# Project Backlog

Canonical open work: `BACKLOG.md`. Contracts and durable constraints live in `AGENTS.md` and indexed `docs/`; investigation history stays in Git and the referenced evidence, not inside open tasks.

Task IDs name bounded work, not execution order. The operator authorizes autonomous selection and execution of open pi-actors work in Grow Loop: choose dependency-ready high-value cohorts across this backlog without repeated routine permission questions. Dependencies, factual acceptance and specific safety/authority boundaries remain explicit; a gated task is not completed merely because another cohort can proceed. Completing a child does not complete its checkpoint.

## Next bounded work

- **Separate remaining owners:** F1.3c, F1.3s and F1.4i remain separate attributable owners, not proof that all AX output already conforms. N1.4c also permits unrouted deterministic preparation within its reviewed contract.
- **Explicit gates:** U1 requires authorized loaded-host observation/reload; N1.2p needs actual Windows profile evidence, N1.3 an asset-distribution decision, and N1.6 separate activation admission. Original-clock/native-scope, macOS research and composition decisions retain their own B/C/T gates. Existing release permission does not adopt them.
- **Evidence reuse:** Reuse the accepted three-OS SOURCE/PACKED quit witnesses for B2.4; extend only the missing descendants/triggers/same-ID/crash cases. N1.9 stays a gated unresolved risk, not an instruction to repeat the completed ownership inquiry.

## Release 0.56.1

- [ ] **R3 — Complete the guarded 0.56.1 release.** Accept the exact dev-to-main PR through all nine product shards and the dependency audit; merge normally, tag the verified main commit once, then verify tag-owned validation, npm identity/package and GitHub Release convergence. Publication belongs only to release.yml; no tag replacement, manual publish, history rewrite or unrelated activation. Close only after external release evidence matches.

## 2. Uniform runtime presentation — adopted, rollout pending

Outcome: JSON structured inputs, block-YAML runtime-output metadata and unchanged selected authored text/Markdown, as defined by [the AX contract](docs/agent-experience.md#json-input-yaml-output-opaque-content). This includes tool/spawn receipts, not only Actor results. Rollout remains partial; this checkpoint does not imply uniform emitter conformance, native continuation, package publication or a loaded-host change. Existing machine/input/source/history contracts remain separate.

### F1 — One readable output contract

Exit: New owned runtime projections use YAML without pseudo-records or serialized JSON objects: bare when metadata-only, `---`-delimited headers only when a separate text body follows. Literal content, meaning, source/privacy bounds and saved messages remain intact. Service-carrier adoption has its own evidence gate; do not delete current framing to simulate completion.

- [ ] **F1.3c — Migrate registry-owned refusals.** Convert only locally authored mode/name/source/template/draft/transaction refusal projections. Keep original getter/coercion/fault order, private causes, opaque advice and whole-source limits; do not wrap host/dependency exceptions or infer no effects/retry. Verify: corresponding registry guard/failure properties and applicable packed witnesses.
- [ ] **F1.3s — Separate synchronous tool metadata from selected output.** Migrate owned usage/guard/exit-label facts without parsing or reserializing stdout/stderr/report bodies or JSON invocation examples. Keep existing trim/tail/loss basis, exact executor failures and the pre-dispatch repair cutoff. Metadata plus selected text uses a delimited header; metadata-only output stays bare. Verify: tools-local/execution-output/spawn guards and packed dispatch-failure owners.
- [ ] **F1.4 — Migrate inspection, Control and runtime notices.** Render selected structured/verbose metadata as YAML, including generated JSON Schema views; retain literal sources. Reconcile emitter execution/depth ceilings with actual caller budgets without narrowing public allowances. Preserve error/cause, request/delivery/handling/effects/closure distinctions and recipient fences. Verify: affected Control/inspect/runtime/notification owner properties.
- [ ] **F1.4i — Verify remaining Inspector feedback recognition.** Check anchored feedback recognition against current AX guard/error output and correct only evidenced gaps. Preserve reviewed generic block-YAML and independent native Markdown, zero added body indentation, exact selected text and own undefined fields, source labels, native columns/wrapping, chronology/identity, chrome, frozen underlay and once-only generation actions. Verify: affected guard/modal properties and compiled parity. Loaded acceptance stays with U1.3/U1.5; no duplicate renderer migration or implicit host reload.
- [ ] **F1.7 — Accept one rollout candidate.** Verify exactly one visual blank line between host invocation/arguments and each result/error without altering selected bodies. Independently verify no runtime-owned JSON/pseudo-record escape remains in the selected rollout, with history/literal-body invariance, source/compiled/package/Skill parity and permitted terminal/phone acceptance. Keep current capture codec facts and new target distinct; no unrun live/native claim or automatic default activation.

