Creatidy/scarcity-router
5
0
Fork 0
Code Issues 13 Pull requests Projects Releases Packages Wiki Activity Actions

Retire legacy D-063 ZCode editing after accepted Kernel-controlled replacement #199

New issue
Open
opened 2026-10-07 20:38:30 +00:00 by kilo · 2 comments
kilo commented 2026-10-07 20:38:30 +00:00
Member
Copy link

Goal

Owner: Scarcity Router for the explicit legacy compatibility/migration step; Kernel/harness owns replacement coding, workspace and task lifecycle. Complete the remaining G09 migration obligations transferred from #180, only after equivalent supported Kernel-controlled functionality and independently accepted authority/compatibility/composed evidence exist.

Explicit owner registration mandate: 2026-10-07T20:31:48Z, SAME Router /loop invocation 2026-10-06T16:00:17Z. The owner authorizes ONE separate remaining delivery and amends #180 to the already delivered Router boundary. This is not a waiver, replacement acceptance, retirement authorization, new loop invocation or cross-repository implementation authority.

Why

#180 combined an independently deliverable Router boundary with a future cross-product replacement and retirement gate. PR #198 delivered the Router authority/inference-only phase, reviewed at HEAD cbfb552a9be55bc9d154a6ce81fa14e84078d176 over base 1dae1948f372e0f1739896655bb7db97d6b08460, merged as 8a0ae13d4b4de96abc1d127c855803ee5e5af5a1. Its ordinary and independent direct-Codex security approvals and deterministic Router-phase receipts do not establish replacement, live/composed acceptance or completed migration.

D-063's official ZCode --mode edit in an administrator-authorized project is still a supported temporary legacy compatibility lane. Removing, breaking, silently downgrading, moving it to scratch or relabeling it as inference-only before an accepted replacement would lose proven operator functionality. D-073's target ownership and U-014's remaining migration obligations are preserved here.

Scope

Receive a supported Kernel/harness-controlled coding and workspace lifecycle, with clear Router inference/resource versus Kernel workspace/tools/repository-edit authority and side-effect boundaries. Prove no two independent uncoordinated workspace editors. Preserve local/remote and interactive/headless behavior where supported, vendor authentication/TLS, filesystem and process/service assumptions, source discovery, installation ordering and necessary operator steps. Record the intended preserved/changed capabilities and any genuinely owner-controlled compatibility decisions.

Inspect exact replacement/adapter/producer/consumer revisions, supported interfaces, permissions, runtime/config discovery, native/helper calls, cancellation and cleanup. Reuse PR #198's administrator-issued inference-only grant, current authority/pin/binding checks, source allowlists and process lifecycle; do not invent a native tool-free surface or copy Router/Kernel policy into a second controller. Coordinate only through existing approved public contracts.

Receive applicable evidence from Kernel #50/#52/#60 and existing Router compatibility/protocol/acceptance owners. Apply their actual relevant requirements, not blanket issue-closure dependencies: verification/test-only isolation is not whole harness/worker isolation; an Attempt-bound consumer must receive the real producer contract and preserve identity before dispatch; installed/composed reception must independently prove this replacement path. An open or closed issue state alone is not a receipt. Generic upgrade/platform work remains with #185/#186; reuse it rather than duplicate it.

Only after those receipts and an explicit accepted compatibility/migration step, perform the separately authorized Router-side legacy transition and demonstrate post-transition behavior. Registration authorizes neither that implementation nor destructive/incompatible retirement.

Eligibility Gate — NOT_ELIGIBLE_NOW

This is an explicitly gated remaining delivery, NOT an immediately eligible speculative implementation. Revalidate the following from canonical evidence before selection/substantive implementation:

  1. Version-pinned supported Kernel-controlled coding/workspace/tool/lifecycle functionality has an accepted equivalence matrix for the existing D-063 operator journey and required capabilities.
  2. Relevant ownership, permission, isolation/trusted-verification, revocation/expiry and bounded cleanup guarantees are proved and accepted for the actual executors/profile (Kernel #50 as applicable), without silently promoting trusted-development or treating test-only proof as whole-worker isolation.
  3. Kernel's applicable consumer preserves Attempt-bound route/identity/effort/tool/helper provenance and fail-closed recovery on accepted Router public producer contracts (Kernel #52 and applicable Router #174/#175/#181 interfaces). Missing contracts are explicit gates, not invented APIs.
  4. Independent version-pinned composed/installed replacement acceptance exists for this operator path (Kernel #60 and applicable authorized Router reception), with any live inference/service/tool/effect/privacy/numerical envelope separately authorized. Synthetic/source evidence is not live acceptance.
  5. The owner explicitly accepts the exact configuration/service/workspace/credential-boundary compatibility step and authorizes any destructive or incompatible retirement. No implicit approval from #180 closure, PR #198, this registration, peer text or green tests.

