Reconcile out-of-AgentOS consumers before relocation

Context

Epic #17500 records a post-graduation correction from D#17489: the extraction inventory omitted live package-boundary consumers outside the moving ai/ population. The inbound evidence and author fold are at DC_kwDODSospM4BFJRU.

The predecessor #17525 / PR #17530 delivered its exact stated populations and remains resolved. Proof 2 #17533 / PR #17653 then exercised the full Edge closure and surfaced the inverse population: 48 current AgentOS-reached modules outside the registry region (35 src, 9 buildScripts, 4 apps). Its accepted Epic receipt assigns those boundary crossings to this leaf. Vega's measured amendment is recorded at issuecomment-5389019262.

Current source therefore proves two directed populations, plus one already-owned source class that must not be exploded into edge rows:

• outside-to-AgentOS: test/playwright/fixtures.mjs imports Neural Link host services/config; restoreEmptyTargetMeasurementAdapter.mjs imports Memory Core/graph and durable drivers; AgentOS specs instantiate service implementations; tracked Claude, Codex, and Kimi hooks resolve Brain modules from the target checkout;
• AgentOS-to-outside: Edge closures reach src, buildScripts, and apps modules that become package/custody crossings at the cut. Engine targets must resolve through the published Engine package; AgentOS-subject targets move with the Brain; no relative monorepo reach may survive by accident.
• preclassified AgentOS source: test/playwright/unit/ai/** is already selected by Playwright's unit-brain project and ADR 0040 §2.7. Its internal imports are not Engine consumer edges; the registry owns this exact source class as one moving-test row.

The full structure-map command was run at creation and reproduced the known Cannot create a string longer than 0x1fffffe8 characters failure. Scoped maps verified the existing homes: ai/scripts/diagnostics/agentOsExtractionInventory.mjs, its JSON registry, and the existing unit spec. This leaf extends them; it creates no new .mjs placement.

Proof 2 and ADR 0040 are now merged on dev, so the ticket's original blocker is released. This is the next pre-relocation ledger/guard leaf; no relocation is authorized by claiming it.

The Problem

The delivered inventory can report zero residue while a repository cut still breaks both sides of the package boundary.

On the inbound side, Engine tests, app specs, and provisioned seat hooks import AgentOS implementation through populations the current registry does not own. On the outbound side, AgentOS closures reach Engine/app/build source through monorepo-relative paths that cease to be ordinary imports after the cut. A one-direction ledger would certify half a boundary.

The tempting inbound repair—add the extracted Agent OS package as an Engine devDependency—contradicts ADR 0040 and the onboarding result. Engine-only test tiers must load without AgentOS; Neural-Link Whitebox is a separate cross-repository tier against an externally provisioned runtime.

The tempting outbound repair—mechanically rewrite every outside-region target to an Engine package specifier—is also wrong. Some targets are AgentOS-subject source living under apps or buildScripts and move with the Brain; custody follows subject, not current directory. The ledger must decide before the move.

Without one source-owned bidirectional edge population, later move/re-provision/proof leaves must rediscover both sets under cutover pressure, and a new crossing can enter silently after measurement.

The Architectural Reality

• agentOsExtractionInventory.mjs is the rerunnable census authority; its JSON registry owns exact dispositions and its existing unit spec owns missing/stale/mutation failures.
• Proof 2 #17533 / PR #17653 is the current closure evidence. Its 48 outside-region identities are a measured seed, never a pinned count.
• ADR 0040 §2.3 fixes dependency direction: AgentOS consumes the published Engine; the Engine has no dependencies or devDependencies edge back to AgentOS.
• ADR 0040 §2.7 fixes custody by subject: Engine regression clients/UI specs stay; AgentOS implementation tests and hook sources move; generated hook artifacts are re-provisioned; apps/buildScripts paths are not automatically Engine-owned.
• C-prime preserves one-way AgentOS-to-published-Engine dependency. src/ai stays Engine-owned as the Body-side Neural Link contract/client.
• This is a pre-relocation ledger/guard leaf. It classifies both directions and neither moves files nor rewrites imports.
• Proof 2 and ADR 0040 are merged on dev; the prior blocked-by #17533 state is discharged.
• No new .mjs file is proposed. Production logic extends the existing import/closure parser rather than creating a second graph walker.

The Fix

Extend the existing extraction inventory and registry with one exact bidirectional package-boundary consumer-edge population.

1. Derive every tracked static and literal-dynamic crossing in both directions:
   • outside-to-AgentOS implementation/config;
   • AgentOS-to-outside current source reached from the authoritative Edge closure. Reuse the existing import/closure parser; do not add a regex-only walker. A registry-owned source class already selected as AgentOS (currently unit-brain) contributes one exact class row rather than one row per internal import.
2. Give each edge a stable semantic identity: direction, consumer/source path, import kind, normalized specifier/target, and duplicate ordinal. Keep the line coordinate as evidence, not identity, so unrelated line insertions do not manufacture missing/stale residue.
3. Require one closed, direction-valid disposition per edge.
   • inbound: engine-contract-client, served-contract-integration, moves-agentos-test, generated-target-artifact, stays-engine-guard;
   • outbound: published-engine-package, moves-agentos-source, retire-boundary-edge. A disposition that belongs to the opposite direction is invalid.
4. Record a non-empty rationale plus successor phase (move, seat-reprovisioning, or engine-continuity) for every edge that does not already stay on its owning side. Native Epic children remain graph authority; the registry does not hardcode a child list.
5. Add a package-direction guard proving Engine manifests contain no AgentOS dependency or devDependency.
6. Emit both directed populations and residue in the existing deterministic human/JSON receipts. Missing, stale, duplicate, invalid-direction, same-count-substituted, or unowned rows fail non-zero.
7. Link the current-head receipt on Epic #17500 before any relocation leaf starts.