### U1 — Loaded UI/AX acceptance

Exit: Real loaded rendering is checked separately from source/headless/native proofs. This is independent follow-up, not a claim that the already merged release received loaded-host acceptance. Reload and an operator Run require their own authorization; do not start one merely to manufacture a live Kill case.

- [ ] **U1.1 — Retest fresh completion packets and expansion.** After authorized reload, inspect actual singleton/multiple/omitted-row packets: index-first YAML/kind, left-edge independent Markdown, literal unfinished blocks, exact cut marker, blank separation and no routine top-level completion caption/toast. Expansion and historical fallback must preserve the saved text. Verify: actual terminal/phone observation plus existing delivery/Pi owners.
- [ ] **U1.2 — Retest the Run dropdown.** Check shifted compact placement, independent stripes/right padding, narrow/medium/wide layout and unchanged selection/source detail. Preserve the accepted navigation and refresh behavior; do not invent a performance cause or change freshness speculatively. Verify: real Inspector plus existing overlay/Inspector properties.
- [ ] **U1.3 — Retest notification and Kill modals.** Check complete selected notification text, no prefix/reader indirection, Esc-only dismissal and scrolling only on physical overflow; check centered compact Kill, default backgrounds/insets, frozen underlay and no key leakage. Cancel returns to the same Inspector without Notice; success relies on selected status and failures remain visible. Verify: actual permitted modal cases, without claiming Kill is scope closure.
- [ ] **U1.4 — Retest Inspector chronology.** Check newest-higher numbering across 100→101/102, filter gaps without renumbering, scrolling/detail provenance and visible `#?` for unavailable history. Do not promise permanent lifetime ordinals or reconstruct missing offsets. Verify: [chronology contract](docs/actor-inspector.md#chronological-numbering-requested-replacement) on loaded terminal/phone.
- [ ] **U1.5 — Retest loaded Inspector YAML documents.** After separately authorized reload, verify real block YAML in Recipe, Control, non-agent Trace detail (including process.stderr) and captured Kill fields, with actual sequence shapes, preserved log scalars and independent exact agent Markdown. Check narrow/wide wrapping, stripes, scrolling and unchanged actions on terminal/phone. Source, compiled and independent-review evidence is not already-loaded-host acceptance.
- [ ] **U1.6 — Retest loaded read-only Control utility.** After separately authorized reload, verify recorded readiness/actions/queue diagnostics, status-first request rows and Enter→redacted YAML on terminal/phone. Check empty/partial history, the20-parsed-record suffix, narrow/low viewports, refresh selection and generation replacement without new Trace reads or actions. Preserve actual status/timestamps and existing Kill guards. Source/compiled/review acceptance is not already-loaded-host proof; no command submission, automatic replay or new protocol.

## 3. Session-wide completion index — adopted, not wired by default

Outcome: Consecutive indices across batches in one logical Pi session; reload/resume/replay preserves allocated numbers. The current repeated single-result `index: 0` is packet-local behavior, not completion of this requirement. This integration is separate from the selective release's currently disabled public-stream boundary; no renderer-local `index++`, silent existing-session bootstrap or historical renumbering.

### S1 — Coupled session-stream activation

Exit: Persistence, trusted lifecycle binding, allocation/capture/recovery and presentation agree under the [adopted stream contract](docs/coordinator-delivery.md#completion-streams-adopted-contract). Existing atomic allocator and fresh-manager bridge are foundations, not default activation.