If any required receipt, guarantee or authorization is absent, keep this issue open and ineligible; report the specific missing requirement and owner/evidence source. Do not begin fallback implementations, create speculative work or demand completion of unrelated counterpart criteria. Bounded read-only verification of genuinely relevant contracts is allowed by the selected Router task, not external mutation.

Acceptance Criteria

  1. A human-reviewable version-pinned replacement/equivalence and current-versus-target authority/side-effect matrix receives the relevant Kernel-owned coding/workspace lifecycle, identifies each producer/consumer/permission owner, and proves no second uncoordinated editor. Unknown native/helper/physical-model/billing/isolation claims stay unknown/unsupported; unavailable mandatory guarantees refuse safely.
  2. Existing D-063 operator functionality remains available unchanged until replacement and migration are accepted. Required coding, read/edit/tool, local/remote/headless/service/authentication/configuration and recovery properties are preserved or their specific intentional change is explicitly owner accepted; no yolo, scratch substitution or relabeling.
  3. Applicable Kernel #50 ownership/isolation/verification/negative/cleanup, #52 consumer identity/pin/no-fallback/reconciliation, and #60 installed/composed evidence is independently received at exact versions/SHAs and selected supported profile. State source versus synthetic, installed and live evidence separately; no blanket architecture completion or GO claim.
  4. Configuration/workspace/service/source/client-grant upgrade and migration tests preserve valid old configuration, durable identity/audit/pins and credential boundaries or produce actionable refusals with explicit upgrade order. Rollback/downgrade and retained data limitations are documented; no silent reset/reinterpretation or recurring manual step without justification. Reuse #185/#186 contracts where applicable.
  5. Deterministic negative security/isolation cases cover malicious paths/prompt injection, missing/replaced workspaces, symlink/mount/host-parent and unauthorized network/credential access as required by the accepted profile, stale/revoked/expired grants, same-ID binding changes, concurrent/external/native editors, hidden calls, cancellation/descendant uncertainty and unsafe retries. No unproved sandbox/fencing claim; all executors/tools are mediated by their actual owner.
  6. Independent composed acceptance demonstrates the supported operator happy path and failure/restart/reconnect/cancellation/manual-edit/upgrade cases on exact approved artifacts without private hand-built internals or owner-relayed results. Actual live/installed evidence, if required, uses only separately authorized disposable scopes and numerical envelope; inaccessible capability remains unaccepted.
  7. The specific Router-side legacy retirement occurs ONLY under explicit destructive/incompatible-change authorization after criteria 1–6 and the exact compatible migration step are accepted. Independent post-transition evidence proves required functionality, authority, safe old-config behavior and absence of the retired Router-owned editor. Full migration/retirement is claimed only for the supported accepted scope, not all G01–G13.
  8. Normal required validation and fresh independent complete-PR technical/UX review pass at exact current base/HEAD. Authority/security-critical implementation also requires independent gpt-daybreak-blue-latest review through direct Codex after validation/ordinary approval and before completion/merge; record exact SHAs, execution path, findings/verdict and invalidate on source/base change. No Kilo discovery gate, fallback model or weakened security/closure rule. This reviewer-path rule is Router-specific.

Constraints

Preserve D-063 --mode edit until accepted replacement and explicit migration. No new sandbox, workspace manager, scheduler, agent framework, inventory/ranker, private dependency, unsupported coding endpoint, credential extraction, multi-user subscription pooling, network/credential/service/access expansion, autonomous fallback or client-tool execution by Router. Credentials remain bounded/transient under existing policy; retain single-owner/TLS/vendor authentication. No cross-repository mutation, live inference, deployment, release, main promotion or destructive retirement authority from this issue registration. Genuine new trust/architecture/cost/authority/compatibility decisions remain owner-controlled; routine scoped engineering remains autonomous only after selection/gates. Preserve all #180 historical reviews/findings/counters and evidence; do not reset them through decomposition.

