{
  "schema_version": "0.1",
  "artifact_type": "implementation_plan",
  "canonical": true,
  "artifact_id": "IMP-011",
  "agent_summary": {
    "title": "Portable repository module contract implementation plan",
    "status": "approved",
    "summary": "Implement the approved contract additively: freeze conformance, build the deterministic compiler and validator, migrate tools to UTCP authority, add governance and legacy normalization, prove AI-Collab binding parity, then ship downstream only after release gates pass.",
    "last_reviewed_at": "2026-07-15",
    "load_notes": "Canonical JSON; implementation remains future work except for the approved spec/schema/fixture package created with this plan."
  },
  "phases": [
    {"id": "IMP-PHASE-034", "summary": "Contract and compiler foundation", "goal": "Freeze the normative package and compile deterministic manifests from current repository authorities."},
    {"id": "IMP-PHASE-035", "summary": "Tool, governance, and security parity", "goal": "Make UTCP authoritative and add portable roles, experts, teams, providers, permissions, approvals, and secret requirements."},
    {"id": "IMP-PHASE-036", "summary": "Compatibility and AI-Collab conformance", "goal": "Normalize legacy modules once and prove generation-guarded admission, nine-Hub projection, rollback, and cross-spec parity."},
    {"id": "IMP-PHASE-037", "summary": "Downstream delivery and release", "goal": "Ship templates, migrations, docs, validation, and versioned package changes only after full verification."}
  ],
  "tasks": [
    {"id": "IMP-TASK-089", "phase_id": "IMP-PHASE-034", "summary": "Freeze the source-pinned Markdown contract, Draft 2020-12 schema, passive/routable fixtures, negative security/authority fixtures, and canonical PRD/architecture/plan traceability.", "requirement_ids": ["PRD-REQ-073", "PRD-REQ-074", "PRD-REQ-077", "PRD-REQ-078", "PRD-REQ-083"], "architecture_ids": ["ARCH-COMP-058", "ARCH-COMP-063", "ARCH-COMP-064", "ARCH-IF-056"], "validation_ids": ["IMP-VAL-081"], "files": ["docs/specs/repository-module-contract-v1/", "tests/test_repository_module_contract.py", ".prd_plugin/state/artifacts/prd/PRD-010.json", ".prd_plugin/state/artifacts/architecture/ARCH-010.json", ".prd_plugin/state/artifacts/implementation_plan/IMP-011.json"], "red_test": "Run the conformance test before the contract package exists and confirm it fails on the missing schema, prose, and fixtures.", "implementation": "Add the smallest complete normative package and source-pinned planning chain without changing installer/runtime behavior.", "green_test": "Run the focused conformance test and Draft 2020-12 fixture validation; require both valid fixtures to pass and all named invalid fixtures to fail for the intended rule.", "complexity": "medium", "confidence": "high", "risk": "medium", "status": "complete"},
    {"id": "IMP-TASK-090", "phase_id": "IMP-PHASE-034", "summary": "Implement a deterministic module.manifest compiler and validator over services, config inventory, UTCP, skills, workflows, knowledge/state, health, evidence, and install authorities with field provenance and artifact digests.", "requirement_ids": ["PRD-REQ-073", "PRD-REQ-074", "PRD-REQ-075", "PRD-REQ-080", "PRD-REQ-081", "PRD-REQ-082"], "architecture_ids": ["ARCH-COMP-058", "ARCH-COMP-059", "ARCH-COMP-063", "ARCH-IF-051", "ARCH-IF-052"], "validation_ids": ["IMP-VAL-082"], "files": ["scripts/", "templates/", "mcp/", "tests/"], "red_test": "Add compiler tests for deterministic output, unknown fields, duplicate IDs, invalid fallbacks, stale sources, digest drift, and attempts to compile live runtime or secret values.", "implementation": "Compile references and provenance from validated source authorities; expose audit and deterministic output without creating a second editable truth store.", "green_test": "Run compiler/schema/audit tests proving stable output, strict validation, source freshness, secret exclusion, and no direct runtime authority.", "complexity": "x-large", "confidence": "medium", "risk": "high", "status": "planned"},