- [ ] **S1.1 — Finish bootstrap/start/status admission.** Positively establish non-connection and trusted first connection; implement the admitted session-level start/status path. Missing/corrupt state is unavailable, not off or permission to restart at zero. Verify: delivery journal and runtime admission properties.
- [ ] **S1.2 — Admit continuation and wire the default runtime.** Resolve startup/reload/resume against the original manager/current generation; preserve pending targets, unresolved-packet barriers and `/tree`-independent counters. Establish restore versus independent-copy semantics for imports retaining an ID/reason=resume, and fork/clone isolation. Verify: run-ui/extension-runtime and real source/packed session journeys.
- [ ] **S1.3 — Preserve immutable numbering/provenance.** Use the kernel allocator's saved whole range/member order and session+stream+index identity; retain unavailable `?`, first-stream boundary and full technical provenance. Projection never reads the mutable current counter, restyles old packets or reconstructs an unknown counter. Verify: run-delivery/Pi/native renderer and installed properties within unchanged budgets.
- [ ] **S1.4 — Accept continuous delivery and loaded display.** Prove multiple batches advance, replay/recovery does not allocate twice, same-session reload/resume does not reset, and new fork/clone does not inherit numbering. Check actual loaded packets only after authorized reload; source success does not activate the already running host. Verify: ordinary source/packed lifecycle plus permitted UI observation.

## 4. Future supervision and self-contained outcomes

Outcome: Complete [A/B/C and the SUP-01–SUP-17 matrix](docs/run-supervision.md), then D. No future version/release or default activation is implied. Keep unchanged credentials, strict Linux/macOS/Windows authority and positive native-closure requirements. Removal of `inspect` remains a separately gated scope, not an implied task here. A can progress without a production scope backend; A4 needs B1's clock, real enforcement needs B and C. The N1 MI reader supplies identity observation, not protected scope/owner-loss authority.

### A0 — Remaining first-layer AX and partial-failure presentation

Exit: Existing owned surfaces are compact, truthful and selectively recoverable. Included loaded UI is owned by U1; session numbering by S1, not duplicate checkboxes here.

- [ ] **A0.2 — Resolve recipient-bound Control enrichment.** Gate richer id/generation/drill-down on a reviewed original-recipient publication contract across tool call, normalization, hooks and final routing. Current conservative unknown-effects errors/private causes remain valid; manager equality, copied context/IDs or saved errors do not authorize publication. Reopen only on changed host-contract evidence; this optional enrichment does not block the conservative layer. Verify: [recipient-bound preparation](docs/run-supervision.md#recipient-bound-correlation-preparation).
- [ ] **A0.3 — Integrate authoritative partial-stop facts.** Depend on B2/C/D1 for richer legacy stop receipts and finalization. No missing Trace/handled/progress record proves inaction, and no error grants automatic retry. Verify: [existing-fact reconciliation](docs/run-supervision.md#control-partial-failure-evidence-existing-facts-not-a-new-receipt-contract) and stop/control owners.

### A1 — Shared snapshot/read-model integration

Exit: A single admitted compositor supplies bounded manual/default/timed observations without fabricated timing, permission or native authority. Existing metadata-only default stays until gates pass.

- [ ] **A1.1 — Join supported lifetime and original-origin facts.** Depend on B1.1/B1.2/B1.3; consume original time/reference capabilities, not saved DTOs, PID/wall timestamps or later replacement samples. Keep ordinary missing first-natural time unproven. Verify: snapshot/supervision/status admission properties.
- [ ] **A1.2 — Wire shared projection routes.** After A1.1, use one compositor/renderer for default/manual/status/timed routes; preserve source/lifetime fences, null/redacted cwd/index, secret masking, metadata-only artifact observations and selective navigation. No second status implementation, source read, ACK, lifecycle or actuation side effect. Verify: snapshot/observability/inspect-security families (`SUP-05`, `SUP-14`).
- [ ] **A1.3 — Join forced-stop projection only from authority.** Gate confirmed stop/closure display on C and B2 facts; unknown lifecycle/timing remains explicit. Verify: stop/snapshot classification, not rejection-only native support.

### A3 — Source selection, recoverability and clipping

Exit: Only explicitly admitted sources/retention cross evidence → projection → delivery; first result/unavailability and saved packets stay immutable. The accepted logical-session file-navigation route remains separate and already supplies ordinary location research.