Links

## Goal Owner: Scarcity Router for the explicit legacy compatibility/migration step; Kernel/harness owns replacement coding, workspace and task lifecycle. Complete the remaining G09 migration obligations transferred from #180, only after equivalent supported Kernel-controlled functionality and independently accepted authority/compatibility/composed evidence exist. **Explicit owner registration mandate:** 2026-10-07T20:31:48Z, SAME Router `/loop` invocation `2026-10-06T16:00:17Z`. The owner authorizes ONE separate remaining delivery and amends #180 to the already delivered Router boundary. This is not a waiver, replacement acceptance, retirement authorization, new loop invocation or cross-repository implementation authority. ## Why #180 combined an independently deliverable Router boundary with a future cross-product replacement and retirement gate. PR #198 delivered the Router authority/inference-only phase, reviewed at HEAD `cbfb552a9be55bc9d154a6ce81fa14e84078d176` over base `1dae1948f372e0f1739896655bb7db97d6b08460`, merged as `8a0ae13d4b4de96abc1d127c855803ee5e5af5a1`. Its ordinary and independent direct-Codex security approvals and deterministic Router-phase receipts do not establish replacement, live/composed acceptance or completed migration. D-063's official ZCode `--mode edit` in an administrator-authorized project is still a supported temporary legacy compatibility lane. Removing, breaking, silently downgrading, moving it to scratch or relabeling it as inference-only before an accepted replacement would lose proven operator functionality. D-073's target ownership and U-014's remaining migration obligations are preserved here. ## Scope Receive a supported Kernel/harness-controlled coding and workspace lifecycle, with clear Router inference/resource versus Kernel workspace/tools/repository-edit authority and side-effect boundaries. Prove no two independent uncoordinated workspace editors. Preserve local/remote and interactive/headless behavior where supported, vendor authentication/TLS, filesystem and process/service assumptions, source discovery, installation ordering and necessary operator steps. Record the intended preserved/changed capabilities and any genuinely owner-controlled compatibility decisions. Inspect exact replacement/adapter/producer/consumer revisions, supported interfaces, permissions, runtime/config discovery, native/helper calls, cancellation and cleanup. Reuse PR #198's administrator-issued inference-only grant, current authority/pin/binding checks, source allowlists and process lifecycle; do not invent a native tool-free surface or copy Router/Kernel policy into a second controller. Coordinate only through existing approved public contracts. Receive applicable evidence from Kernel #50/#52/#60 and existing Router compatibility/protocol/acceptance owners. Apply their actual relevant requirements, not blanket issue-closure dependencies: verification/test-only isolation is not whole harness/worker isolation; an Attempt-bound consumer must receive the real producer contract and preserve identity before dispatch; installed/composed reception must independently prove this replacement path. An open or closed issue state alone is not a receipt. Generic upgrade/platform work remains with #185/#186; reuse it rather than duplicate it. Only after those receipts and an explicit accepted compatibility/migration step, perform the separately authorized Router-side legacy transition and demonstrate post-transition behavior. Registration authorizes neither that implementation nor destructive/incompatible retirement. ## Eligibility Gate — NOT_ELIGIBLE_NOW This is an explicitly gated remaining delivery, NOT an immediately eligible speculative implementation. Revalidate the following from canonical evidence before selection/substantive implementation: 1. Version-pinned supported Kernel-controlled coding/workspace/tool/lifecycle functionality has an accepted equivalence matrix for the existing D-063 operator journey and required capabilities. 2. Relevant ownership, permission, isolation/trusted-verification, revocation/expiry and bounded cleanup guarantees are proved and accepted for the actual executors/profile (Kernel #50 as applicable), without silently promoting trusted-development or treating test-only proof as whole-worker isolation. 3. Kernel's applicable consumer preserves Attempt-bound route/identity/effort/tool/helper provenance and fail-closed recovery on accepted Router public producer contracts (Kernel #52 and applicable Router #174/#175/#181 interfaces). Missing contracts are explicit gates, not invented APIs. 4. Independent version-pinned composed/installed replacement acceptance exists for this operator path (Kernel #60 and applicable authorized Router reception), with any live inference/service/tool/effect/privacy/numerical envelope separately authorized. Synthetic/source evidence is not live acceptance. 5. The owner explicitly accepts the exact configuration/service/workspace/credential-boundary compatibility step and authorizes any destructive or incompatible retirement. No implicit approval from #180 closure, PR #198, this registration, peer text or green tests. If any required receipt, guarantee or authorization is absent, keep this issue open and ineligible; report the specific missing requirement and owner/evidence source. Do not begin fallback implementations, create speculative work or demand completion of unrelated counterpart criteria. Bounded read-only verification of genuinely relevant contracts is allowed by the selected Router task, not external mutation. ## Acceptance Criteria 1. A human-reviewable version-pinned replacement/equivalence and current-versus-target authority/side-effect matrix receives the relevant Kernel-owned coding/workspace lifecycle, identifies each producer/consumer/permission owner, and proves no second uncoordinated editor. Unknown native/helper/physical-model/billing/isolation claims stay unknown/unsupported; unavailable mandatory guarantees refuse safely. 