[ ] 16741 Wake delivery over the ingress for clients without host-reachable listeners, [x] 16735 Fleet control service joins the composition — optional fleet-server (Fleet-owned root + registered projections), [x] 16743 Wire-only Fleet client contract — versioned vocabulary, zero trust imports, [ ] 16742 Client connection broker — successor to #14574 (profiles + credential custody, three custodian shapes)
blocking
[]
milestone
Agent OS extraction wave
Harness demotion — dissolve loadFleetRuntimeContracts; FM stops supervising the organism
Harness demotion — dissolve loadFleetRuntimeContracts; FM stops supervising the organism
Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). The harness demotion path — FM stops being an organism supervisor. Parent: #13377 (the OPEN Electron shell Epic — shell/main-process hosting, packaging, distribution; #13033 is its closed build-root spike; cycle-4 one-cell correction).
Context
harness/brain.mjs's loadFleetRuntimeContracts imports TRUST primitives from the host checkout's ai/ tree — tree ≠ organism post-hard-cut (the founding falsifier of D#16720). The attach-or-own machinery (#16694/#16696/#16711) stops being the cockpit's runtime identity; "boot a local plane" convenience belongs to packaging/bootstrap.
Empirical reinforcement (2026-08-09): the first live-cockpit receipt (#16694, IC_kwDODSospM8AAAABN80VQw) ran the cockpit as a PURE client — transport supplied externally, bearer injected via the worker-realm seam, plane-mode seams verified — and every surface rendered honest states. The demotion this ticket executes is the codification of a topology that already works.
Acceptance Criteria
Blast-radius inventory FIRST (pre-implementation, blocking): file-count, topology inventory (which seats/flows run the checkout-import path today), sequencing plan — the one sub where "how many things break, in what order" was unanswered at graduation.
Dissolve loadFleetRuntimeContracts client-side (C2's SDK home + C1's broker replace its consumers); no checkout-tree trust imports remain in the shell.
ADR 0020 §§3–4 amendment points implemented per the D1 ADR (in-process-target + fleet-lifecycle-owns-restarts amended for the pure-client cockpit).
Packaged own-mode fate executed per the recorded OQ3 position (bundle = organism, Body-first boot, truth-rendering throughout).
Sequenced LAST: lands only after the remote-only journey AC is proven (cockpit on a no-checkout machine: connect, roster, wake — zero local ai/ imports).
The Contract Ledger below holds at retirement time: every row's terminal replacement exists, its failure behavior is witnessed, and the row-4 ratchet is flipped in the same PR that dissolves the surface.
Contract Ledger (T3)
(Added 2026-08-09 per intake IC_kwDODSospM8AAAABN7pzpw — all anchors verified at current origin/dev before writing.)
#
Surface (live anchor)
Source of authority
Terminal replacement
Failure / degraded behavior after retirement
Docs / JSDoc disposition
Executable evidence
1
loadFleetRuntimeContracts (harness/brain.mjs:54–76) + probeFleetServing (brain.mjs:407–415) — dynamic-imports FIVE members from the checkout ai/ tree: normalizeAgentIdentityNodeId (ai/graph), probeExistingFleetServer + resolveFleetBearer (fleetLaunchContract), FLEET_WIRE_METHODS + FLEET_CREDENTIAL_METHODS (fleetWireMethods)
ADR 0038 §2.1 ("never imports runtime trust primitives from a checkout") + D#16720 founding falsifier
Split by member nature: the three TRUST primitives dissolve client-side — credential custody moves to C1 #16742's broker, identity normalization + probe/reuse semantics stay plane-side behind the wire; the two VOCABULARY members ship from C2 #16743's SDK home as versioned client vocabulary (the app-side twin apps/agentos/config/fleetWireMethods.mjs + parity lint already prove the split is real)
A missing SDK vocabulary is a build-time import failure, never a runtime checkout probe; the shell boots to honest-offline connection states — no silent supervisor fallback, no tree-reads
brain.mjs module summary rewritten to client-topology language; the ADR 0020 §§3–4 amendment points (already textually amended by PR #16752) implemented in code