- [ ] **A3.1 — Decide the broader stdout predicate.** Obtain approval for final successful settled ordinary-command attempt, including a single retry wrapper, before extending the initial bare-command/one-attempt raw-source contract. Composition/parallel/repeat/recovery/policy output, stderr and Actor-session answers need their own predicates. Preserve the 4 MiB input boundary. Verify: [selection reconciliation](docs/run-supervision.md#a3-owner-reconciliation-and-unadopted-selection-proposal).
- [ ] **A3.2 — Decide summary/diagnostic retention.** Approve source-kind/privacy/storage/replay boundaries before retaining more than fixed fields or pre-record Trace text. Resolve collector1000/display200 and failure-journal4096 UTF-16 losses without split scalars, guessed counts, raw/private disclosure, malformed repair or changed packet text. Verify: [legacy disclosure boundary](docs/run-supervision.md#legacy-completion-disclosure-boundary).
- [ ] **A3.3 — Integrate only approved source branches.** After the corresponding decision, prove full authorized retention before formatting, exact ranges/Unicode counts, whole-row omission and immutable provenance/unavailability through existing evidence/delivery/render owners. Executor-final-response capture is bounded retained text, not expanded raw-stream permission. Verify: ordinary source/packed recovery (`SUP-11–12`, `SUP-14–16`); reuse unchanged primary/artifact/diagnostic witnesses.

### A4 — Latest-only diagnostics and context

Exit: Reporting uses A1, the accepted session-owned navigation and B1's admitted clock, with descendants quiet and default reporting disabled.

- [ ] **A4.1 — Implement root cooldown/coalescing.** Coalesce only unadmitted observations; freeze admitted packets and honor `RUN_DIAGNOSTIC_MIN_INTERVAL_MS` at actual accepted delivery. Manual/terminal/urgent bypass stays independent. Verify: delivery/runtime clock-boundary fixtures (`SUP-06–08`, `SUP-17`).
- [ ] **A4.2 — Fold only obsolete automatic context.** Preserve native/foreign/manual history, mixed terminal members and acceptance evidence; do not rewrite stored packets or widen source permissions. Verify: session-evidence/context-recovery fixtures (`SUP-13`).

### B1 — Original clock, host lifetime and controller ownership

Exit: Supported coordinator/independent-supervisor lifetimes retain original origins without new allowance; same-runtime claims do not masquerade as cross-process authority.

- [ ] **B1.1 — Resolve the live-origin carrier contract.** The carrier proposal is unadopted. Establish clock-domain/epoch/platform, issuer/bootstrap/return, bounded nonblocking relay and cleanup, then obtain approval before kernel-interface work. No channel/nonce/DTO, late sample or passive historical receipt reconstructs an origin. Verify: explicit [carrier gate](docs/run-supervision.md) and first-natural semantics.
- [ ] **B1.2 — Establish host shutdown-before-invalidation.** Resolve bare `AgentSession.dispose` coverage with trusted shutdown, not copied IDs or inferred revocation. Integrate supported original-manager lifetimes while preserving singleton clocks and existing retained capabilities. Verify: real SDK lifecycle plus replacement/revocation fixtures.
- [ ] **B1.3 — Integrate ordinary first-natural timing and controller authority.** After B1.1/B1.2, carry the original one-shot capture into ordinary runner/supervisor lifetimes; preserve pending/failed publication and post-stop uncertainty. Resolve ownership across distinct origins/runtimes/processes, not only cooperative same-origin claims. No cross-process/model await under lifecycle admission or relocated canonical T0. Verify: supervision/time/long-workload families (`SUP-03–04`).
- [ ] **B1.4 — Admit restart recovery without renewal.** Missing clock/origin stays unavailable; saved start/clock metadata cannot grant a fresh allowance, launched-Run fact or terminal timing. Verify: restart/overdue/provider-fault and singleton witnesses.

### B2 — Existing stop protocol and parent-stop integration

Exit: A request/ACK/signal is not terminal handling or whole-scope closure. Actual native actuation remains C-gated.