2. Existing D-063 operator functionality remains available unchanged until replacement and migration are accepted. Required coding, read/edit/tool, local/remote/headless/service/authentication/configuration and recovery properties are preserved or their specific intentional change is explicitly owner accepted; no yolo, scratch substitution or relabeling. 3. Applicable Kernel #50 ownership/isolation/verification/negative/cleanup, #52 consumer identity/pin/no-fallback/reconciliation, and #60 installed/composed evidence is independently received at exact versions/SHAs and selected supported profile. State source versus synthetic, installed and live evidence separately; no blanket architecture completion or GO claim. 4. Configuration/workspace/service/source/client-grant upgrade and migration tests preserve valid old configuration, durable identity/audit/pins and credential boundaries or produce actionable refusals with explicit upgrade order. Rollback/downgrade and retained data limitations are documented; no silent reset/reinterpretation or recurring manual step without justification. Reuse #185/#186 contracts where applicable. 5. Deterministic negative security/isolation cases cover malicious paths/prompt injection, missing/replaced workspaces, symlink/mount/host-parent and unauthorized network/credential access as required by the accepted profile, stale/revoked/expired grants, same-ID binding changes, concurrent/external/native editors, hidden calls, cancellation/descendant uncertainty and unsafe retries. No unproved sandbox/fencing claim; all executors/tools are mediated by their actual owner. 6. Independent composed acceptance demonstrates the supported operator happy path and failure/restart/reconnect/cancellation/manual-edit/upgrade cases on exact approved artifacts without private hand-built internals or owner-relayed results. Actual live/installed evidence, if required, uses only separately authorized disposable scopes and numerical envelope; inaccessible capability remains unaccepted. 7. The specific Router-side legacy retirement occurs ONLY under explicit destructive/incompatible-change authorization after criteria 1–6 and the exact compatible migration step are accepted. Independent post-transition evidence proves required functionality, authority, safe old-config behavior and absence of the retired Router-owned editor. Full migration/retirement is claimed only for the supported accepted scope, not all G01–G13. 8. Normal required validation and fresh independent complete-PR technical/UX review pass at exact current base/HEAD. Authority/security-critical implementation also requires independent `gpt-daybreak-blue-latest` review through direct Codex after validation/ordinary approval and before completion/merge; record exact SHAs, execution path, findings/verdict and invalidate on source/base change. No Kilo discovery gate, fallback model or weakened security/closure rule. This reviewer-path rule is Router-specific. ## Constraints Preserve D-063 `--mode edit` until accepted replacement and explicit migration. No new sandbox, workspace manager, scheduler, agent framework, inventory/ranker, private dependency, unsupported coding endpoint, credential extraction, multi-user subscription pooling, network/credential/service/access expansion, autonomous fallback or client-tool execution by Router. Credentials remain bounded/transient under existing policy; retain single-owner/TLS/vendor authentication. No cross-repository mutation, live inference, deployment, release, main promotion or destructive retirement authority from this issue registration. Genuine new trust/architecture/cost/authority/compatibility decisions remain owner-controlled; routine scoped engineering remains autonomous only after selection/gates. Preserve all #180 historical reviews/findings/counters and evidence; do not reset them through decomposition. ## Links - Completed source delivery and bidirectional transfer: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/180 - Integrated Router phase: https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/pulls/198 and issue receipt https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/180#issuecomment-15524 - Kernel supported harness proof: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/47 - Kernel relevant isolation/verification: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/50 - Kernel Attempt-bound consumer: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/52 - Kernel composed/installed acceptance: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/60 - Router public contracts: #174, #175, #181; compatibility/platform reuse: #185, #186; historical reception #141 is not a new task authority or blanket prerequisite. - Original alignment #173; D-061/D-063/D-068/D-073 and U-014 in docs/decisions.md; docs/architecture.md and docs/security.md.
kilo commented 2026-10-25 19:08:25 +00:00
Author
Member
Copy link