    {"id": "IMP-TASK-091", "phase_id": "IMP-PHASE-035", "summary": "Migrate the complete PRD Plugin tool catalog to UTCP authority, generate MCP compatibility, preserve guarded mutation semantics in handlers, and expose MCP-only gaps until parity is proven.", "requirement_ids": ["PRD-REQ-076", "PRD-REQ-080", "PRD-NFR-039", "PRD-NFR-040"], "architecture_ids": ["ARCH-COMP-060", "ARCH-COMP-063", "ARCH-IF-054", "ARCH-DEC-049"], "validation_ids": ["IMP-VAL-083"], "files": ["scripts/prd_tools.py", "utcp.json", "mcp/server.cjs", "tests/"], "red_test": "Add catalog parity tests that fail on every MCP-only schema/permission/side-effect gap and on independently authored MCP metadata.", "implementation": "Move canonical definitions to UTCP-compatible source metadata, retain validation/locking/consent in handlers, and produce MCP through the compatibility path.", "green_test": "Run tool enumeration, schema, permission, guarded write, idempotency, timeout, health, and bridge parity tests with no unexplained catalog gaps.", "complexity": "x-large", "confidence": "medium", "risk": "high", "status": "in_progress"},
    {"id": "IMP-TASK-092", "phase_id": "IMP-PHASE-035", "summary": "Add portable role, repo expert, agent profile, team template, provider capability, permission, approval, prompt-layer, and secret-requirement authorities plus validated compiler mappings.", "requirement_ids": ["PRD-REQ-077", "PRD-REQ-078", "PRD-REQ-079", "PRD-REQ-084"], "architecture_ids": ["ARCH-COMP-061", "ARCH-COMP-063", "ARCH-IF-055", "ARCH-DEC-050", "ARCH-DEC-051"], "validation_ids": ["IMP-VAL-084"], "files": ["templates/", "scripts/", "skills/", "tests/"], "red_test": "Add tests for passive/routable conditions, missing roles, live instance/account leakage, self-granted permissions, workspace-policy widening, resolved secrets, and uninspectable prompt layers.", "implementation": "Create source-controlled desired governance templates and validated references while leaving all effective/live roster and provider resolution to AI-Collab.", "green_test": "Run governance/security tests proving conditional expert requirements, no runtime leakage, least authority, inspectable prompt references, and opaque secret handling.", "complexity": "x-large", "confidence": "medium", "risk": "high", "status": "planned"},
    {"id": "IMP-TASK-093", "phase_id": "IMP-PHASE-036", "summary": "Build one legacy-to-manifest adapter boundary with stable capability IDs, source classification, conformance levels, field provenance, missing/unknown quarantine, parity evidence, state/config migrations, and rollback.", "requirement_ids": ["PRD-REQ-082", "PRD-REQ-084", "PRD-NFR-040", "PRD-NFR-041"], "architecture_ids": ["ARCH-COMP-062", "ARCH-COMP-063", "ARCH-IF-053", "ARCH-IF-056", "ARCH-DEC-053"], "validation_ids": ["IMP-VAL-085"], "files": ["scripts/", "templates/", "tests/fixtures/", "tests/"], "red_test": "Add legacy fixtures that expose invented fields, unstable IDs, weaker permissions, lost config/state, Hub-specific adapters, missing rollback, and false conformance upgrades.", "implementation": "Compile legacy authorities through one adapter, mark every field native/derived/missing/legacy, and retain old entry points until parity and rollback pass.", "green_test": "Run native-versus-adapted equivalence tests for identity, capability graph, config/state, permissions, health, app contributions, gaps, and rollback.", "complexity": "x-large", "confidence": "medium", "risk": "high", "status": "planned"},