- [ ] **B2.1 — Remove stalled-transport lock coupling safely.** Replace lifecycle admission held across awaited `sendRunControl` transport only after an equivalent generation/endpoint fencing contract exists. Do not merely remove `await` and open a replacement race. Verify: transport saturation, release faults and same-ID replacement.
- [ ] **B2.2 — Join claims/work/captures to confirmed stop.** Keep durable first cause and natural-result precedence; replace immediate handled/progress/terminal finalization after signaling with confirmed supported scope termination. Verify: control/lifecycle/native-authority boundary families (`SUP-09–10`).
- [ ] **B2.3 — Reconcile every terminal reader and retention path.** Keep nonterminal request ACKs, `timed_out`, pending captures and exact generation consistent across status/collector/retention. Verify: status/outcome/retirement owners without fabricated closure.
- [ ] **B2.4 — Extend the accepted portable quit evidence.** The ordinary SOURCE/PACKED graceful-quit case already passed exact-candidate Linux/macOS/Windows CI with actual runner close, direct-workload fresh absence and a surviving foreign owner; retain that evidence rather than replaying it as missing. Remaining work is descendants, other triggers, concurrent same-ID hosts, crash/hung-host and original owner-instance lifetime. These extensions require their corresponding B/C authority; the existing case proves neither sealed membership nor full closure. Verify: native shutdown and parent-stop families for only the newly admitted cases.

### B3 — Deterministic controller integration

Exit: Controlled drivers prove controller behavior, not OS termination or platform support.

- [ ] **B3.1 — Join admission and stop races.** Exercise canonical state/lifecycle-lock contention, deadline/manual/natural ordering, replacement and unavailable scope authority across B1/B2. Verify: explicit controller drivers (`SUP-03–04`, `SUP-08–10`).
- [ ] **B3.2 — Preserve long-timer/provider-fault behavior.** Integrate existing wake-plan, overflow and fault witnesses without fresh allowance, fake authority or native-support claims. Verify: deterministic supervision/time properties before native integration.

### C1 — Three-platform protected scope and owner-loss authority

Exit: Approved native scope identity/issuer/compatibility and positive evidence for Linux/macOS/Windows under unchanged credentials. Heartbeat loss and runner PID are not owner-death authority; namespace/group-mapping variants remain parked.

- [ ] **C1.1 — Review exact native bootstrap/setup contracts.** Review protected cgroup-v2/pidfd, Windows HANDLE/Job and the admitted macOS candidate with original host lifetime, session epoch and Run generation before work. Backend implementation remains gated on the macOS feasibility in C1.3/C1.4. Record concrete setup/rights/containment requirements for separate approval before performing them. No second registry, journal-reconstructed grant, privilege escalation or Linux-only substitution. Verify: [owner-loss mechanism gate](docs/run-supervision.md#owner-loss-termination-approved-outcome-and-mechanism-gate).
- [ ] **C1.2 — Bind the separately permitted macOS inventory operation.** Select the exact approved clean GitHub commit and inventory-only envelope before using the previous single inventory-only permission; `inventory_only=true`, `execute_pilot_a=false`, empty reviewed-profile JSON/digest. Current selective-release authority does not execute this research workflow or grant pilot A. Inventory facts cannot approve a profile. Verify: [SPI/CI plan](docs/run-supervision.md#macos-spi-and-ci-feasibility-plan).
- [ ] **C1.3 — Admit and execute macOS observational profile A.** Obtain exact v2 profile/`transport_sha256` and native-execution approval. Prove ABI, identities, fork/setsid observations and actual cleanup for macos-15/arm64 Xcode16.4 SDK15.5 under unchanged credentials; then separately review macos-26/arm64 and macos-15-intel. Local/mock/19-case C-core evidence is not native PASS_A, C1 or B authority.
- [ ] **C1.4 — Prove macOS issuer/bootstrap and complete closure feasibility.** Establish one authenticated issuer, exclusive pre-work binding, retained lifetime, sealed membership/emptiness/recovery and supported profile/setup. Exercise real own/foreign, ingress/escape/stop, owner/controller loss and partial faults. Keep B blocked if unavailable; no guessed SPI authority, coalition/accounting requirement, registration or speculative adapter.
- [ ] **C1.5 — Verify cross-platform compatibility and authority.** After mechanism feasibility, prove no breakaway/migration, correct original-instance authority, handle/controller loss and compatibility with existing host containment. Retain every uncertain/non-pass result. Verify: agreed native profiles, not labels, metrics, helper exit or rejection-only tests.

