From 49d1906c87feebd5ae06a0cdf4df2c37d0506518 Mon Sep 17 00:00:00 2001 From: Arye Kogan Date: Sat, 4 Jul 2026 06:03:50 +0300 Subject: [PATCH 1/3] docs: record post-M7 sequencing decisions and authorize wave 1 Adds a dated Post-spine decisions (2026-07-04) subsection under M7 in MILESTONES.md, recording the owner's sitting: M7 exit evidence posture (EVRUN-partial mandatory, EVRUN-full as named debt), the internal SDK packaging boundary (N2), TUI/dashboard as extension-point-only, the hybrid smoke target, the wave-1 merge policy, wave-1 authorization (including the M8 proposal), and the repo-plan-m7.md open-question dispositions cited against jig ADRs 0022, 0023, 0024, and 0025. Adds a proposed M8: Planning-discipline uplift milestone entry for owner ratification in this PR's review. Updates ROADMAP.md's jig Next step paragraph to reflect the decided tail direction: transport evidence and packaging boundary authorized, TUI stays extension-point-only, freeze still gated. --- MILESTONES.md | 115 ++++++++++++++++++++++++++++++++++++++++++++++++++ ROADMAP.md | 8 ++-- 2 files changed, 120 insertions(+), 3 deletions(-) diff --git a/MILESTONES.md b/MILESTONES.md index 167f9e6..ee21981 100644 --- a/MILESTONES.md +++ b/MILESTONES.md @@ -496,6 +496,81 @@ before any design or implementation: - Remaining tail items are not automatic continuation work. They require replanning before implementation because they carry product-surface, evidence, policy, or package-boundary decisions outside the Phases 6-9 spine. +- Post-spine decisions (2026-07-04): the owner's sitting after the closeout checkpoint above. + These append to M7; they do not rewrite the closeout text. + 1. **D-EXIT (M7 exit evidence) — Option A.** A committed, redacted, citable real-run evidence + record ("EVRUN") is mandatory for M7 exit either way. The owner accepts that its agent leg + may be a scripted injected session with an explicit Limitations section + ("EVRUN-partial"), with the Codex-driven leg ("EVRUN-full") recorded as a **named debt** + retired by the post-M7 Codex-transport track (N1). M7's `State` above stays `current` and + flips to `done` only when the EVRUN-partial record is merged — per this file's own rule + that a milestone is done only when exit criteria are evidenced. Concrete Codex transport + evidence stays a post-M7 validation adjunct gating any v0 contract freeze, not org-level + exit. Lifecycle-edge split: no codex-plugin-cc-style lifecycle edges (broker, interrupt, + cleanup, Windows process-tree) gate M7 exit; all of them gate the transport ADR and, + through it, the freeze. + 2. **Packaging (N2) — internal SDK boundary now, no publishing.** Rationale: extensibility and + single-responsibility; the SDK's first-party consumers are jig's CLI and a future MCP + surface. Packages stay `private: true`; the posture can flip to public later, and no + stability promise is created now. The third-party (out-of-repo, installable) + provider-ecosystem question explicitly **remains open** as a deferred product question — + the packaging design must not silently assume it either way. Consequence: jig's + packaging/SDK-boundary design cycle (N3) is authorized to start once this decision is + recorded in jig's product docs. + 3. **TUI/dashboard — extension-point-only** (per jig guarantee CFG-7). No first-party TUI + cycle; reopen only on recorded operator pain. Third-party surfaces are enabled through the + observability-records contract plus the internal SDK boundary (decision 2). + 4. **Smoke target (operational) — hybrid.** A local bare git remote serves repeatable + push-path smoke tests (no credentials); a dedicated private sandbox repo + (`jig-smoke-target`) with a repo-scoped fine-grained PAT (env-only, never in records) + serves the full landing evidence (push + PR + merge + block-surfacing); an independent + secret-scan of any evidence record is required before it is committed. + 5. **Merge policy for the wave.