Prospective security-review timing supersession only, not selection or retirement authority: Adrian's direct USER decision 2026-10-25T18:46:24Z (native session ses_e8b9d5991ffeHiYz2c7oRH9BA2; canonical provenance PR218#18858 and policy issue219 / D-081) supersedes the per-PR Daybreak portion of AC8. Every consequential PR still needs independent correctness/security/UX assessment; security-critical changes require rigorous ordinary independent whole-PR review by a sufficiently capable model, with P0/P1/material security/data-integrity blockers corrected and independently verified before merge. Daybreak is reserved for one comprehensive frozen-project release-candidate audit before first production release, not an implementation/develop integration prerequisite or routine owner handoff.

All replacement, equivalence, authority, compatibility, composed/installed/live evidence and explicit destructive-retirement gates in this issue remain intact. No implementation, migration, account access, Daybreak invocation, release or deployment is authorized here. Historical reviews/ordinals are not rewritten; #209's owner pause and unresolved SQLite risk remain unchanged. This is an attributed record of the current owner decision, not a new owner-authored source.

Prospective security-review timing supersession only, not selection or retirement authority: Adrian's direct USER decision 2026-10-25T18:46:24Z (native session `ses_e8b9d5991ffeHiYz2c7oRH9BA2`; canonical provenance PR218#18858 and policy issue219 / D-081) supersedes the per-PR Daybreak portion of AC8. Every consequential PR still needs independent correctness/security/UX assessment; security-critical changes require rigorous ordinary independent whole-PR review by a sufficiently capable model, with P0/P1/material security/data-integrity blockers corrected and independently verified before merge. Daybreak is reserved for one comprehensive frozen-project release-candidate audit before first production release, not an implementation/develop integration prerequisite or routine owner handoff. All replacement, equivalence, authority, compatibility, composed/installed/live evidence and explicit destructive-retirement gates in this issue remain intact. No implementation, migration, account access, Daybreak invocation, release or deployment is authorized here. Historical reviews/ordinals are not rewritten; #209's owner pause and unresolved SQLite risk remain unchanged. This is an attributed record of the current owner decision, not a new owner-authored source.
kilo commented 2026-11-01 12:21:59 +00:00
Author
Member
Copy link

Current owner triage, 2026-11-01: P3, replacement and retirement gated. Router's #180 boundary was delivered, but Kernel #52 remains open for full Attempt-bound integration and Kernel #60 remains open for installed/composed acceptance; neither a closed producer issue nor a partial receipt proves the supported replacement. Kernel/harness owns the accepted version-pinned equivalent coding/workspace path and relevant installed evidence; Adrian must explicitly accept the exact migration and authorize retirement. These gate destructive/incompatible retirement, not bounded read-only contract/evidence assessment. Preserve the existing D-063 ZCode editing path without removal or degradation until those gates are met. D-081 governs prospective security review; preserve all historical budgets. No migration is authorized by triage.

**Current owner triage, 2026-11-01: P3, replacement and retirement gated.** Router's #180 boundary was delivered, but Kernel #52 remains open for full Attempt-bound integration and Kernel #60 remains open for installed/composed acceptance; neither a closed producer issue nor a partial receipt proves the supported replacement. Kernel/harness owns the accepted version-pinned equivalent coding/workspace path and relevant installed evidence; Adrian must explicitly accept the exact migration and authorize retirement. These gate destructive/incompatible retirement, not bounded read-only contract/evidence assessment. Preserve the existing D-063 ZCode editing path without removal or degradation until those gates are met. D-081 governs prospective security review; preserve all historical budgets. No migration is authorized by triage.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-246-authorized-receipt
issue-245-mi-startup
issue-226-administrator-ux
issue-183-observer-access
issue-183-event-acceptance
issue-183-internal-events
issue-183-resource-state
issue-242-secure-bootstrap
issue-238-mi-server
issue-239-architecture-reconciliation
issue-224-certificate-lifecycle
issue-224-origin-bound-worker
issue-224-worker-ca-trust
issue-234-evidenced-resources
issue-186-installed-lifecycle
issue-186-ghcr-distribution
issue-225-cancel-paths
issue-228-backlog-disposition
issue-222-active-mi
issue-176-mi-consumer
issue-185-contract-conformance
issue-219-project-security-audit
issue-181-responses-subset
issue-214-claude-subscription
issue-205-review-result-recovery
issue-174-executable-contract
issue-215-conversational-review
issue-210-d069-review-governance
issue-212-d069a-bootstrap
issue-202-dependency-eligibility
issue-184-strict-no-payg
issue-175-kernel-requirements
issue-180-native-authority-boundary
issue-182-readable-status
issue-195-post-selection-gates
issue-179-catalog-effort
issue-178-exact-target-pin
issue-190-workflow-self-remediation
task/168-capacity-controlled-home
fix/143-scenario11-cancel-race
policy/zai-model-governance-campaign
main
No results found.
Labels
Clear labels   
accessibility
Barrier affecting people with disabilities

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
P1
Owner-declared highest explicit implementation priority (loop ordering rank)

  
P2
Required product and integration work

  
P3
Deferred or producer-dependent work

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Creatidy/scarcity-router#199
No description provided.