### C2 — Authenticated live membership before work

Exit: Scope membership is authoritative and generation-bound, not copied preparation data or directory ancestry.

- [ ] **C2.1 — Bind the actual spawning member and parent.** Extend private intent/preparation evidence with authenticated native scope identity and live membership before work. No actor scope path, delivery environment, owner discovery or index lineage supplies that authority. Verify: admission/missing/foreign/replaced membership families (`SUP-02`, `SUP-09–10`).
- [ ] **C2.2 — Serialize ingress with parent stop.** Cover fork/setsid and separately spawned cross-owner Runs, parent/child admission contention, migration/descriptor/namespace egress and nested scopes. Preserve independent child policies within the parent scope and original parent clock. Verify: real native ingress/escape plus controlled races.

### C3 — Positive closure, recovery and retirement

Exit: Only sealed complete scope identity/emptiness plus recursive exact-generation child closure permits finalization or guard release.

- [ ] **C3.1 — Compose complete native/child closure.** Retain escalation policy and authoritative original-scope evidence; all recorded members settling is not complete membership or closure. Wire ordinary native/child starts only after C2 and closure integration. Verify: positive native stop/escape/descendant witnesses.
- [ ] **C3.2 — Recover uncertain preparations without inventing work.** Handle producer loss, staged-only/incomplete records, malformed/legacy/replaced proof and runtime-local cleanup quarantine. No identity backfill, reconstructed authority, fabricated exits or metadata-to-work promotion. Verify: real crash/replacement/recovery and retirement guards (`SUP-09–10`).

### D — Future integrated supervision acceptance and release

Exit: One candidate supports the complete SUP-01–SUP-17 claim set. A/B readiness does not replace C, and unsupported/unproven or rejection-only behavior is not positive enforcement support. No future version is authorized yet.

- [ ] **D1 — Wire admitted public ingress.** After readiness, integrate Recipe/spawn literals, delegation/async inheritance and synchronous-path refusal; keep ordinary arguments/singleton compatibility. Expose the admitted generation and require top-level kill preconditions, exact terminal ACKs, consistent readers and kill independence from actor Control saturation. Verify: Recipe/tools/Control/source-packed journeys (`SUP-01–02`, `SUP-09–10`, `SUP-13`).
- [ ] **D2 — Prove positive deadline/manual/natural outcomes.** Join B/C through actual public launches on the agreed native platform set: membership before work, independent expiry, sealed admission, owned-scope termination and only then `timed_out`. Cover descendants, replacement, producer loss/recovery and event ordering. Reject unsupported limits before work; rejection alone is not acceptance (`SUP-03–04`, `SUP-08–10`).
- [ ] **D3 — Validate one future candidate.** Only after A/B/C and live/native acceptance, select an eligible minor version, consolidate outcome notes and align API/Skills/package/lock/dist. Bind the complete evidence matrix, normal validation, source/packed parity, native checks, dependency audit and context checks. Equivalent-input reuse is allowed; mocks/skips do not replace native proof.
- [ ] **D4 — Perform the separately admitted release handoff.** Follow refreshed ADMIN/fork/dev-route/remote/version/tag eligibility and sole workflow ownership. This future epic grants no reset/rebase/force-push/intermediate publish/tag reuse. Close only after immutable-tag automation and exact npm/GitHub verification; keep MPRIS separate.

## 5. Future Linux MPRIS integration

Outcome: One optional MPRIS2 surface for the existing `music-player/playback` singleton, not a second playback authority. No current release activation.

### M1 — Generation-fenced bus surface

- [ ] **M1.1 — Define bus lifetime and availability.** Use one stable session-scoped identity, withdraw it on stop/replacement and fail soft without user D-Bus. Verify: deterministic ownership/generation/bus-loss properties.
- [ ] **M1.2 — Publish truthful media state.** Supply playback status, metadata, duration, read-time position, volume and capabilities from existing playback facts; do not edit Run truth or signal the backend. Verify: MPRIS property/position contract.
- [ ] **M1.3 — Route controls through existing Control.** Map Play/Pause/PlayPause/Next/Previous/Stop and Seek/SetPosition/Volume into the generation-fenced helper contract. Verify: deterministic delivery/refusal and replacement races, preserving backend independence.
- [ ] **M1.4 — Accept the live GNOME surface.** Check media presence, metadata, progress, volume and controls against the owned Actor; retain missing-environment evidence rather than claiming a smoke pass. Verify: separately authorized live session.

