# OMS Runtime Contract

This contract describes the implemented local TypeScript control plane. It does
not certify a live provider run, unattended endurance, or production readiness.

## MUST

- Keep `.agents/` as the tracked source of truth and preserve user-owned text
  around generated managed blocks.
- Keep runtime automation in Node.js/TypeScript; do not add tracked shell
  automation scripts as an orchestration layer.
- Initialize runtime data only below one validated absolute state root with
  restrictive permissions. Make `init` idempotent and read-only surfaces
  non-creating.
- Keep `doctor`, `verify`, tests, HUD, release status, and the local trace fixture
  offline and deterministic.
- Keep raw ticket content in immutable blobs and pass only opaque IDs or
  absolute file paths across process and future tmux boundaries.
- Require expected versions, attempts, actors, operation nonces, and lease
  tokens at ticket mutation boundaries.
- Validate exact event schemas and consume immutable outbox events through
  idempotent per-consumer receipts.
- Bind session and quota changes to canonical hook events, session versions,
  timestamps, policy identity, and active ticket authority.
- Let deterministic verification vote before and finally; treat grader output as
  supplemental evidence only.
- Keep trust reports review-only and derive canonical trust runs only from live,
  ticket-bound deterministic evidence.
- Keep one canonical OMS goal record; treat native goal, Team, Ultragoal, HUD,
  and report state as checkpoint evidence or projections.
- Persist audit manifests, conductor decisions, goal artifacts, Team plans, and
  service plans immutably and reject conflicting replay.
- Freeze complete ticket admission identity before starting an audit; require
  immutable completion evidence, continuity-safe run events, and an explicit
  exact-generation operation for crashed controller-lock recovery.
- Keep the initial conductor session human-started. Launch executor panes only
  from accepted dispatch delivery after fresh policy, provider, ticket, and
  worktree checks.
- Admit open ready GitHub tickets before notifying the conductor. Keep role,
  model, task, and routing judgment in the conductor skill, not the admission
  command.
- Journal every authorized provider/GitHub contact before contact. After a
  protected pass, permit only the fixed secret-scanned non-force branch and
  draft-PR handoff, then wait for typed PR/check events before
  `READY_FOR_HUMAN`.
- Keep all merge dispositions on human hold and release status fixed to the
  negative-only `not_stable` schema.
- Require a named live confirmation to persist contact/spend disclosure before
  any provider or GitHub contact.

## MUST NOT

- Contact a provider or GitHub from `doctor`, `verify`, tests, HUD, release
  status, the trace fixture, or any command without an explicit named live
  confirmation.
- Use interactive panes to evade metering, authentication, usage limits, or
  provider policy.
- Evaluate untrusted text or send raw issue/model content as tmux keystrokes,
  shell source, service-manager source, a branch name, or a path.
- Let an unaccepted conductor decision invoke a provider, pass untrusted content
  through tmux keys, or claim delivery without a bound receipt.
- Install, enable, start, stop, or remove generated cron, systemd, or launchd
  artifacts.
- Send Slack messages or interpret a request-only event as delivery evidence.
- Let the watchdog resume quota-parked work, retry an external provider, or
  convert a stall report into success.
- Let a grader, trust assessment, HUD, Team plan, or goal projection grant queue,
  execution, release, or merge authority.
- Claim a live GitHub ticket, elapsed canary, provider session, executor-group
  checkpoint, or stable release without independent matching
  evidence.
- Merge automatically, overwrite active queue state from GitHub, or parse a
  positive release state in the current release.
- Mark a draft ready-for-review, merge, force-push, tag, publish, or release
  through the review-delivery path.

## IMPLEMENTATION DONE WHEN

- `make verify` passes from a clean checkout with no network or provider call.
- Unsafe state roots are rejected and read-only commands do not create missing
  runtime state.
- Generated `AGENTS.md`, `CLAUDE.md`, native agents, and skills are idempotent
  while preserving user-owned content.
- The offline ticket fixture reaches human-held completion with deterministic
  evidence before supplemental grading and without tracked source mutation.
- Duplicate hook, outbox, queue, scheduler, watchdog, audit, goal, trust, and
  Team operations replay or fail closed according to their authority.
- Service artifacts are generated immutably but never installed; audit runs and
  conductor routes remain truthful about whether an accepted dispatch produced
  a provider delivery receipt.
- HUD and release status remain read-only and report `not_stable`.
- Runtime, secret, temporary, and log files remain untracked.

## RELEASE REMAINS BLOCKED UNTIL

- one real live GitHub ticket has reviewed evidence;
- an elapsed 12-hour canary and a fresh elapsed 24-hour canary have reviewed
  evidence;
- a real executor-group delivery plus normal per-ticket deterministic checks and
  opposite-engine grade are captured; and
- a future reviewed positive-release design, if one is wanted, explicitly
  grants authority. The current implementation intentionally cannot do so.