Promote exact launch-root and dependency authority into the AgentOS inventory

Context

Epic #17500 requires #17533's paired plane-boundary receipt before any relocation leaf starts. The parent proof has already delivered its isolated two-root resolution layer, and #17634 / PR #17641 delivered H2: exact runtime-probe eligibility. Vega's current parent handover names H1 as the remaining open help-shape: promote launch-root identities and dependency populations into first-class inventory authority before the static/runtime composer consumes them.

Fresh V-B-A at origin/dev f47f337809 found:

• readEntrypoints() derives 74 unique launch roots: 62 npm, 5 workflow, 7 task; 47 resolve to Edge custody, but H2 currently governs 45 because its script-module join omits the two Edge task roots outside ai/scripts (ai/daemons/wake/daemon.mjs and ai/mcp/server/neural-link/run-bridge.mjs);
• agentOsExtractionInventory v2 retains only launchRoots.total and byVia counts, so an identity can disappear or be same-count substituted without the receipt exposing the row;
• package.json declares 38 devDependencies and zero dependencies; package.brain.json declares 3 devDependencies and zero dependencies;
• none of those 41 declaration identities is a reconciled inventory surface;
• #17533's live resolution-layer receipt therefore uses root devDependencies minus the Brain tier as an explicitly interim population and routes that topology finding to H1.

The Problem

The paired proof cannot truthfully materialize its Edge root and nested Cloud fixture from the extraction receipt while the receipt drops the exact manifest inputs. A count-only launch population can stay green after one target is replaced by another. A dependency population inferred ad hoc by the consumer can omit a Cloud driver, absorb an Engine-only build dependency into Edge, or drift independently from the inventory registry.

That would make the proof strongest around its resolver mechanics and weakest at the population boundary that licenses every resolver result.

The Architectural Reality

• ai/scripts/lint/lint-script-plane.mjs owns the unique launch-root population across npm, workflow, and task channels. This lane consumes readEntrypoints(); it does not create a second classifier.
• collectScriptModules() already carries the exact launch-root objects internally and discards them only when buildInventory() reduces them to counts.
• package.json and package.brain.json are the declaration sources. The inventory records declared section/name/version identity plus explicit manifestTargets (engine, edge, cloud, or the ADR-admitted physical shared package); source-declaration custody remains one disjoint disposition authority.
• reconcileInventory() and agentOsExtractionInventory.json already own exact bidirectional disposition authority, typed residue, deterministic rows, and mutation controls. New populations extend that substrate.
• ADR 0040 keeps the future repository root Host Edge, cloud/ independently installed, and forbids workspaces. H1 supplies proof inputs; it does not author the final manifests or move source.

The Fix

1. Add an exact launch-root inventory surface derived from readEntrypoints(). Each row has a stable target identity plus the source channel/name evidence retained by the owning classifier.
2. Add an exact package-dependency inventory surface derived from package.json and package.brain.json. Identity binds manifest, dependency section, and package name; evidence carries the declared version.
3. Reconcile both surfaces through the existing registry. Every identity keeps exactly one source-declaration custody disposition. Package rows separately carry explicit manifestTargets, so a dependency can materialize into multiple independently installed roots without overloading ADR 0040's physical shared/ source package or creating duplicate authority.
4. Expose the exact sorted rows in JSON and human receipts, alongside counts, so #17533 can consume one population rather than reconstruct it.
5. Preserve every H2 judgment, then close its newly visible population gap: runtime-probe eligibility derives from reconciled Edge launch-root rows rather than script-module rows, retaining all 45 existing identities and adding explicit judgments for the wake daemon and Neural Link Bridge task root.
6. Add detector arms for missing, stale, duplicate, invalid, added, and same-count-substituted identities, plus independent root/Brain dependency mutations.

Contract Ledger Matrix

Decision Record impact

aligned-with ADR 0040 (Edge-root, nested-Cloud, no-workspaces topology and exact membership proof) and ADR 0039 (the paired proof's instrument semantics). No accepted ADR is amended.

