Exercise the isolated AgentOS plane boundary before relocation

Context

Epic #17500 requires two blocking proofs before any AgentOS relocation leaf may start. #17525 / PR #17530 owns proof 1: the exact zero-residue inventory. This leaf owns proof 2: exercise the selected C′ package topology and the complete static/runtime denial pair against that inventory before files move.

Current source already contains nearly every primitive:

• ai/scripts/lint/scriptPlaneClosure.mjs — transitive capability closure, bare-package normalization, and named unresolved edges;
• ai/scripts/lint/lint-script-plane.mjs — launch-root acquisition from npm, workflows, and orchestrator task definitions;
• test/playwright/unit/ai/services/hostBarrelImportReach.spec.mjs — static Cloud-package reach with a real positive control;
• test/playwright/unit/ai/services/hostBarrelRuntimeReach.spec.mjs + its module.register() denial loader — eager-lifecycle/runtime reach with Cloud and host controls;
• package.brain.json + its lock — the existing durable-driver tier (chromadb, better-sqlite3, @chroma-core/default-embed);
• MANAGED_WORKSPACE_MCP_SERVER_DESCRIPTORS — the existing Host-Edge MCP population seed;
• #17525's registry — every script/root/workflow/subprocess/config/custody identity plus the 12 current computed/unresolved closure edges.

What is missing is their composition over the selected future topology.

Premise correction — 2026-08-23: exact-head intake proved that the paired-gate exercise precedes store-edge severance in the Epic's reviewed leaf order, while this ticket originally required the exercise itself to report zero Cloud reach. That was impossible by construction. The corrected contract below makes instrument integrity and controls green, but makes the current-head topology receipt red-capable: every non-empty blocker is a named output with an owning successor, never a reason to weaken or skip the exercise. Evidence: https://github.com/neomjs/neo/issues/17533#issuecomment-5383344554

The Problem

Today all proofs run inside the monorepo's installed dependency tree. That environment can make a false Edge package look healthy:

• a root or workspace ancestor can hoist Cloud drivers into resolution range;
• a manifest can omit an Edge entrypoint and make a green denial result vacuous;
• the static walker can pass while better-sqlite3 still loads through eager initAsync();
• a runtime denial can fail for syntax/cwd/loader reasons and still look like a useful negative;
• a computed import can sit outside the static graph while no registry binds its disposition;
• the Cloud side can disappear entirely and “Edge resolves nothing” still passes.

A manifest omission is therefore not isolation. The proof needs an isolated artifact, bidirectional membership reconciliation, static closure, runtime denial, and a named Cloud positive control over one shared population.

The Architectural Reality

• C′ is one repository whose root is the Host-Edge package and whose cloud/ child is installed independently. npm workspaces are forbidden; resolution may not depend on ancestor hoisting.
• Databases, durable state, ingestion, migration, backup, and compaction exist only in Container Cloud. Edge may call served contracts; it cannot resolve a durable-store driver, path, service, or transitive handle.
• shared/ is conditional. A module enters it only when the exact inventory proves genuine cross-plane consumption and the module owns no driver, host capability, or ambient config authority.
• ADR 0039 establishes that static and runtime instruments are complementary. Neither may be promoted into the whole property alone.
• The #17525 registry is custody authority. Current closure is evidence/conflict checking, not an implicit membership fallback.
• The mandatory full npm run --silent ai:structure-map -- --files --loc currently exceeds Node's maximum string size; scoped source reads above are the placement evidence.
• Structural fast-path: if a new spec is needed, test/playwright/unit/ai/services/agentOsPlaneBoundary.spec.mjs matches the existing static/runtime denial siblings. Production logic extends existing closure/lint modules; no parallel gate module is prescribed.
• The Epic's reviewed order is inventory → paired-gate exercise → store-edge severance. A current Edge→Cloud finding is therefore valid proof output. The exercise fails only when it cannot name or classify the finding, when a control is vacuous, or when authority and population disagree.

The Fix

Build a temporary, disposable C′ fixture from the exact inventory and run one paired proof over it. The proof has two result layers: instrument integrity must be green; topology findings are an exact, red-capable receipt whose non-empty blockers name their successor owners.

