jason.woltje
ad21ad7ac5
ci/woodpecker/pr/ci Pipeline failed
Ratifies the Mosaic Stack PRD rev1 (Jason Woltje, 2026-09-01) as project source of truth and installs the GOV.1 lifecycle model: - docs/PRD.md becomes a permanent shim (kind: shim, current_rev -> docs/PRDs/2026-08-31_PRD_rev1/). Its path never changes again. - docs/PRDs/2026-08-26_PRD_rev0/PRD.md archives the 2026-08-26 North Star verbatim (sha256 60cc2f98...36afdf unchanged). Archive, never delete. - docs/PRDs/2026-08-31_PRD_rev1/ is the frozen rev1 bundle: 18 sectioned documents (VIS, DATA, AUTHN, AUTHZ, SEAT, ROLE, HARN, PROV, SESS, UI, CLI, GOV.1-5) consolidating rev0 D1-D15, the fleet north star, the agent-runtime L1/L2 contracts and the control-plane-surfaces lane findings, with a single decision map (GOV.3) and a closed open-questions frontier (GOV.5, grill rounds 1-8). Drafting inputs (_source-* snapshots) are not shipped. Consequences of the ratified rulings carried in the same change: - Q-T1 (ruling B, "shipped but frozen"): D3 amended in GOV.3/VIS.1; federation M1-M3 acknowledged as shipped behind tier === 'federated', excluded from the v1 bar and frozen, with a security re-audit gate before any resumption. docs/MISSION-MANIFEST.md, docs/federation/MISSION-MANIFEST.md and docs/scratchpads/mvp-20260312.md get status: superseded + banners (content preserved verbatim); docs/guides/deployment.md gains a "Relationship to the PRD (D15)" section. NORTH_STAR.yaml adds dormant workstream M (projects no goals by design); NORTH_STAR.md regenerated. - Q-G2 (distinct registry prefixes): every citation of the operator DECISION-REGISTER in the bundle reads OD-nn; the stack registry stays D1-D15; L1-Dnn/L2-Dnn untouched. Prefix rule recorded in GOV.1. Follow-ups (not in this PR): CI parity drift-gate witness (Q-C1); brain-side DECISION-REGISTER rename to OD- with redirect table on its next touch.
64 lines
3.3 KiB
Markdown
64 lines
3.3 KiB
Markdown
---
|
|
id: HARN.1
|
|
status: ratified
|
|
ratified: 2026-09-01 (Jason Woltje; PRD rev1 ratification PR)
|
|
---
|
|
|
|
# HARN.1 — Harness configuration
|
|
|
|
A harness is an installed agent runtime (claude, pi, codex, opencode, …).
|
|
Shared contracts speak capability language; harness commands, model IDs,
|
|
hooks, and settings live in runtime adapters (register OD-38).
|
|
|
|
## Harness configuration surface (WebUI page + CLI)
|
|
|
|
| Control | Notes |
|
|
|---|---|
|
|
| install harness | single button push; installer runs server-side through official tooling |
|
|
| enable / disable | disabled harnesses are not selectable on any seat page |
|
|
| available models | an **allowlist** a seat may select from — not a selection. Whether `enabledModels` is role policy or harness/seat preference is open: [[GOV.5-open-questions]] Q-H1 |
|
|
| reasoning level defaults | |
|
|
| provider | which provider(s) back this harness ([[PROV.1-providers]]) |
|
|
| linked auth accounts | which accounts may drive this harness ([[AUTHN.1-auth-accounts]]) |
|
|
|
|
Enable/disable and install are runtime state (Postgres-owned) projected into
|
|
whatever flat state the launcher needs ([[DATA.1-record-authority]]).
|
|
## Runtime adapter contract (pulled 2026-08-31 from adapter-contract draft)
|
|
|
|
Every harness adapter binds a required capability set or **fails closed**:
|
|
repository ops via wrapper capability, scoped file/command execution,
|
|
structured reasoning, shared-memory capture/search/recall, inter-seat
|
|
messaging/wake, checkpoint persistence + mechanical telemetry, a `mosaic coord`
|
|
client that cannot mutate Kanban state or deploy seats directly, and credential
|
|
resolution through the seat's own slot. Rules:
|
|
|
|
- An unavailable capability is a **named blocker**, never silent degradation.
|
|
**"Prompt adherence is not an enforcement mechanism"** — a harness that
|
|
cannot persist checkpoints, emit telemetry, or honor fencing does not run
|
|
workflows that need them.
|
|
- Each adapter publishes a capability→binding table (capability, binding
|
|
surface, config source, verification check) and proves its bindings at
|
|
session start; verification failure is a named blocker.
|
|
- Adapters bind capabilities but **never redefine role authority, delivery
|
|
policy, gate outcomes, or review independence** — a harness whose native
|
|
workflow conflicts with shared policy keeps the shared policy and records the
|
|
conflict as an adapter limitation.
|
|
|
|
## E2 inputs (triage 2026-08-31; see [[GOV.2-docs-inventory]])
|
|
|
|
**Canonical ground truth**: the `fleet/` book — `concepts/desired-vs-observed-state.md`
|
|
(roster-v2 sole writable authority), `concepts/generated-env-launch-chain.md` +
|
|
`reference/generated-env-boundary.md`, `reference/roster-v2-fields.md`,
|
|
`operations/reconcile-and-recover.md` (lock/generation semantics),
|
|
`NORTH_STAR.md`/`FLEET-DOCTRINE.md` (delivery-fleet north star, subordinate to
|
|
this PRD per rev0 §10).
|
|
**Pending pulls**: brain `docs/guides/proposed/runtime/adapter-contract.md`
|
|
(the register-OD-38 runtime-adapter capability contract this section cites).
|
|
|
|
## enabledModels ruling (Q-D4, Jason 2026-09-01)
|
|
|
|
The Role Revision defines the allowed model set — a policy ceiling. The seat
|
|
records model preferences within that set. Effective models = the
|
|
intersection, consistent with the L2-D39 authority-intersection chain. A seat
|
|
preference outside the role ceiling is refused, not silently clamped.
|