August 2026
commis shipped this month: a config-row spec (commis/v1), a roam execution bridge, peage metering (hold → capture → refund), hart delivery (the deliverable is the receipt), notify, cron scheduling with a reaper, and an approval channel you can answer from your phone — email, webhook, ntfy, Telegram, or cuzz. No hosted rail has a default host: nothing you install talks to anyone else's machine until you point it at one.
commis now conforms to all five cli-specs.intrane.fr conventions — output, guide, feedback, update, and telemetry. commis feedback reaches the operator even when the relay is down; commis update verifies a content hash, smoke-tests the download, and swaps atomically before ever touching the running binary.
Every one of these was found by running a real agent, not by writing a unit test: a weekly cron that silently never fired because the systemd timer never landed on the right minute; a PATH-based tool grant that a curious model bypassed on its own, twice, on two different rows; a delivery bug that shipped the wrong report the same day a fix landed. All four were found, fixed, and reshipped live the same day.
A live run discovered, unprompted, that PATH=/usr/bin:$PATH curl ... reaches any binary the host has, granted or not. commis never shipped a fix that half-solves this — the plan, README, and schema docs now say plainly that PATH raises the bar against an accident, not a boundary against a model actively trying to get out. Honest disclosure over a false sense of safety.
COMMIS_RUN_AS=<user> drops the worker process to a named unprivileged system user, narrowing what a misbehaving run can touch — no other user's files, no sudo. Unset by default; a misconfigured drop fails loudly instead of silently running as root. Found live: it doesn't compose with a row that genuinely needs root (a system-prune row), and that gap is now documented rather than discovered the hard way twice.
Settlement now prefers the provider's own observed cost (OpenRouter reports it) over the token-rate guess used everywhere else. Every settled receipt discloses which one happened — cost_basis: "observed" or "estimated" — so an operator billing a stranger's wallet is never quietly relying on a rate-table guess when the truth was available for free.
commis fire used to remove only the roster row — the hart delivery key, run receipts, and a persistent (paid) relais approval inbox all stayed behind forever. It now releases everything, including the one item with an ongoing bill, and reports exactly what it cleaned.
The last unverified claim in commis's whole design: does the approval gate actually stop a destructive command? Run for real on a production box, narrowly scoped to three apt cache files. Every rm was shown verbatim and approved individually before it ran; the deletions were confirmed against the real filesystem, and apt-get update regenerated everything cleanly afterward — proving the "lossless" claim rather than just asserting it.