## 6. Composition transport and optional CodeMode

Outcome: Refine the [recorded design intake](docs/composition-transport.md) separately from 0.56.0. Illustrative APIs are not adoption or a new runtime requirement.

### T1 — Bundle contract and resolver integration

- [ ] **T1.1 — Decide the portability boundary.** Resolve recipes-only versus scripts/assets, external dependencies, export privacy, source provenance and aggregate limits before claiming self-contained portability. Keep container IDs distinct from Recipe names/global Skill identity/Run authority. Verify: contract review.
- [ ] **T1.2 — Specify and validate JSONL grammar.** Define manifest/entry/record/local-ID/reference rules and refusal for duplicates, missing IDs, cycles, truncation and malformed input. Verify: bounded parser/preflight properties after T1.1.
- [ ] **T1.3 — Integrate lossless pack/load.** Reuse current resolution/composition, preserving args/defaults/Control/async/artifacts/runtime origins/relative paths/source privacy. No second runtime or registry. Verify: relocation and source/packed parity after T1.2.

### T2 — Agent operating patterns and interoperability

- [ ] **T2.1 — Update actual owning Skills.** Teach optional preflight/conditional chains, bounded awaited fan-out, real-completion fan-in and selective result reading with omission counts. actors owns shared lifecycle mechanics; swarm owns independence/scopes/dissent/integration. Include benefit/overhead/contracts/failure/cancellation and ordinary-tool fallback; docs alone do not complete delivery.
- [ ] **T2.2 — Validate real host interoperability.** Exercise actual spawn/active registered-tool calls through CodeMode with awaited receipt, independent outcome delivery, context/generation, cancellation before/after materialization and partial effects. Preserve failure/source/omission semantics; no polling, new wait service, abandoned Promise, raised Pi floor or implicit JS Recipe backend. Verify: source/packed host-capability journeys.

## 7. Optional native acquisition and post-release package work

Outcome: Prepare a separately reviewed optimized acquisition path without retroactively turning it into a 0.56.0 release blocker. The shipped reader remains PowerShell with corrected UTF-8. Inert differential success and restored SDK timing observation do not admit UTC/provider profiles, executable assets, production routing or full native SDK convergence. The owning [Windows design/evidence](docs/windows-process-observation.md) preserves those boundaries.

### N1 — Reviewed fresh Windows acquisition

Exit: A separately admitted optimized shipping path preserves identity/status/authority semantics and passes unchanged source-and-packed SDK/native acceptance. This future backend is not the released PowerShell UTF-8 correction. Owner: process acquisition, not supervision. Design and experiment evidence: [Windows process observation recovery](docs/windows-process-observation.md).

