88%

Ownership Contract and Capability Delta

Goal

  • Pin the AI OS as an evolution of harness_dist and define every cross-plan boundary before implementation.

Files

  • MODIFY scripts/harness_dist/api.py
  • CREATE scripts/harness_dist/ai_os_contracts.py
  • CREATE scripts/harness_dist/schemas/ai_os_contracts.schema.json
  • CREATE scripts/project_research_runtime/project_profile.schema.json
  • CREATE scripts/harness_dist/release_manifest.schema.json
  • MODIFY plans/workflow-engine-rework/plan.json through plan_corpus writers
  • MODIFY plans/workflow-engine-rework/content/root-closure-arbitrary-depth-invocation--s-be712e10.md through plan_corpus writers
  • MODIFY plans/workflow-engine-rework/content/root-closure-durability-recovery--s-7aad8aa5.md through plan_corpus writers
  • MODIFY plans/harness-dist-rollout/plan.json through plan_corpus writers
  • CREATE scripts/harness_dist/tests/test_ai_os_contracts.py

Work Items

  • Register cross-plan route gates — FIRST, before any other work item in this section — via the existing plan_corpus binding_constraints mechanism (write.py:binding_constraint_append, consumed by route_walk.dossier_constraint_violation_or_none / detectors/dossier_constraint_violation.py) that block workflow-engine-rework’s bundle-materialization work items in s-be712e10 and s-7aad8aa5, and block harness-dist-rollout consumer mutation, until the shared StoreReference contract and AI OS parity receipts are complete; never invent a parallel gate mechanism.
  • Inventory existing harness_dist fingerprint, pin, migration, project-detection, overlay, provider-category, and mutation-gate capabilities in one machine-readable capability delta.
  • Define canonical ProjectProfile and ReleaseManifest schema contracts, then define ProjectPin, ResolvedOverlay, AdapterProjection, ProviderProbeReceipt, and StoreReference in ai_os_contracts.py with aggregate $ref links instead of duplicate definitions.
  • Make harness_dist the sole release-byte publication/store/GC owner; make workflow-engine-rework persist typed StoreReference values and expose authoritative active/pending-root reference enumeration without materializing a second bundle store.
  • Rewrite workflow-engine work items in root-closure-arbitrary-depth-invocation—s-be712e10.md and root-closure-durability-recovery—s-7aad8aa5.md through sanctioned plan-corpus operations to consume StoreReference rather than materialize bundle bytes; align their criteria and route gates.
  • Map harness-dist-rollout work items w-6f28a1b0, w-b8fc0701, w-7e068f54, w-840eb091, w-92773487, and w-4dfa3ad1 to their AI OS successor gates without changing their explicit live-project authorization requirements.
  • Add boundary tests rejecting direct plan writes, duplicate project detectors, workflow transitions in harness_dist, and install-state mutation from workflow adapters.

Verification

  • Write failing positive, negative, interruption, concurrency, and idempotency cases before implementation.
  • Pin the consumer-visible outcome through the real CLI/runtime entry point.
  • Run focused pytest and the owning runtime self-test with a 150-second test timeout.
  • Run python -m scripts.harness_dist verify --root . when distributed artifact classification changes.

Fresh intel (regenerated)

This section is the architectural lock for the entire 10-section AI OS plan, not a schema-authoring chore. It ships almost NO runtime behavior — its deliverable is a set of ownership boundaries, five typed contracts, and cross-plan route gates. The graph makes three things decisive:

  1. harness_dist already OWNS every capability the AI OS is told to reuse. The inventory work item (w-3ce61ec0) names seven capabilities; all seven are live, well-tested symbols in scripts/harness_dist/ today: fingerprint (recorded_fingerprint.py + version-fingerprint.json), pin (version.py:read/write_consumer_pin), migration (version.py:harness_migrate_or_refuse + migrations/), project-detection (project_detect.py:detect_project_type), overlay/dist-class (classify.py:derive_dist_class), provider-category (classify.py category resolution), and the mutation-gate (apply.py:guard_not_canonical + manual_invocation_guard.py). The contract’s job is to EXTEND these, never fork them (mission Evolution Boundary: “Do not create a parallel installer, fingerprint system, project detector, or plan writer”).

  2. [JOIN] There is a genuine DUAL content-addressed store on a collision course. The workflow-engine-rework spec plans its OWN bundle_store.py — “immutable content-addressed engine bundles” (workflow-state-machines.md:2185, :1119, :2360) — while this section (w-ea1da06f) declares harness_dist the SOLE release-byte store owner and forces workflow-engine to persist only a typed StoreReference. scripts/workflow_engine/ exists on disk but is a skeleton (no bundle_store.py, no RootClosure, no StoreReference yet), so the collision is preventable — but ONLY if this section lands the StoreReference contract + w-3f91c5f3’s rewrite of the two workflow-engine sections BEFORE workflow-engine builds bundle_store.py. Two content-addressed stores for the same bytes is a live LEAK:algorithmic-duplication the design exists to foreclose.

  3. The cross-plan route-gate mechanism the section needs already exists — reuse it. w-301d873f (“cross-plan route gates that block workflow-engine bundle materialization … until the shared StoreReference contract … [is] complete”) maps exactly onto the shipped scripts/plan_corpus/binding_constraints.py + detectors/dossier_constraint_violation.py + route_walk.dossier_constraint_violation_or_none primitive, and the plan_corpus/write.py:binding_constraint_append sanctioned op. The section must consume that route-gate machinery, not invent a parallel gate.

Decisions this package forces before any code is written:

  1. Read the two workflow-engine sections + the workflow-state-machines spec bundle-store region FIRST (s-be712e10, s-7aad8aa5, spec :1119/:2185/:2360). The StoreReference contract must be shaped to retire bundle_store.py, not coexist with it.
  2. Every new contract mirrors the existing typed-contract shape (classify.py Asset / Manifest / SyncConfig / SyncReport dataclasses + ManifestError) and the existing schema shape (config_schema.json / manifest_schema.json, $schema/$id/$ref). The w-3cc8dcb9 “aggregate $ref links instead of duplicate definitions” directive IS the anti-duplication constraint at schema level.
  3. Extend the canonical capabilities; never duplicate them. detect_project_type is the SOLE project detector (w-d48f513e boundary test explicitly rejects a duplicate detector); guard_not_canonical + manual_invocation_guard.evaluate are the mutation gate the boundary tests must PRESERVE, not weaken.
  4. All workflow-engine + harness-dist-rollout edits go through sanctioned plan_corpus writers (write.py), never hand-edited .md/plan.json. w-5ac49b5a must preserve the 6 rollout work items’ USER-AUTHORIZED live-project-mutation semantics unchanged.
  5. Touch nothing on the live self-hosting execution path (route_walk.serve_next_v7, commit_push.state_machine.run_state_machine, resume_manifest.build_manifest) — this plan executes THROUGH that path; editing it mid-plan mutates the run’s own substrate.
["guard_not_canonical", "evaluate", "detect_project_type", "harness_migrate_or_refuse", "serve_next_v7", "run_state_machine", "build_manifest"]

DIG DEEPER

python -m scripts.plan_corpus.read --summary plans/ai-os-platform
sed -n '1,31p' plans/ai-os-platform/content/ownership-capability-delta--s-08f4833c.md
sed -n '1,24p' plans/ai-os-platform/mission.md

(full dossier: ownership-capability-delta—s-08f4833c.intel.md)