    {"id": "IMP-TASK-094", "phase_id": "IMP-PHASE-036", "summary": "Align the AI-Collab companion spec and fixtures with stable binding identity, monotonic desired generation, exact revision tuple matching, admission/effective policy, sanitized health/readiness, nine-Hub projection, and stale-result withdrawal.", "requirement_ids": ["PRD-REQ-075", "PRD-REQ-080", "PRD-REQ-083", "PRD-REQ-084"], "architecture_ids": ["ARCH-COMP-064", "ARCH-IF-052", "ARCH-IF-055", "ARCH-IF-056", "ARCH-DEC-048", "ARCH-DEC-052"], "validation_ids": ["IMP-VAL-086"], "files": ["docs/specs/repository-module-contract-v1/fixtures/"], "red_test": "Add cross-spec fixtures that fail on manifest-version binding identity, non-monotonic generations, partial tuple matches, late health resurrection, leaked readiness diagnostics, or Hub projection before admission.", "implementation": "Share the glossary and fixtures with the separately owned AI-Collab binding spec; change this repo only for the portable contract and fixture half.", "green_test": "Run both repositories' conformance suites against identical fixtures and require stale/denied/unknown capabilities to remain absent from all nine Hubs.", "complexity": "large", "confidence": "medium", "risk": "high", "status": "planned"},
    {"id": "IMP-TASK-095", "phase_id": "IMP-PHASE-037", "summary": "Fold the implemented compiler, schemas, templates, migrations, validation, commands/tools, docs/wiki/manual, installer scope, package metadata, and downstream skeleton into one versioned PRD Plugin release.", "requirement_ids": ["PRD-REQ-073", "PRD-REQ-074", "PRD-REQ-075", "PRD-REQ-082"], "architecture_ids": ["ARCH-COMP-058", "ARCH-COMP-059", "ARCH-COMP-062"], "validation_ids": ["IMP-VAL-087"], "files": ["README.md", "docs/", "wiki/", "templates/", "scripts/", "skills/", "package.json", ".codex-plugin/plugin.json", ".opencode/plugin.json"], "red_test": "Add release/gap/installer tests that detect omitted contract files, stale versions, missing migrations, changed protected user state, or inconsistent host/package surfaces.", "implementation": "Use the fold-in and release workflows after implementation parity is green; bump versions only after the pre-bump gap audit.", "green_test": "Run installer, package, docs/wiki/manual, host parity, version, gap, release hygiene, and downstream system tests with zero findings.", "complexity": "x-large", "confidence": "high", "risk": "high", "status": "planned"},
    {"id": "IMP-TASK-096", "phase_id": "IMP-PHASE-037", "summary": "Run security, compatibility, migration, cross-version, cross-spec, code-review, traceability, and release-wide verification; fix every finding before evidence, changelog, commit, merge, tag, or publication claims.", "requirement_ids": ["PRD-REQ-073", "PRD-REQ-074", "PRD-REQ-075", "PRD-REQ-076", "PRD-REQ-077", "PRD-REQ-078", "PRD-REQ-079", "PRD-REQ-080", "PRD-REQ-081", "PRD-REQ-082", "PRD-REQ-083", "PRD-REQ-084"], "architecture_ids": ["ARCH-COMP-058", "ARCH-COMP-059", "ARCH-COMP-060", "ARCH-COMP-061", "ARCH-COMP-062", "ARCH-COMP-063", "ARCH-COMP-064"], "validation_ids": ["IMP-VAL-081", "IMP-VAL-082", "IMP-VAL-083", "IMP-VAL-084", "IMP-VAL-085", "IMP-VAL-086", "IMP-VAL-087", "IMP-VAL-088"], "files": ["tests/", "system_tests/", "scripts/", ".prd_plugin/state/", "docs/"], "red_test": "Freeze the complete verification matrix before implementation and confirm every unimplemented contract track is red for the intended reason.", "implementation": "Review against CRAFTE, repair findings, run focused scopes and one release-wide suite, record evidence, and ship only when every deterministic gate is green.", "green_test": "Require schema/fixture, compiler, tools, governance, secrets, migration, AI-Collab parity, installer, package, state, traceability, local workflow, PRD gate, and release checks to pass.", "complexity": "x-large", "confidence": "high", "risk": "high", "status": "planned"}
  ],
  "validations": [
    {"id": "IMP-VAL-081", "summary": "Normative package and planning-chain tests prove source pins, strict schema, positive/negative fixtures, passive/routable rules, UTCP authority, secret exclusion, and traceability.", "applies_to": ["IMP-TASK-089", "IMP-TASK-096"]},