1. Materialize an Edge root package and independently installed nested cloud/ package outside the repository/ancestor dependency tree. Do not use npm workspaces or a symlinked parent node_modules. Refuse an empty manifest population.
2. Promote every manifest input the current report drops into exact authority: resident ai/scripts modules, every npm/workflow/task launch-root identity, root commands, and package dependencies. Reconcile each plane bidirectionally; a missing row and a stale row are distinct findings.
3. Prove the isolated Edge artifact's real resolver cannot see chromadb, better-sqlite3, @chroma-core/default-embed, or any future Cloud-only dependency authority. The nested Cloud control must resolve the same dependency from its own package root. Adding a Cloud driver to Edge is a mutation RED.
4. Run scriptPlaneClosure over every Edge manifest entrypoint from that same population. Record every Cloud package, Cloud/durable path, root escape, and unregistered unresolved/computed edge. The current receipt may be non-empty; every identity must be exact and successor-owned.
5. Run the existing runtime denial hook only over an explicitly authority-classified eager-evaluable Edge population. An ineligible entrypoint requires a reason; omission is residue. A success is licensed only by paired controls:
   • the Cloud positive-control entrypoint dies under the identical Cloud-package denial for the denial reason;
   • an Edge entrypoint dies when a dependency it genuinely uses is denied, proving the hook observes that target.
6. Reconcile every computed/dynamic Edge closure edge with the registry. An added edge and a same-count substitution each RED by identity.
7. Emit a deterministic machine-readable current-head receipt separating instrumentErrors from topologyFindings. The command exits non-zero when either is non-empty; unit fixtures prove every finding arm without making hosted CI depend on the known pre-severance topology.
8. Keep fixture creation/cleanup OS-temp scoped and import-safe. Reuse or extract the existing closure and denial helpers rather than copying their semantics into a third implementation.
9. Link the receipt and native successor relationships on Epic #17500. No relocation is authorized until proof 2 exists and every successor marked preRelocationBlocker is discharged.

Contract Ledger Matrix

Decision Record impact

Depends on ADR 0039 and aligns with the corrected C′ authority in D#17489 / Epic #17500. It does not amend ADR 0039 and does not freeze ADR 0040 or the repository name.

Decision Record

Required: #17502 will record ADR 0040 after the naming sweep. This paired proof is evidence for that record, not a substitute for it.

Discussion Criteria Mapping

Acceptance Criteria

• A disposable C′ fixture materializes a non-empty Edge root and independent nested cloud/ package outside the repo's ancestor dependency tree, with no npm workspace or parent/symlinked node_modules.
• Exact manifest authority includes resident modules, npm/workflow/task launch roots, root commands, and dependency identities. Missing and stale entries RED independently and name the exact identity; an empty population REDs.
• The isolated Edge resolver cannot resolve every Cloud-only dependency in the declared set; the nested Cloud positive resolves each from its own root; adding one driver to Edge REDs.
• Static closure runs over every Edge manifest entrypoint and emits exact Cloud-package, Cloud/durable-path, root-escape, and unregistered unresolved/computed findings. export * and bare-package edges cannot disappear from the instrument.
• Runtime denial runs over every explicitly eligible Edge entrypoint; every ineligible entrypoint is registry-owned with a reason. The Cloud control and Edge-used-package control fail for the exact denial contract, not merely with a non-zero exit.
• A computed-edge addition and same-count substitution each RED by stable semantic identity; the current registry population is fully dispositioned.
• Instrument errors and topology findings are separate in deterministic JSON/human output. Unit fixtures make every detector arm RED/GREEN; known pre-severance topology findings do not become hosted-CI false greens or permanently failing tests.
• The proof reuses/extracts the existing static/runtime instruments rather than copying their semantics.
• Fixture output is OS-temp scoped, cleaned on pass/fail, and commits no install/build artifact.
• The current-head receipt is linked on Epic #17500. Every non-empty topology finding names a native successor relationship and whether it blocks relocation; no relocation is authorized until those blockers close.

Out of Scope

• moving AgentOS files or creating the external repository;
• severing the two measured Edge→store spines (this proof names them; the Epic's next leaf owns the repair);
• authoring final production plane manifests before naming/repository scaffolding;
• choosing the repository name or drafting ADR 0040;
• changing database ownership away from Container Cloud;
• treating a green static walk or package omission as the whole property.

Avoided Traps

• Manifest omission as isolation: ancestor hoisting can make undeclared drivers resolve.
• Static-only green: cannot observe eager dynamic better-sqlite3 loading.
• Green-before-severance inversion: requiring proof 2 to be topologically green before the reviewed leaf 3 repair hides the very blockers the exercise exists to surface.
• Runtime death without reason: syntax/cwd/loader failure is not a denial control.
• One-sided membership: a missing row and a stale row are separate drift classes.
• Count ratchet: one edge can replace another at the same total.
• Parallel gate implementation: reuse/extract the established closure and denial pair.
• Fixture inside the repo tree: parent node_modules would invalidate the isolation claim.

Related

Parent: #17500. Blocked by: #17525 / PR #17530. Decision Record leaf: #17502. Source: D#17489. Existing boundary authority: ADR 0039.

Origin Session ID: bbd4f722-ca03-4269-a88e-29555b12b9f9

Retrieval Hint: query_raw_memories("AgentOS extraction second blocking proof isolated Edge manifest runtime denial Cloud positive control")

Live latest-open sweep: checked latest 20 open issues at 2026-08-22T00:22:08.694Z; no equivalent found. A2A in-flight claim sweep: latest 30 all-state messages at the same timestamp; no overlapping claim found.