Acceptance Criteria

• buildInventory() exposes 74 current launch-root identities as exact, sorted, reconciled rows at the creation baseline, preserving npm/workflow/task evidence without copying readEntrypoints() logic.
• buildInventory() exposes all 41 current package declaration identities at the creation baseline: 38 root devDependencies and 3 Brain-tier devDependencies, with manifest/section/name/version fidelity.
• Every launch-root and dependency row has exactly one valid registry disposition, non-empty source, and non-empty rationale; every dependency additionally has valid explicit manifestTargets aligned to its source-declaration custody; zero residue remains on current head.
• Missing and stale authority, duplicate identity, invalid disposition, added identity, and same-count substitution each RED with the exact semantic identity.
• Root-manifest and Brain-manifest dependency additions RED independently; a dependency version change remains visible in row evidence without changing identity.
• Human and --json receipts include deterministic exact rows and counts; the parent proof can consume them without rereading package manifests or reconstructing launch targets.
• H2 remains green and identity-scoped: all 45 existing Edge judgments survive, the two newly authoritative Edge task roots receive explicit eligibility/reason/source rows, and runtime-probe reconciliation governs all 47 Edge launch roots.
• The implementation extends the existing inventory module, registry, and spec; it adds no parallel census authority and no new .mjs placement.

Out of Scope

• final production package.json/cloud/package.json authoring;
• installing or copying dependencies into the disposable #17533 fixture;
• static closure, runtime denial, computed-edge composition, or the final parent receipt;
• moving AgentOS source, tests, hooks, workflows, or tracker items;
• dependency cleanup or version changes;
• store-edge severance and the blocked successors #17631, #16202, and #17627.

Avoided Traps

• Count parity as identity proof: equal totals can hide one missing and one added row.
• Consumer-side manifest reconstruction: gives #17533 a second, drifting population authority.
• Treating package.brain.json as the whole Cloud boundary: future Cloud-only declarations must enter the same exact population automatically.
• Overloading shared dependency custody to mean duplicate declarations: explicit manifestTargets own multi-root materialization; ADR 0040 keeps shared/ reserved for its inventory-proven physical source package.
• Declaring final manifests here: H1 records current authority for the proof; the move leaf owns production manifests.
• Reclassifying launch roots by filename: readEntrypoints() and reconciled custody remain the owners.

Related

Parent: #17533. Epic: #17500. Predecessor inventory: #17525 / PR #17530. Runtime eligibility sibling: #17634 / PR #17641. Decision record: ADR 0040 / #17502 / PR #17624.

Origin Session ID: 01a02ead-f0db-7b30-b4e2-54189808ab54

Retrieval Hint: query_raw_memories("AgentOS H1 exact launch-root dependency manifest authority")

Live latest-open sweep: checked the newest 30 open issues and a targeted AgentOS manifest/dependency/inventory query at 2026-08-23T19:15Z; only #17500, #17533, and the blocked consumer successor #17631 overlapped, with no H1 duplicate. Memory Core raw queries for the H1 framing were clear misses. A2A latest unread/outbox plus #17533's handover showed H1 explicitly unclaimed.

Update 2026-08-23 — H1 exposed an H2 population omission before implementation: exact launch-root custody resolves 47 Edge roots, while deriveRuntimeProbeTargets() joins only script-module rows and therefore governs 45. The two missing identities are task roots outside ai/scripts. The body now requires H2 to consume reconciled launch-root authority and add both judgments; preserving H2 means preserving its 45 decisions, not preserving the omission.

Independent diff-audit correction and parent-authority reconciliation: schema v3 removes the v2 fallback entirely, and missing dependency manifests plus unknown dependency-bearing sections are typed REDs. The audit correctly separated source custody from target-manifest materialization. #17533's owner first overloaded shared, then corrected the public ruling in place at issuecomment-5388072792: ADR 0040 reserves shared/ for the physical source package, while manifestTargets are a separate typed axis. Live materialization is engine 32 / edge 13 / cloud 14 / shared 0 over 41 partitioned source declarations.