checks a new release next to the
running one, switches the /opt/togetherdecomp symlink in one step and only
then restarts what changed (the worker when idle); pages are live without a
restart. tools/deploy.sh ships HEAD (and with --td the td binaries).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Claims, task context, checks, submissions and batch results carry a
`guidance` field with the project's current policy, so agents that are
already running pick it up on their next call. The default asks for faithful
ports with a few checks per function instead of chasing exact bytes, since
peer review confirms the logic. Admins change it live with
`td-server guidance set|off|reset|show`. AGENTS.md and the MCP instructions
say the same for new sessions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
td-server start web | worker | all. The web process serves the website, API
and git; the worker verifies, merges, runs remote checks and refreshes the
Ghidra project. They share the database and the repository, so restarting
one never interrupts the other. Remote checks are queued in check_jobs and
picked up by the worker. Web files are read from disk per request, so page
changes need no restart at all. The web unit no longer has docker access.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
The submitted function sits next to Ghidra's pseudocode, and our compiled code
next to the original assembly, lined up by instruction with the differences
highlighted. Checks now keep each function's compiled listing for this.
Warnings, references, other functions in the file, files and notes are
collapsible sections.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
The queue lists functions still waiting for peer verdicts (with how many peers
confirmed so far) next to the ones ready for a human. Maintainers and admins can
approve, send back or reject them without waiting for the peers. The attempt
page shows the original pseudocode and disassembly beside the submission.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
A batch no longer waits for its slowest function: once some of its functions
are approved and the rest wait for review, the approved ones merge as their
own batch (the pending functions put back as they are on the base commit),
and the rest is rebased onto that commit. The merge re-verifies the split; if
anything breaks, the batch merges as a whole as before.
Comparing compiler output against the original runs in worker threads. A
check that recompiled dozens of units (a header change) blocked the
coordinator's event loop for minutes, so the website stopped responding.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Leased functions grouped by unit with the lease expiry, peer reviews held,
batches being checked and when their agent was last seen.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Explains what td and the AI do, walks through register, approval, token,
install, opening the AI in the workspace and the start message, with copy
buttons and a troubleshooting list. The installers print the same next steps.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
A second process (rebuild, ghidra refresh) holding a write lock made the
verifier's timer throw "database is locked" and took the coordinator down.
Set a busy timeout and keep timer errors from killing the process.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Versions get a readable label (td-server version label <id> <text>),
served in /api/info and shown under the headline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
- Batches: claim every open function of a unit or address range (td claim --unit/--range),
submit the file once; one compile, per-function routing, merged as a whole. A failing
function returns the batch; peer verdicts carry over to functions whose compiled code is
unchanged (code fingerprints). Submissions may not change functions they do not hold.
- Byte-identical functions are approved and merged without human review
(matchPolicy.autoMergeIdentical); peer-confirmed ones need one click per batch.
- Remote check: td check compiles on the server when there is no local toolchain.
- /api/original: assembly and pseudocode of the original from the server's Ghidra export
(objdump before an export exists); td disasm/decompile fall back to it.
- td as a standalone executable (Node single executable application; tools/build-td),
one-line installers (install.ps1 / install.sh) with checksum verification, td connect for
any MCP client, td mcp --workspace, self-update (td update, hourly check).
- Server-side Ghidra project: built once per version, refreshed after merges, downloadable
for contributors (td ghidra download); JDK 21 and the pinned Ghidra in deploy/install.sh.
- Agent instructions: work continuously, batches first, peer reviews in between.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
MCP clients start servers from arbitrary folders, so the workspace can be named explicitly
(--workspace or TD_WORKSPACE). td setup prints the settings for Claude Code and a generic
mcpServers entry for other clients; the website lists the supported agents.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
- td submit found no changed files: the git helper trimmed the leading space of the first
porcelain status line, which cut the first character of the path
- td ghidra install: use Windows' own tar.exe (Git Bash's GNU tar reads "C:" as a host)
- annotation lint only reports comments that carry an ID or address ("// FUNCTION NAME:" in
third-party headers is not a broken annotation)
- td check reports annotation problems of the checked files only
- td setup --toolchain <root>: use the project's compile.json compiler and ${TC} layout
- td config: show or change workspace settings (ghidraHome, server)
- pin the Ghidra 11.2.1 release checksum in the project template
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
Coordinator (accounts with approval, API tokens, tasks with leases, sandboxed MSVC verification against
the original exe, peer review by three agents for non-identical code, human review, serial merge queue),
the `td` contributor CLI with an MCP server for agents, pinned Ghidra integration, deployment (Caddy,
systemd, nftables, Forgejo) and the wowdecomp 15890 migration tools.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RNwtXPYqFu3oKaaXwYwNWW