Row-4 ratchet flip + a negative import witness over harness/** (zero ai/ specifiers) + the remote-only journey proof as the terminal gate
2
harness/main.mjs consumers: resolveFleetBearer({suppliedToken}) at :81; FLEET_CREDENTIAL_METHODS at :443 (preload-ingress credential classification); FLEET_WIRE_METHODS at :448 (IPC proxy allowlist)
:81 → C1 #16742 broker (Electron-main custodian shape; process-bearer coordination demotes to packaging/bootstrap ownership per #16694/#16708); :443/:448 → C2 #16743 SDK vocabulary import — the SAME published source, never an inferred local trust twin (server authorization never reconstructed client-side)
Protocol/vocabulary skew renders CLOSED "unsupported" response states per ADR 0038 §2.8 capability negotiation — never a guessed method list, never a widened credential classification; broker-unavailable renders the honest-offline ladder
main.mjs header rewritten; the credential-matrix pointers re-anchored to ADR 0038 §2.5.1 (the S6 ledger, PR #16762)
lint-fleet-vocabulary-parity extended to pin the SDK home as the third parity leg; broker/adapter unit witnesses for the custodian shape
3
Packaged local bootstrap vs remote-only client profile
ADR 0038 §2.7 profiles table + the recorded OQ3 position (bundle = organism, Body-first first-render)
Bootstrap ownership lands in packaging/bootstrap (the #16708 self-supply mechanics are its harness-path precedent); the cockpit's runtime identity is CONNECT-only in every profile
No-checkout machine: the remote-only journey (ADR 0038 §2.8 AC) — connect to a plane, render the plane-owned roster, working wake story (S7 #16741), zero local ai/ imports; first render is truthful in all states (zero-state → live → degraded ladder)
RunningTheFleetCockpit.md gains the packaged-profile section when the own-mode fate executes; OQ3 position text carried in ADR 0038 §2.7
The #16694 live receipt already witnesses the honest-states ladder renderer-side; the remote-only journey witness (no-checkout machine) is the terminal proof this ticket waits for
4
test/playwright/unit/harness/pack.spec.mjs:140 — today a POSITIVE witness: expect(mainSource).toContain('loadFleetRuntimeContracts(organismRoot)'); plus the packaged-modules list at :131–139
The pack spec is the packaging contract's executable statement
The SAME assertion flips negative in the retirement PR: not.toContain('loadFleetRuntimeContracts') + a directory-walk negative import witness asserting no harness/** module imports any ai/ specifier; the packaged-modules list drops dissolved files in the same diff
A regression that re-introduces a checkout trust import fails unit CI mechanically — the guard is the ratchet, not reviewer diligence
Spec-level comment names ADR 0038 §2.1 as the ratchet's authority
The flipped spec IS the evidence; runs in unit CI on every push
Sequencing
TERMINAL sub — blocked by the remote-only journey (C1+C2+S1+S7 composition). S1 #16735 closed COMPLETED (PR #16761 merged @ 92c0a49fda); #16741, #16742, #16743 remain open (C2 #16743 unblocked as of 2026-08-09, PR #16728 merged).
Signal Ledger
Family-keyed at D#16720 final filed state (body v12 @ 2026-08-08T19:52:47Z; post-close repair @ 20:01:01Z): fableAUTHOR_SIGNAL + APPROVED (re-bound) · OpusAPPROVED (re-stamped, blockers verified closed) · GPT[GRADUATION_APPROVED] at the filed state. Full ledger: D#16720 closing comments.
Unresolved Dissent
None open — the graduation's GPT DEFERRED closed at the filed state; no dissent touches C5 scope. (Stale "re-stamp pending" prose truth-folded 2026-08-09 per intake.)
Unresolved Liveness
@neo-gemini-pro benched; Kimi engaged in D#16720 as seat witness without a final-anchor signal — recorded, never implied consent.
Harness demotion — dissolve loadFleetRuntimeContracts; FM stops supervising the organism
Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). The harness demotion path — FM stops being an organism supervisor. Parent: #13377 (the OPEN Electron shell Epic — shell/main-process hosting, packaging, distribution; #13033 is its closed build-root spike; cycle-4 one-cell correction).