** The owner authorized autonomous squash-merge for wave-1 PRs + once review threads are resolved and `pnpm check` is green, except this sequencing PR + itself (`.github`, "docs: record post-M7 sequencing decisions and authorize wave 1"), + which is human-reviewed and human-merged. + 6. **Wave-1 authorization.** The following may start once this PR records the decisions above: + - jig's absorption-ledger absorbed-vs-open update; + - jig's Codex-transport evidence-capture plan, plus a dated/hashed `evidence/` convention; + - jig's product amendment recording decision 2 (packaging/SDK boundary); + - a design-flow item for self-report-only/mock-adequacy conformance vocabulary; + - the EVRUN-partial evidence task, once the smoke target (decision 4) exists; + - M8 below, as a **proposal for owner ratification** in this PR's review — it is not + self-authorizing. + + M6 (Learning Loop Seed) stays `proposed` and is not part of this wave-1 list; pull timing + remains an open org choice. + + 7. **Repo-plan open-question disposition** — `jig/docs/delivery/m7-real-providers/repo-plan-m7.md` + "Open questions to send back to the org roadmap" #1-#3, each verified against the jig ADRs + at the time of this sitting: + - **#1 — sync `describe()` vs async proof: settled by ADR 0022.** + [`jig/docs/design/decisions/0022-phase-6-real-driver-integration.md`](https://github.com/agentic-workflow-kit/jig/blob/main/docs/design/decisions/0022-phase-6-real-driver-integration.md), + Decision 3, "`describe()` stays synchronous — prove-then-describe resolves the + sync/async tension": the confinement proof runs async at compose time, outside + `describe()`, in the host driver's factory; `describe()` stays a pure getter over an + already-computed attestation. No P5-pinned seam surface flexes. Confirm this holds at + the transport-ADR session. + - **#2 — `action`-union / provenance record impact: settled by ADR 0023 and ADR 0024.** + [`jig/docs/design/decisions/0023-phase-7-real-forge-landing.md`](https://github.com/agentic-workflow-kit/jig/blob/main/docs/design/decisions/0023-phase-7-real-forge-landing.md), + Decision 2, repairs `LandingRequest.action` from the single mis-encoded literal + `'push|open-pr|merge'` to the real union `'push' | 'open-pr' | 'merge'` — a local + port-type fix that freezes nothing; the dry-run modeled-landing record keeps recording + the literal token verbatim, so the byte-identity goldens are untouched. + [`jig/docs/design/decisions/0024-phase-8-real-work-source.md`](https://github.com/agentic-workflow-kit/jig/blob/main/docs/design/decisions/0024-phase-8-real-work-source.md), + Decision 3, widens `CandidateWorkItem.provenance` from the single literal + `'jig-validated'` to an origin-bearing shape (source system + candidate identifier), + legible in the run record as an additive field alongside `run.drivers.workSource` — also + a local fix, no records-contract freeze required. Both ADRs confirm no + observability-records v0 field change was needed. + - **#3 — tamper-evidence contract field: resolved for now by ADR 0025.** + [`jig/docs/design/decisions/0025-phase-9-records-integrity.md`](https://github.com/agentic-workflow-kit/jig/blob/main/docs/design/decisions/0025-phase-9-records-integrity.md), + Decision 1 plus Contract Impact Gate Q5: tamper-evidence is computed over existing + durable evidence but materialized on a separate, non-golden integrity sidecar + (`runs//integrity.json`, name design-owned) with an environment-keyed HMAC; no + digest/HMAC field is added to the observability-records v0 contract. The ADR states + this explicitly answers open question 3 and that the freeze posture is re-examined at + the v0-freeze checkpoint (T14), not settled here. - Repo planning handoff: - `jig` derives its repo plan directly from this milestone, decomposing the outcome into its own phases and stories. Org milestones carry no story list; that decomposition lives in @@ -522,6 +597,46 @@ before any design or implementation: - A real run record — with attestation, tamper-evidence, and redacted secrets — can be cited by Learning-loop design. +### M8: Planning-discipline uplift + +- State: proposed — recorded here as a proposal for owner ratification in the PR that adds + this entry; it does not self-authorize on merge of that PR alone. +- Outcome: Enable the Planning layer (and the layers that feed it) to reuse the durable + planning-discipline ideas the prev-gen authoring standard proved out, de-productized from + that legacy corpus rather than ported wholesale, so future planning cycles do not + re-discover the same lessons from scratch. +- Why now: Raised at the 2026-07-04 post-M7 sequencing sitting alongside the M7 exit, + packaging, TUI, smoke-target, and merge-policy decisions, as the owner's forward-looking + planning-quality item for the wave after the M7 spine closed. +- Primary owner: `design-to-plan` +- Participating repos: `design-to-plan`, `technical-design`, `jig`, `.github` +- Owned seam or artifact: Not yet pinned. This entry proposes the milestone; the seam or + artifact it owns (if any) is decided when the milestone is planned, not here. +- Entry criteria: + - The owner ratifies this milestone (this entry is a proposal pending that ratification). + - M7's post-spine decisions above are recorded (this PR). +- Exit criteria: + - Not yet defined. Per this file's Planning Rules, exit criteria are set when the milestone + is planned in detail, not invented ahead of that work; this proposal intentionally leaves + them open rather than guessing at scope the owner has not yet specified. +- Artifacts: Not yet defined; derived when the milestone is planned. +- Repo planning handoff: + - `design-to-plan` derives its own repo plan from M8 once ratified and planned. + - `technical-design` and `jig` participate where the de-productized ideas touch their + layers, but do not decide M8's scope unilaterally. + - Carve-out: jig's `PlanValidator` plan-ingest preflights (the Phase 8 structural intake + chokepoint and related plan-validation feedback) may proceed jig-locally under M4's + existing plan-validation-feedback ownership without waiting for M8. M8 does not gate + work M4 already owns. +- Risks / kill assumptions: + - Fails if it re-imports the legacy authoring standard wholesale instead of de-productizing + only the durable ideas. + - Fails if it duplicates or contests M4's existing plan-validation-feedback ownership rather + than sitting alongside it. + - Fails if "planning discipline" expands into a general planning-layer rewrite instead of a + bounded uplift. +- Evidence when landed: Not yet defined; recorded when the milestone is planned and delivered. + --- ## Deferred From This Sequence diff --git a/ROADMAP.md b/ROADMAP.md index 5e847d3..ea08a92 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -99,9 +99,11 @@ parallel. The current sequence is tracked in [`MILESTONES.md`](./MILESTONES.md). skeleton through the M7 real-provider track. Jig PR #39 merged the Phase 9 records-integrity closeout at `3b3d224`, completing the M7 repo-track spine for real agent/host, Forge, work-source, and records-integrity behavior behind the same contracts. - Tail work now needs replanning before implementation: concrete Codex transport evidence, - TUI/dashboard product-surface design, policy-analyzer timing based on real run history, - and any contract freeze or package extraction decision. + Per the 2026-07-04 post-M7 sequencing decisions (`MILESTONES.md`), the tail is now + replanned rather than open-ended: a Codex-transport evidence-capture track and an internal + SDK packaging boundary (no publishing) are authorized to start; a first-party TUI/dashboard + stays an extension-point-only non-goal; and any v0 contract freeze still waits on M7 exit + evidence plus the packaging and transport decisions. - **References (curated):** - Product (own, drafted): `jig/docs/product/jig.md`, `guarantees.md`, `use-cases.md`, `concepts.md`. From 1865d16a1a8d41a93c9eac7ad118bd32a5ebaab9 Mon Sep 17 00:00:00 2001 From: Arye Kogan Date: Sat, 4 Jul 2026 06:11:41 +0300 Subject: [PATCH 2/3] docs: name the contract-owner role for seam routing and T14 Adds item 8 to the Post-spine decisions (2026-07-04) list: the contract owner for jig's two org seams is jig's design authority (the org/product owner deciding through jig's ADR flow), receiving routed seam-shape questions and alone executing any v0 freeze at T14. Closes the G-OWN gate from the approved plan. --- MILESTONES.