- [ ] **N1.2p — Establish UTC-profile admission.** Record actual native environment/version facts and real PowerShell precision-boundary witnesses, then define/test the exact initial admission predicate. MI offset zero, runner labels, JavaScript timezone or expected-identity equality are insufficient. Keep unproved date/provider partitions unsupported. Verify: Windows differential and separately disclosed controlled formatter witnesses.
- [ ] **N1.3 — Decide native executable distribution.** Obtain an explicit decision on reviewed unsigned Windows x64 repository/npm assets with manifest-bound provenance and baseline fallback. Recommendation: committed prebuilts, no install-time compilation/download. This decision does not approve default activation. Verify: source/build/artifact/architecture/dependency and execution-policy review.
- [ ] **N1.4c — Complete asset-verified acquisition preparation.** Add the bounded complete-manifest reader, trusted exact-byte selection, fixed versioned package-relative asset verification/lookup and shell-free invocation seam under the reviewed contract. Preserve raw-null refusal and unsupported UTC admission until N1.2p; comparison/status/fences remain in their owners. No production routing or binary inventory change without their separate gates. Verify: mirrored asset/acquisition/fallback ports and source/compiled parity.
- [ ] **N1.5 — Bind the exact candidate asset.** After N1.3, retain reviewed Windows build bytes and manifest, verify source/artifact hashes and toolchain provenance, and make offline build/prepack copy-and-verify assets for source and compiled lookup. Ordinary users need no compiler, new runtime, download or privilege. Unsupported architecture and missing/corrupt/policy-blocked assets must not bypass policy or repair a mismatch. Verify: source/packed asset parity and differential against those exact bytes.
- [ ] **N1.6 — Review and integrate acquisition routing.** Gate on N1.2p/N1.4c/N1.5 and explicit activation admission. Change only the fresh scalar/shared acquisition seam; keep liveness, public status/error precedence, original-frame fallback, publication/Control/snapshot/teardown checks and callback fences. Never fall back through a supported identity mismatch or replacement. Verify: process/status/observability/results/Control owners and independent review.
- [ ] **N1.7 — Close real SDK/native convergence.** Run the full source-and-packed journeys through the integrated shipping path and obtain the complete three-OS/three-shard matrix plus audit. Keep 87 planned genuine Runs/layout, nine modes, both 40-spawn cohorts, workload 300 s/10 ms, SDK watchdog 900 s Windows/300 s elsewhere, operator-admitted five-second completion-boundary ESRCH settlement after canonical work readiness and separate ten-second original-close acceptance. Other existing eight-second settlement policies remain unchanged. No extra skips, forced exits, signals, fabricated birth/absence or deadline resets/inflation.
- [ ] **N1.9 — Gate further private-cleanup remediation on new evidence.** The intermittent post-research final-PID refusal remains causally unexplained despite a passing release-candidate run; it is not an active red check. The producer/reader inquiry found no ownership omission. Reopen implementation only for a new falsifiable actual-owner mechanism, or explicit admission plus reviewed positive original-generation/resource proof before changing cleanup. Prior absence, close0, an arbitrary mismatch or guessed PID reuse cannot replace fresh ESRCH for every captured safe PID. No repeated role-only inquiry, wait inflation, dropped captures, forced cleanup or luck reruns.

Shared N1 constraints: Retain uncertain roots; fresh ESRCH immediately precedes every deletion. Missing/malformed/query failure never proves absence. Preserve fingerprint schemas/algorithms and saved historical identity bytes, existing optional normalization and `.trim()`, exact falsy/ordered causes and all source/privacy/generation/physical fences. Corrected UTF-8 acquisition must not rewrite old lossy Unicode records or accept legacy aliases; a live mismatch remains `owner_mismatch`. No TTL/cross-callback identity map, daemon, new mandatory platform prerequisite or native-check elision. A prototype pass does not activate a backend. Reuse unchanged evidence semantically; packaged docs/status changes still invalidate an earlier exact tarball.

### R1 — Post-release package-surface review

Exit: Any later cleanup is independently justified and validated against its own tree. The immutable 0.56.0 tag is not a cleanup branch; source/packed presentation and release-narrative acceptance are already covered by the accepted release tree.

- [ ] **R1.1 — Inventory retained inactive foundations before a removal decision.** Identify packaged but unactivated supervision/stream/native-adapter owners, their actual consumers and interleaved safety guards. Produce a reachability/package inventory that distinguishes reviewed runtime dependencies from optional foundations; remove nothing merely by filename or because its default path is off. Default supervision and public completion streams remain disabled. Verify: source/compiled/default-wiring and npm-inventory audit; use existing build/package evidence where inputs are unchanged.
- [ ] **R1.2 — Remove temporary diagnostics after native acceptance.** Gate on N1.7; remove only proven temporary/redundant instrumentation, preserve owned regressions, then refresh invalidated focused checks and final candidate-bound packaging/native evidence. A dirty status note or earlier executable result is not final-tarball proof.

## Evidence and scope notes

The committed baseline of the former backlog is retained in Git at `16a3417`; later operational evidence is linked from the owning design and CI runs. Old candidate logs, review hashes and investigation iterations are evidence, not additional open work. Do not infer completed functionality from a closed author/reviewer process or infer publication/activation from a prototype PASS.