Context
harness/brain.mjs'sloadFleetRuntimeContractsimports TRUST primitives from the host checkout'sai/tree — tree ≠ organism post-hard-cut (the founding falsifier of D#16720). The attach-or-own machinery (#16694/#16696/#16711) stops being the cockpit's runtime identity; "boot a local plane" convenience belongs to packaging/bootstrap.Empirical reinforcement (2026-08-09): the first live-cockpit receipt (#16694, IC_kwDODSospM8AAAABN80VQw) ran the cockpit as a PURE client — transport supplied externally, bearer injected via the worker-realm seam, plane-mode seams verified — and every surface rendered honest states. The demotion this ticket executes is the codification of a topology that already works.
Acceptance Criteria
loadFleetRuntimeContractsclient-side (C2's SDK home + C1's broker replace its consumers); no checkout-tree trust imports remain in the shell.ai/imports).Contract Ledger (T3)
(Added 2026-08-09 per intake IC_kwDODSospM8AAAABN7pzpw — all anchors verified at current
origin/devbefore writing.)loadFleetRuntimeContracts(harness/brain.mjs:54–76) +probeFleetServing(brain.mjs:407–415) — dynamic-imports FIVE members from the checkoutai/tree:normalizeAgentIdentityNodeId(ai/graph),probeExistingFleetServer+resolveFleetBearer(fleetLaunchContract),FLEET_WIRE_METHODS+FLEET_CREDENTIAL_METHODS(fleetWireMethods)apps/agentos/config/fleetWireMethods.mjs+ parity lint already prove the split is real)brain.mjsmodule summary rewritten to client-topology language; the ADR 0020 §§3–4 amendment points (already textually amended by PR #16752) implemented in codeharness/**(zeroai/specifiers) + the remote-only journey proof as the terminal gateharness/main.mjsconsumers:resolveFleetBearer({suppliedToken})at:81;FLEET_CREDENTIAL_METHODSat:443(preload-ingress credential classification);FLEET_WIRE_METHODSat:448(IPC proxy allowlist):81→ C1 #16742 broker (Electron-main custodian shape; process-bearer coordination demotes to packaging/bootstrap ownership per #16694/#16708);:443/:448→ C2 #16743 SDK vocabulary import — the SAME published source, never an inferred local trust twin (server authorization never reconstructed client-side)main.mjsheader rewritten; the credential-matrix pointers re-anchored to ADR 0038 §2.5.1 (the S6 ledger, PR #16762)lint-fleet-vocabulary-parityextended to pin the SDK home as the third parity leg; broker/adapter unit witnesses for the custodian shapeai/imports; first render is truthful in all states (zero-state → live → degraded ladder)RunningTheFleetCockpit.mdgains the packaged-profile section when the own-mode fate executes; OQ3 position text carried in ADR 0038 §2.7test/playwright/unit/harness/pack.spec.mjs:140— today a POSITIVE witness:expect(mainSource).toContain('loadFleetRuntimeContracts(organismRoot)'); plus the packaged-modules list at:131–139not.toContain('loadFleetRuntimeContracts')+ a directory-walk negative import witness asserting noharness/**module imports anyai/specifier; the packaged-modules list drops dissolved files in the same diffSequencing
TERMINAL sub — blocked by the remote-only journey (C1+C2+S1+S7 composition). S1 #16735 closed COMPLETED (PR #16761 merged @ 92c0a49fda); #16741, #16742, #16743 remain open (C2 #16743 unblocked as of 2026-08-09, PR #16728 merged).
Signal Ledger
Family-keyed at D#16720 final filed state (body v12 @ 2026-08-08T19:52:47Z; post-close repair @ 20:01:01Z): fable
AUTHOR_SIGNAL+APPROVED(re-bound) · OpusAPPROVED(re-stamped, blockers verified closed) · GPT[GRADUATION_APPROVED]at the filed state. Full ledger: D#16720 closing comments.Unresolved Dissent
None open — the graduation's GPT DEFERRED closed at the filed state; no dissent touches C5 scope. (Stale "re-stamp pending" prose truth-folded 2026-08-09 per intake.)
Unresolved Liveness
@neo-gemini-pro benched; Kimi engaged in D#16720 as seat witness without a final-anchor signal — recorded, never implied consent.
Discussion Criteria Mapping
D#16720 criteria (1)–(9): closing comment.
Origin: D#16720 · Retrieval Hint: "harness demotion dissolve loadFleetRuntimeContracts blast radius remote journey last"