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/MILESTONES.md b/MILESTONES.md index ee21981..c9485f9 100644 --- a/MILESTONES.md +++ b/MILESTONES.md @@ -571,6 +571,13 @@ before any design or implementation: digest/HMAC field is added to the observability-records v0 contract. The ADR states this explicitly answers open question 3 and that the freeze posture is re-examined at the v0-freeze checkpoint (T14), not settled here. + 8. **Contract-owner role named.** The contract owner for the two org seams jig owns + (execution-plan, observability-records) — the role that receives routed seam-shape + questions (for example, the transport session-observability question and any + port-surface flex) and that alone executes any v0 contract freeze at the T14 + checkpoint — is jig's design authority: the org/product owner deciding through jig's + ADR flow (`docs/design/decisions/`), per M1's seam ownership. Delivery tracks and + sub-agents do not decide seam shapes (the repo-plan "must not decide" boundary). - Repo planning handoff: - `jig` derives its repo plan directly from this milestone, decomposing the outcome into its own phases and stories. Org milestones carry no story list; that decomposition lives in From 48dab9bd08350f134b36a0b46e28149b146932a0 Mon Sep 17 00:00:00 2001 From: Arye Kogan Date: Sat, 4 Jul 2026 06:15:24 +0300 Subject: [PATCH 3/3] docs: reconcile M7 handoff bullets with post-spine decisions Review follow-up on PR #17: the Repo planning handoff list is live forward guidance, so its open conditionals are updated to reflect the 2026-07-04 post-spine decisions. The TUI bullet now states the extension-point-only decision (decision 3); the transport bullet records the decided posture (decision 1: adjunct gating the freeze, not exit); the v0-freeze bullet points at decisions 1 and 2. The closeout checkpoint and decisions list are untouched. --- MILESTONES.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/MILESTONES.md b/MILESTONES.md index c9485f9..07a593c 100644 --- a/MILESTONES.md +++ b/MILESTONES.md @@ -585,13 +585,20 @@ before any design or implementation: - The real run records M7 emits strengthen M6 seeding, but M6 does not block on M7 — M6's entry is already satisfiable by M1 examples or an M5 record. - Concrete Codex transport evidence or an ADR is a post-M7 validation adjunct unless the - org explicitly decides that shipped transport evidence is required for M7 exit. - - A first-party TUI or dashboard needs product-surface design before implementation. + org explicitly decides that shipped transport evidence is required for M7 exit. Decided + 2026-07-04 (Post-spine decision 1): it remains a post-M7 adjunct gating any v0 freeze, + not org-level exit; M7 exit evidence is the committed EVRUN-partial record. + - A first-party TUI or dashboard is extension-point-only (Post-spine decision 3, + 2026-07-04): no first-party TUI cycle; reopen only on recorded operator pain. + Third-party surfaces build on the observability-records contract and the internal SDK + boundary. - A policy analyzer should wait for enough real run-history data to avoid designing against synthetic or one-off examples. - v0 contract freeze or package extraction is gated by Phase 9 records-integrity evidence from Jig PR #39 plus package-boundary and product decisions; if the org requires concrete transport evidence for M7 exit, that evidence should also precede any freeze. + The package-boundary/product decision is recorded (Post-spine decision 2); the + transport-evidence conditional is resolved by decision 1. - Risks / kill assumptions: - Fails if a real driver can escalate its substrate — argv, credentials, or egress — past what the attestation authorized.