Record the C′ AgentOS extraction topology

Context

Epic #17500 graduates D#17489 into a one-week first-wave AgentOS extraction. The converged C′ shape is architectural authority, but it is not yet recorded in the durable Decision Record series.

ADR 0039 establishes the Brain-internal Cloud/Host-Edge executable boundary inside today's repository. The corrected C′ fold realizes that boundary as package topology in one new repository whose name remains unresolved: the repository root is the Host-Edge package, cloud/ is an independent nested package, npm workspaces are forbidden, and a pure shared/ package is conditional on inventory proof.

This is a one-PR leaf: it records the decision and its revalidation/retirement conditions. It moves no runtime code.

The Problem

Without an ADR, the extraction's load-bearing decisions remain distributed across a long Discussion and Epic body:

• why one repository wins the first wave and why its concrete name requires a separate registry/in-market disposition;
• why root Host Edge and nested Cloud require independent package/install roots with no npm workspaces;
• why package omission is not isolation while workspace hoisting can resolve Cloud dependencies;
• why AgentOS→published Engine is the only dependency direction;
• why runtime root and target checkout root are separate authorities;
• why apps and published learn/agentos content stay Engine in wave one;
• which pre-move proofs and cutover gates block relocation;
• why no historical neomjs/neo SHA changes.

A later migration PR could otherwise choose a locally convenient workspace, root script, or cwd fallback and still appear consistent with one fragment of the conversation.

The Architectural Reality

• ADR 0039 owns current Cloud/Host-Edge executable-closure semantics and the paired static/runtime proof requirement.
• D#17489 correction DC_kwDODSospM4BFFq_ owns the Edge-root / nested-Cloud / no-workspaces fold and the amended first-blocking-leaves timing.
• ADR 0019 owns AiConfig as the reactive SSOT; realm disposition may move config files but may not create second config authorities.
• Fleet's existing workspace provisioning already separates installed mainCheckout from target repoPath; C′ promotes these to agentosRuntimeRoot and targetRepoRoot.
• The repository name is not architectural identity: “Agent OS” remains the subsystem term, while the concrete repository name stays unresolved until the naming sweep.
• scriptPlaneClosure.mjs, the ADR 0039 denial witnesses, package manifests, and Fleet-managed MCP descriptors are existing primitives; the missing authority is their common plane-owned population.
• learn/agentos has Engine Portal/SEO/tree/source consumers and remains Engine in wave one.
• D#17247 remains the long-term topology authority and is not narrowed by this decision.

The Fix

Add learn/agentos/decisions/0040-agentos-extraction-topology.md as the durable record of C′.

The ADR will record:

• resolved repository name plus the Edge-root / nested-Cloud / no-workspaces topology;
• first-wave custody and explicit exclusions;
• dependency direction and Engine package contract;
• plane membership, isolated Edge resolution, static closure, runtime denial, Cloud positive control, and computed-import disposition;
• conditional shared/ admission: pure, driver-free, capability-free, and inventory-proven—or absent;
• runtime-root versus target-root authority and fail-loud target binding;
• criteria 2/3's amended timing: inventory/membership reconciliation and the temporary paired-gate exercise are the first two blocking Epic proofs and both precede every relocation leaf;
• issue-transfer canary, label provisioning, cut window, and in-flight-lane ledger;
• migration provenance with no second Engine history rewrite;
• relationship to ADR 0039, ADR 0019, Epic #17500, D#17489, and D#17247;
• retirement and revalidation triggers.

Update ADR 0039's relationship surface only as needed to point forward to ADR 0040; do not rewrite ADR 0039's already-shipped two-plane decision.

Implementation Gate — SATISFIED 2026-08-22 (receipts recorded per this gate's own third condition)

ADR drafting starts only after:

• ✅ Vega revalidates Epic #17500 against the explicit timing/root correction — receipt: [GRADUATION_APPROVED] REVALIDATED at the correction anchor DC_kwDODSospM4BFFq_, epic-review updated in place (IC_kwDODSospM8AAAABQHA4IQ), 2026-08-21;
• ✅ the registry/in-market naming sweep selects the repository name — receipt: sweep matrix + peer-convergence close: neomjs/neo-agent-brain (two-maintainer disjoint convergence, 2026-08-23; supersedes the 2026-08-22 neo-cortex close, which the operator's function-legibility challenge re-formed; evidence-bearing objections fold in until ~2026-08-24 18:00Z; Clio/Mnemosyne fold in on Friday return);
• ✅ the ticket body is refreshed with those two receipts — this edit.

The exact inventory and temporary paired-gate exercise remain pre-relocation Epic proofs; this ADR records their binding contract, it does not substitute prose for the receipts.

Contract Ledger Matrix

Decision Record impact

Depends on ADR 0039 and ADR 0019. Creates ADR 0040 only after Epic revalidation and repository naming disposition; does not amend or graduate D#17247.

Decision Record

Required: ADR 0040.

Acceptance Criteria

• ADR 0040 records the naming-sweep winner and C′ as one repository whose root is the Host-Edge package, with independent nested cloud/, no npm workspaces, and conditional inventory-proven pure shared/ (otherwise absent).
• It records AgentOS→published Engine as the only package dependency direction and keeps src/ai/** Engine-owned.
• It makes Edge isolation an isolated-artifact + membership-reconciliation + static/runtime denial contract, not a package-omission claim.
• It records explicit agentosRuntimeRoot / targetRepoRoot authority and the negative process.cwd() fallback proof.
• It records the amended timing explicitly: inventory/membership reconciliation and the temporary paired-gate exercise are the first two blocking Epic proofs, both required before any relocation leaf.
• It records wave-one custody: apps, learn/agentos, content, Portal/SEO/tree inputs, and the minimal Engine contributor surface stay Engine.
• It records label provisioning + canary transfer and the named cut-window/in-flight-lane ledger.
• It records migration provenance without changing any historical neomjs/neo SHA.
• It carries explicit retirement/revalidation triggers for a future physical Edge split, custody changes, new plane entrypoints, computed imports, or dependency-hoist changes.
• It cites the D#17489 Signal Ledger, STEP_BACK, and Epic #17500 without naming any client.

Out of Scope

• moving files, creating the external repository, or changing package manifests;
• implementing the inventory, severance, standing gate, seat bootstrap, ticket conversion, or cutover;
• extracting Core or src/ai/**;
• moving apps or published learn/content surfaces in wave one;
• deciding D#17247's long-term topology;
• another Engine history rewrite.

Avoided Traps

• ADR as implementation checklist: it records stable decisions and gates, not a duplicated child-ticket registry.
• Restating ADR 0039: ADR 0040 realizes its plane boundary as repository topology rather than replacing its proof semantics.
• Workspace equals isolation: the ADR retains the ancestor-hoist falsifier and isolated-artifact proof.
• Cwd equals target authority: the ADR records the negative fallback requirement.
• “First wave” silently becomes permanent global topology: D#17247 remains open, and future physical custody is a revalidation trigger.

Related

Parent: Epic #17500. Source: D#17489. Long-term topology: D#17247. Existing plane decision: ADR 0039.

Origin Session ID: 7287162e-14b1-44ca-b7d5-a2854211828f

Retrieval Hint: query_raw_memories("ADR 0040 C-prime AgentOS extraction topology plane roots runtime target root")

Live latest-open sweep: checked latest 20 open issues and recent A2A claims at 2026-08-21T20:06:45.457Z; no equivalent ADR leaf or competing claim found.