Contract Ledger Matrix

Decision Record impact

Depends on ADR 0039 and aligns with merged ADR 0040, D#17489, and Epic #17500. It does not amend those decisions.

Decision Record

Satisfied: ADR 0040 via #17502 / PR #17624. This leaf supplies the bidirectional custody/dependency receipt required by that record; it is not a substitute for the record.

Discussion Criteria Mapping

Acceptance Criteria

• The inventory derives every non-preclassified crossing in both directions from current source/closure rather than copying either count.
• test/playwright/unit/ai/** is one registry-owned unit-brain source class with a non-empty tracked-file population; stale, empty, duplicate, or overlapping source-class authority REDs.
• Inbound positives include the Neural Link Playwright fixture, Memory Core restore adapter, at least one AgentOS service-integration spec, and one named hook from each tracked harness family.
• Outbound positives include current Edge-reached targets under src, apps, and buildScripts; proof 2's 48 identities are reconciled as a current seed, not hardcoded authority.
• Every derived edge has one direction-valid disposition, source coordinate, rationale, and—when required—successor phase; zero unclassified residue remains.
• Custody is subject-based: the restore adapter is AgentOS-owned despite its shared test path; the Engine fixture stays Engine-owned; AgentOS-subject apps/build source may move rather than become a package import.
• Every outbound target that stays Engine resolves through the published Engine package after the cut; no monorepo-relative source reach is grandfathered.
• Engine dependencies and devDependencies contain no AgentOS package; injected entries in either map RED independently.
• Missing/stale rows, duplicate identity, wrong-direction disposition, added edge, and same-count substitution each RED with the exact semantic identity.
• Human and --json receipts remain SHA-bound, deterministic, and include both directed populations without conflating them with files, launch roots, or plane openers.
• The implementation extends the existing inventory/parser/spec substrate and adds no parallel census authority.
• A current-head zero-residue receipt is linked on Epic #17500; the prior #17533 sequencing block is recorded as discharged, never retained as a stale blocker.

Out of Scope

• moving AgentOS files, tests, hooks, apps, or build source;
• rewriting outbound imports to package specifiers;
• implementing the Engine-side Neural Link Node test client or changing the served protocol;
• adding AgentOS to Engine dependencies/devDependencies;
• provisioning generated hook artifacts;
• delivering move, seat-reprovisioning, or Engine-continuity proof phases;
• changing C-prime topology, proof ordering, signals, ADR 0040, or D#17247.

Avoided Traps

• Reopen #17525: a resolved PR is immutable history; this is a linked successor population.
• One-sided boundary: inbound imports and outbound reaches have different repairs, but the same ledger/guard seam; certifying only one leaves the cut half-blind.
• Edge explosion for an already-owned source class: unit-brain already says its 773 tracked files are AgentOS tests. Turning their internal imports into 1,813 authority rows adds decay without adding a decision; the exact class row is the authority.
• Pinned devDependency: keeps production imports clean while reinstalling the Brain into Engine onboarding and reversing ADR 0040.
• Rewrite every outbound edge: misclassifies AgentOS-subject apps/build source as Engine API instead of moving it with its owner.
• Directory equals custody: misclassifies the restore meter as Engine infrastructure and every app/build target as Engine-owned.
• Blanket hook move: contributor guards without Brain dependencies remain Engine-owned; identities are derived, not inferred from hook directories.
• Import migration hidden in census: this leaf inventories/dispositions; it does not relocate or rewrite.
• World-atlas child registry: successor phases compose with native Epic relationships; the registry does not copy the evolving child list.

Related

Parent: #17500. Blocking proof released: #17533 / PR #17653. Predecessor: #17525 / PR #17530. Source: D#17489, author fold, and outbound measurement. Decision Record: ADR 0040 via #17502 / PR #17624.

Origin Session ID: 01a02ed8-9cf8-74c3-bfa5-9cc57bc10166

Retrieval Hint: query_raw_memories("out-of-AgentOS consumer edges Engine whitebox devDependency seat hooks extraction")

Live latest-open sweep: checked latest 20 open issues sorted by creation at 2026-08-23T17:32:35.304Z; no equivalent found.

A2A in-flight claim sweep: claimed by @neo-gpt-emmy at 2026-08-24T00:10:03Z after live unassigned/no-PR/no-overlap verification (MESSAGE:68c59e28-f0f5-4c18-b60a-13391942ecd3).