    {"id": "IMP-VAL-082", "summary": "Compiler tests prove deterministic output, stable IDs, strict fields, provenance/digests, source freshness, fallback rules, no live runtime data, and no competing authority.", "applies_to": ["IMP-TASK-090", "IMP-TASK-096"]},
    {"id": "IMP-VAL-083", "summary": "UTCP/MCP tests prove one canonical catalog, complete metadata, generated compatibility, preserved guarded mutations, and no unexplained projection gap.", "applies_to": ["IMP-TASK-091", "IMP-TASK-096"]},
    {"id": "IMP-VAL-084", "summary": "Governance tests prove conditional repo experts, portable roles/profiles/teams/providers, prompt inspectability, policy precedence, opaque secrets, and exclusion of live accounts/instances.", "applies_to": ["IMP-TASK-092", "IMP-TASK-096"]},
    {"id": "IMP-VAL-085", "summary": "Migration tests prove one normalization boundary, explicit field status, stable identity, state/config preservation, equal-or-stricter permissions, conformance evidence, and rollback.", "applies_to": ["IMP-TASK-093", "IMP-TASK-096"]},
    {"id": "IMP-VAL-086", "summary": "Cross-spec tests prove admission before projection, stable binding identity, monotonic generation, exact revision tuple matching, stale-result withdrawal, sanitized readiness, and consistent nine-Hub state.", "applies_to": ["IMP-TASK-094", "IMP-TASK-096"]},
    {"id": "IMP-VAL-087", "summary": "Downstream/release tests prove additive install/update, protected user state, complete package/template/docs/host/version parity, and reversible migration.", "applies_to": ["IMP-TASK-095", "IMP-TASK-096"]},
    {"id": "IMP-VAL-088", "summary": "Final code-review, state, traceability, security, compatibility, cross-version, full-suite, package, gap, release-hygiene, and PRD gates report zero findings.", "applies_to": ["IMP-TASK-096"]}
  ],
  "evidence_expectations": [
    {"id": "EV-TODO-003", "summary": "Record the RED missing-package result, focused GREEN conformance result, Draft 2020-12 fixture validation, planning traceability review, and verified commit for the approved specification package.", "closes": ["IMP-TASK-089"]},
    {"id": "EV-TODO-004", "summary": "For each future implementation task, record the intended RED result, focused GREEN result, impact-selected verification, review findings and fixes, migration/rollback evidence, and source-linked commit.", "closes": ["IMP-TASK-090", "IMP-TASK-091", "IMP-TASK-092", "IMP-TASK-093", "IMP-TASK-094", "IMP-TASK-095"]},
    {"id": "EV-TODO-005", "summary": "Record cross-repository fixture parity and the final release-wide verification receipt before closing the plan or publishing a release.", "closes": ["IMP-TASK-096"]}
  ],
  "dependencies": [
    "PRD-010 and ARCH-010 remain approved and source-pinned.",
    "AI-Collab owns and implements the companion admission/module.binding specification.",
    "Existing PRD Plugin source authorities remain backwards-readable until native manifest parity and rollback are verified."
  ],
  "risks_and_rollback": [
    "The specification package changes no runtime or installer behavior and can be reverted as one documentation/planning increment.",
    "Future compiler/tool/governance/migration tracks stay independently gated and retain legacy entry points until parity evidence passes.",
    "AI-Collab cutover retains the prior admitted binding and withdraws current projections on any generation, digest, revision, policy, health, or permission mismatch."
  ],
  "traceability": {
    "requirement_ids": ["PRD-REQ-073", "PRD-REQ-074", "PRD-REQ-075", "PRD-REQ-076", "PRD-REQ-077", "PRD-REQ-078", "PRD-REQ-079", "PRD-REQ-080", "PRD-REQ-081", "PRD-REQ-082", "PRD-REQ-083", "PRD-REQ-084"],
    "architecture_ids": ["ARCH-COMP-058", "ARCH-COMP-059", "ARCH-COMP-060", "ARCH-COMP-061", "ARCH-COMP-062", "ARCH-COMP-063", "ARCH-COMP-064"],
    "tracking_ids": [],
    "health_ids": []
  }
}